netdev - Re: [PATCH net,v3] tcp: make sure init the accept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANn89iKhWyw9YvS_cgfuym0sK4O-FS2xXyWgU=MjZ0g=wesYjg@mail.gmail.com>
Date: Wed, 17 Jan 2024 12:28:40 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Zhengchao Shao <shaozhengchao@...wei.com>
Cc: netdev@...r.kernel.org, davem@...emloft.net, kuba@...nel.org, 
	pabeni@...hat.com, dsahern@...nel.org, sming56@...yun.com, 
	weiyongjun1@...wei.com, yuehaibing@...wei.com
Subject: Re: [PATCH net,v3] tcp: make sure init the accept_queue's spinlocks once

On Wed, Jan 17, 2024 at 7:22 AM Zhengchao Shao <shaozhengchao@...wei.com> wrote:
>
> When I run syz's reproduction C program locally, it causes the following
> </TASK>
>
> The issue triggering process is analyzed as follows:
> Thread A                                       Thread B
> tcp_v4_rcv      //receive ack TCP packet       inet_shutdown
>   tcp_check_req                                  tcp_disconnect //disconnect sock
>   ...                                              tcp_set_state(sk, TCP_CLOSE)
>     inet_csk_complete_hashdance                ...
>       inet_csk_reqsk_queue_add                 inet_listen  //start listen
>         spin_lock(&queue->rskq_lock)             inet_csk_listen_start
>         ...                                        reqsk_queue_alloc
>         ...                                          spin_lock_init
>         spin_unlock(&queue->rskq_lock)  //warning
>
> When the socket receives the ACK packet during the three-way handshake,
> it will hold spinlock. And then the user actively shutdowns the socket
> and listens to the socket immediately, the spinlock will be initialized.
> When the socket is going to release the spinlock, a warning is generated.
> Also the same issue to fastopenq.lock.
>
> Move init spinlock to inet_create and inet_accept to make sure init the
> accept_queue's spinlocks once.
>
> Fixes: fff1f3001cc5 ("tcp: add a spinlock to protect struct request_sock_queue")
> Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path")
> Reported-by: Ming Shu <sming56@...yun.com>
> Signed-off-by: Zhengchao Shao <shaozhengchao@...wei.com>
> ---
> v3: Move init spinlock to inet_create and inet_accept.
> v2: Add 'init_done' to make sure init the accept_queue's spinlocks once.
> ---
>  net/core/request_sock.c         |  3 ---
>  net/ipv4/af_inet.c              | 11 +++++++++++
>  net/ipv4/inet_connection_sock.c |  8 ++++++++
>  3 files changed, 19 insertions(+), 3 deletions(-)
>
> diff --git a/net/core/request_sock.c b/net/core/request_sock.c
> index f35c2e998406..63de5c635842 100644
> --- a/net/core/request_sock.c
> +++ b/net/core/request_sock.c
> @@ -33,9 +33,6 @@
>
>  void reqsk_queue_alloc(struct request_sock_queue *queue)
>  {
> -       spin_lock_init(&queue->rskq_lock);
> -
> -       spin_lock_init(&queue->fastopenq.lock);
>         queue->fastopenq.rskq_rst_head = NULL;
>         queue->fastopenq.rskq_rst_tail = NULL;
>         queue->fastopenq.qlen = 0;
> diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
> index 835f4f9d98d2..6589741157a4 100644
> --- a/net/ipv4/af_inet.c
> +++ b/net/ipv4/af_inet.c
> @@ -244,6 +244,14 @@ int inet_listen(struct socket *sock, int backlog)
>  }
>  EXPORT_SYMBOL(inet_listen);
>
> +static void __inet_init_csk_lock(struct sock *sk)
> +{
> +       struct inet_connection_sock *icsk = inet_csk(sk);
> +
> +       spin_lock_init(&icsk->icsk_accept_queue.rskq_lock);
> +       spin_lock_init(&icsk->icsk_accept_queue.fastopenq.lock);
> +}

This probably could be an inline helper in a suitable include file.
No need for __prefix btw.

static void inline inet_init_csk_locks(struct sock *sk)
{
       struct inet_connection_sock *icsk = inet_csk(sk);

       spin_lock_init(&icsk->icsk_accept_queue.rskq_lock);
       spin_lock_init(&icsk->icsk_accept_queue.fastopenq.lock);
}


> +
>  /*
>   *     Create an inet socket.
>   */
> @@ -330,6 +338,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
>         if (INET_PROTOSW_REUSE & answer_flags)
>                 sk->sk_reuse = SK_CAN_REUSE;
>
> +       if (INET_PROTOSW_ICSK & answer_flags)
> +               __inet_init_csk_lock(sk);
> +
>         inet = inet_sk(sk);
>         inet_assign_bit(IS_ICSK, sk, INET_PROTOSW_ICSK & answer_flags);
>
> diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
> index 8e2eb1793685..5d3277ab9954 100644
> --- a/net/ipv4/inet_connection_sock.c
> +++ b/net/ipv4/inet_connection_sock.c
> @@ -655,6 +655,7 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
>  {
>         struct inet_connection_sock *icsk = inet_csk(sk);
>         struct request_sock_queue *queue = &icsk->icsk_accept_queue;
> +       struct request_sock_queue *newqueue;
>         struct request_sock *req;
>         struct sock *newsk;
>         int error;
> @@ -727,6 +728,13 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
>         }
>         if (req)
>                 reqsk_put(req);
> +
> +       if (newsk) {
> +               newqueue = &inet_csk(newsk)->icsk_accept_queue;
> +               spin_lock_init(&newqueue->rskq_lock);
> +               spin_lock_init(&newqueue->fastopenq.lock);
> +       }

So that we could here use a common helper

if (newsk)
     inet_init_csk_locks(newsk);


Thanks, this is looking quite nice.