netdev - Re: [syzbot] KASAN: use-after-free Read in tcp_retransmit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <af8a3cc6-ee2f-f1ab-ee78-8e5988a9a2f8@I-love.SAKURA.ne.jp>
Date:   Sun, 10 Apr 2022 09:38:12 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:     Eric Dumazet <edumazet@...gle.com>
Cc:     bpf <bpf@...r.kernel.org>,
        syzbot <syzbot+694120e1002c117747ed@...kaller.appspotmail.com>,
        Andrii Nakryiko <andrii@...nel.org>,
        Andrii Nakryiko <andriin@...com>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        David Miller <davem@...emloft.net>,
        David Ahern <dsahern@...nel.org>,
        John Fastabend <john.fastabend@...il.com>,
        Martin KaFai Lau <kafai@...com>,
        KP Singh <kpsingh@...nel.org>,
        Jakub Kicinski <kuba@...nel.org>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        netdev <netdev@...r.kernel.org>,
        Song Liu <songliubraving@...com>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        tpa@...hospital.com, Yonghong Song <yhs@...com>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Trond Myklebust <trondmy@...merspace.com>
Subject: Re: [syzbot] KASAN: use-after-free Read in tcp_retransmit_timer (5)

On 2022/04/10 1:46, Eric Dumazet wrote:
> Try removing NFS from your kernel .config ? If your repro still works,
> then another user of kernel TCP socket needs some care.

Since my .config is CONFIG_NETWORK_FILESYSTEMS=n, NFS is irrelevant.

On 2022/04/10 2:47, Eric Dumazet wrote:
> So please add to your tree the NFS fix:
> 
> commit f00432063db1a0db484e85193eccc6845435b80e
> Author: Trond Myklebust <trond.myklebust@...merspace.com>
> Date:   Sun Apr 3 15:58:11 2022 -0400
> 
>     SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()

Since CONFIG_SUNRPC depends on CONFIG_NETWORK_FILESYSTEMS=y,
this NFS fix will be also irrelevant.

On 2022/04/10 2:55, Eric Dumazet wrote:
> Side note: We will probably be able to revert this patch, that perhaps
> was working around the real issue.
> 
> commit 4ee806d51176ba7b8ff1efd81f271d7252e03a1d
> Author: Dan Streetman <ddstreet@...e.org>
> Date:   Thu Jan 18 16:14:26 2018 -0500
> 
>     net: tcp: close sock if net namespace is exiting

I uploaded my .config at https://I-love.SAKURA.ne.jp/tmp/config-5.17
so that you can try this reproducer using my .config file.

I haven't identified where the socket

[  260.295512][    C0] BUG: Trying to access destroyed net=ffff888036278000 sk=ffff88800e2d8000
[  260.301941][    C0] sk->sk_family=10 sk->sk_prot_creator->name=TCPv6 sk->sk_state=11 sk->sk_flags=0x30b net->ns.count=0

came from. Can you identify the location?