netdev - Re: [PATCH net] mptcp: fix double-unlock in mptcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20200412.210508.28307843911867097.davem@davemloft.net>
Date:   Sun, 12 Apr 2020 21:05:08 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     fw@...len.de
Cc:     netdev@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        mptcp@...ts.01.org,
        syzbot+e56606435b7bfeea8cf5@...kaller.appspotmail.com
Subject: Re: [PATCH net] mptcp: fix double-unlock in mptcp_poll

From: Florian Westphal <fw@...len.de>
Date: Sat, 11 Apr 2020 21:05:01 +0200

> mptcp_connect/28740 is trying to release lock (sk_lock-AF_INET) at:
> [<ffffffff82c15869>] mptcp_poll+0xb9/0x550
> but there are no more locks to release!
> Call Trace:
>  lock_release+0x50f/0x750
>  release_sock+0x171/0x1b0
>  mptcp_poll+0xb9/0x550
>  sock_poll+0x157/0x470
>  ? get_net_ns+0xb0/0xb0
>  do_sys_poll+0x63c/0xdd0
> 
> Problem is that __mptcp_tcp_fallback() releases the mptcp socket lock,
> but after recent change it doesn't do this in all of its return paths.
> 
> To fix this, remove the unlock from __mptcp_tcp_fallback() and
> always do the unlock in the caller.
> 
> Also add a small comment as to why we have this
> __mptcp_needs_tcp_fallback().
> 
> Fixes: 0b4f33def7bbde ("mptcp: fix tcp fallback crash")
> Reported-by: syzbot+e56606435b7bfeea8cf5@...kaller.appspotmail.com
> Signed-off-by: Florian Westphal <fw@...len.de>
> ---
>  NB: Reproducer did not trigger for me, so i can't be 100% sure,
>  but looking at the 'Fixes' commit the change to
>  __mptcp_needs_tcp_fallback was broken.

Applied, thanks Florian.