netdev - Re: [PATCH net 1/2] mptcp: fix possible divide by zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210830165705.1f0dbafc@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Mon, 30 Aug 2021 16:57:05 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Mat Martineau <mathew.j.martineau@...ux.intel.com>
Cc:     netdev@...r.kernel.org, Paolo Abeni <pabeni@...hat.com>,
        davem@...emloft.net, matthieu.baerts@...sares.net,
        mptcp@...ts.linux.dev, Florian Westphal <fw@...len.de>
Subject: Re: [PATCH net 1/2] mptcp: fix possible divide by zero

On Fri, 27 Aug 2021 17:17:30 -0700 Mat Martineau wrote:
> From: Paolo Abeni <pabeni@...hat.com>
> 
> Florian noted that if mptcp_alloc_tx_skb() allocation fails
> in __mptcp_push_pending(), we can end-up invoking
> mptcp_push_release()/tcp_push() with a zero mss, causing
> a divide by 0 error.
> 
> This change addresses the issue refactoring the skb allocation
> code checking if skb collapsing will happen for sure and doing
> the skb allocation only after such check. Skb allocation will
> now happen only after the call to tcp_send_mss() which
> correctly initializes mss_now.
> 
> As side bonuses we now fill the skb tx cache only when needed,
> and this also clean-up a bit the output path.
> 
> Reported-by: Florian Westphal <fw@...len.de>
> Fixes: 724cfd2ee8aa ("mptcp: allocate TX skbs in msk context")
> Signed-off-by: Paolo Abeni <pabeni@...hat.com>
> Signed-off-by: Mat Martineau <mathew.j.martineau@...ux.intel.com>
> ---
>  net/mptcp/protocol.c | 78 +++++++++++++++++++++-----------------------
>  1 file changed, 37 insertions(+), 41 deletions(-)
> 
> diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
> index a88924947815..0d5c1ec28508 100644
> --- a/net/mptcp/protocol.c
> +++ b/net/mptcp/protocol.c
> @@ -994,6 +994,15 @@ static void mptcp_wmem_uncharge(struct sock *sk, int size)
>  	msk->wmem_reserved += size;
>  }
>  
> +static void __mptcp_mem_reclaim_partial(struct sock *sk)
> +{
> +#ifdef CONFIG_LOCKDEP
> +	WARN_ON_ONCE(!lockdep_is_held(&sk->sk_lock.slock));
> +#endif

lockdep_assert_held_once() ? No ifdef should be needed?

> +	__mptcp_update_wmem(sk);
> +	sk_mem_reclaim_partial(sk);
> +}
> +
>  static void mptcp_mem_reclaim_partial(struct sock *sk)
>  {
>  	struct mptcp_sock *msk = mptcp_sk(sk);

> @@ -1512,7 +1516,9 @@ static void __mptcp_push_pending(struct sock *sk, unsigned int flags)
>  static void __mptcp_subflow_push_pending(struct sock *sk, struct sock *ssk)
>  {
>  	struct mptcp_sock *msk = mptcp_sk(sk);
> -	struct mptcp_sendmsg_info info;
> +	struct mptcp_sendmsg_info info = {
> +				 .data_lock_held = true,

indentation looks off

> +	};