netdev - Re: [PATCH] tipc: fix shutdown() of connectionless socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 3 Sep 2020 14:05:15 +0200
From:   Wouter Verhelst <w@...r.be>
To:     Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc:     syzbot <syzbot+e36f41d207137b5d12f7@...kaller.appspotmail.com>,
        Jon Maloy <jmaloy@...hat.com>,
        Ying Xue <ying.xue@...driver.com>,
        syzkaller-bugs@...glegroups.com,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org,
        tipc-discussion@...ts.sourceforge.net
Subject: Re: [PATCH] tipc: fix shutdown() of connectionless socket

On Thu, Sep 03, 2020 at 08:57:01PM +0900, Tetsuo Handa wrote:
> On 2020/09/03 20:31, Wouter Verhelst wrote:
> > So.
> > 
> > On Wed, Sep 02, 2020 at 08:09:54PM +0900, Tetsuo Handa wrote:
> >> syzbot is reporting hung task at nbd_ioctl() [1], for there are two
> >> problems regarding TIPC's connectionless socket's shutdown() operation.
> >> I found C reproducer for this problem (shown below) from "no output from
> >> test machine (2)" report.
> >>
> >> ----------
> >>
> >> int main(int argc, char *argv[])
> >> {
> >>         const int fd = open("/dev/nbd0", 3);
> >>         ioctl(fd, NBD_SET_SOCK, socket(PF_TIPC, SOCK_DGRAM, 0));
> > 
> > NBD expects a stream socket, not a datagram one.
> > 
> >>         ioctl(fd, NBD_DO_IT, 0);
> > 
> > This is supposed to sit and wait until someone disconnects the device
> > again (which you probably cna't do with datagram sockets). Changing that
> > changes a userspace API.
> > 
> 
> Excuse me, but other datagram sockets (e.g. socket(PF_INET, SOCK_DGRAM, 0)) does not
> hit this problem. What do you want to do? Add a "whether the file descriptor passed
> to ioctl(NBD_SET_SOCK) is a SOCK_STREAM socket" test to the NBD side?

I missed originally that you were checking whether the passed socket is
in fact a SOCK_DGRAM socket, and limiting the changes to that. That's
fine, because NBD doesn't deal with SOCK_DGRAM sockets anyway (i.e.,
passing a SOCK_DGRAM socket to the NBD device is undefined behavior). If
the behavior also changes for SOCK_STREAM sockets then that would be a
problem that would need to be reverted, but otherwise it's fine.

-- 
To the thief who stole my anti-depressants: I hope you're happy

  -- seen somewhere on the Internet on a photo of a billboard