netdev - [PATCH] tcp: Fix inet_bind2_bucket_match_addr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <23b5678b-1e5a-be6c-ea68-b7a20dff4bbc@163.com>
Date: Thu, 21 Mar 2024 11:02:36 +0800
From: Jianguo Wu <wujianguo106@....com>
To: netdev <netdev@...r.kernel.org>
Cc: Eric Dumazet <edumazet@...gle.com>, davem@...emloft.net, kuniyu@...zon.com
Subject: [PATCH] tcp: Fix inet_bind2_bucket_match_addr_any() regression

From: Jianguo Wu <wujianguo@...natelecom.cn>

If we bind() a TCPv4 socket to 0.0.0.0:8090, then bind() a TCPv6(ipv6only) socket
to :::8090, both without SO_REUSEPORT, then bind() 127.0.0.1:8090, it should fail
but now succeeds. like this:
  tcp        0      0 127.0.0.1:8090          0.0.0.0:*               LISTEN
  tcp        0      0 0.0.0.0:8090            0.0.0.0:*               LISTEN
  tcp6       0      0 :::8090                 :::*                    LISTEN

bind() 0.0.0.0:8090, :::8090 and ::1:8090 are all fail.

But if we bind() a TCPv6(ipv6only) socket to :::8090 first, then  bind() a TCPv4
socket to 0.0.0.0:8090, then bind() 127.0.0.1:8090, 0.0.0.0:8090, :::8090 and ::1:8090 are all fail.

When bind() 127.0.0.1:8090, inet_bind2_bucket_match_addr_any() will return true as tb->addr_type == IPV6_ADDR_ANY,
and tb is refer to the TCPv6 socket(:::8090), then inet_bhash2_conflict() return false, That is, there is no conflict,
so bind() succeeds.

  inet_bhash2_addr_any_conflict()
  {
	inet_bind_bucket_for_each(tb2, &head2->chain)
		// tb2 is IPv6
		if (inet_bind2_bucket_match_addr_any(tb2, net, port, l3mdev, sk))
			break;

	// inet_bhash2_conflict() return false
	if (tb2 && inet_bhash2_conflict(sk, tb2, uid, relax, reuseport_cb_ok,
                                reuseport_ok)) {
		spin_unlock(&head2->lock);
		return true;
	}

  }

Fixes: 5a22bba13d01 ("tcp: Save address type in inet_bind2_bucket.")
---
 net/ipv4/inet_hashtables.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 7498af320164..3eeaca8a113f 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -830,8 +830,8 @@ bool inet_bind2_bucket_match_addr_any(const struct inet_bind2_bucket *tb, const
 		return false;

 #if IS_ENABLED(CONFIG_IPV6)
-	if (tb->addr_type == IPV6_ADDR_ANY)
-		return true;
+	if (sk->sk_family == AF_INET6)
+		return tb->addr_type == IPV6_ADDR_ANY;

 	if (tb->addr_type != IPV6_ADDR_MAPPED)
 		return false;
-- 
1.8.3.1