netdev - Re: [PATCH v1 net 1/2] tcp: Fix bind() conflict check for dual-stack wildcard address.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d39f0806-cbe7-52ae-2271-67e365315018@redhat.com>
Date:   Mon, 13 Mar 2023 17:12:35 +0100
From:   Paul Holzinger <pholzing@...hat.com>
To:     Kuniyuki Iwashima <kuniyu@...zon.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        David Ahern <dsahern@...nel.org>
Cc:     Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org,
        Martin KaFai Lau <martin.lau@...nel.org>
Subject: Re: [PATCH v1 net 1/2] tcp: Fix bind() conflict check for dual-stack
 wildcard address.

Thanks Kuniyuki, patch works for me.

On 12/03/2023 04:19, Kuniyuki Iwashima wrote:
> Paul Holzinger reported [0] that commit 5456262d2baa ("net: Fix
> incorrect address comparison when searching for a bind2 bucket")
> introduced a bind() regression.  Paul also gave a nice repro that
> calls two types of bind() on the same port, both of which now
> succeed, but the second call should fail:
>
>    bind(fd1, ::, port) + bind(fd2, 127.0.0.1, port)
>
> The cited commit added address family tests in three functions to
> fix the uninit-value KMSAN report. [1]  However, the test added to
> inet_bind2_bucket_match_addr_any() removed a necessary conflict
> check; the dual-stack wildcard address no longer conflicts with
> an IPv4 non-wildcard address.
>
> If tb->family is AF_INET6 and sk->sk_family is AF_INET in
> inet_bind2_bucket_match_addr_any(), we still need to check
> if tb has the dual-stack wildcard address.
>
> Note that the IPv4 wildcard address does not conflict with
> IPv6 non-wildcard addresses.
>
> [0]: https://lore.kernel.org/netdev/e21bf153-80b0-9ec0-15ba-e04a4ad42c34@redhat.com/
> [1]: https://lore.kernel.org/netdev/CAG_fn=Ud3zSW7AZWXc+asfMhZVL5ETnvuY44Pmyv4NPv-ijN-A@mail.gmail.com/
>
> Fixes: 5456262d2baa ("net: Fix incorrect address comparison when searching for a bind2 bucket")
> Reported-by: Paul Holzinger <pholzing@...hat.com>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>
> ---
> Cc: Martin KaFai Lau <martin.lau@...nel.org>
> ---
> Some cleanup patches will be posted against net-next later:
>
>    * s/addr_any/in6addr_any/
>    * Remove duplicated tests for net, port, and l3mdev.
> ---
>   net/ipv4/inet_hashtables.c | 8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
> index e41fdc38ce19..6edae3886885 100644
> --- a/net/ipv4/inet_hashtables.c
> +++ b/net/ipv4/inet_hashtables.c
> @@ -828,8 +828,14 @@ bool inet_bind2_bucket_match_addr_any(const struct inet_bind2_bucket *tb, const
>   #if IS_ENABLED(CONFIG_IPV6)
>   	struct in6_addr addr_any = {};
>   
> -	if (sk->sk_family != tb->family)
> +	if (sk->sk_family != tb->family) {
> +		if (sk->sk_family == AF_INET)
> +			return net_eq(ib2_net(tb), net) && tb->port == port &&
> +				tb->l3mdev == l3mdev &&
> +				ipv6_addr_equal(&tb->v6_rcv_saddr, &addr_any);
> +
>   		return false;
> +	}
>   
>   	if (sk->sk_family == AF_INET6)
>   		return net_eq(ib2_net(tb), net) && tb->port == port &&
Tested-by: Paul Holzinger <pholzing@...hat.com>