netdev - Re: [PATCH net] tcp: use signed arithmetic in tcp_rtx_probe0_timed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89i+ai=p7wRhFZLAoXgk5ckoqVV0eC691BY3Tb-is82n-Pw@mail.gmail.com>
Date: Fri, 7 Jun 2024 17:23:30 +0200
From: Eric Dumazet <edumazet@...gle.com>
To: Neal Cardwell <ncardwell@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org, eric.dumazet@...il.com, 
	Menglong Dong <imagedong@...cent.com>
Subject: Re: [PATCH net] tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()

On Fri, Jun 7, 2024 at 5:12 PM Neal Cardwell <ncardwell@...gle.com> wrote:
>
> On Fri, Jun 7, 2024 at 8:56 AM Eric Dumazet <edumazet@...gle.com> wrote:
> >
> > Due to timer wheel implementation, a timer will usually fire
> > after its schedule.
> >
> > For instance, for HZ=1000, a timeout between 512ms and 4s
> > has a granularity of 64ms.
> > For this range of values, the extra delay could be up to 63ms.
> >
> > For TCP, this means that tp->rcv_tstamp may be after
> > inet_csk(sk)->icsk_timeout whenever the timer interrupt
> > finally triggers, if one packet came during the extra delay.
> >
> > We need to make sure tcp_rtx_probe0_timed_out() handles this case.
> >
> > Fixes: e89688e3e978 ("net: tcp: fix unexcepted socket die when snd_wnd is 0")
> > Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> > Cc: Menglong Dong <imagedong@...cent.com>
> > ---
> >  net/ipv4/tcp_timer.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
> > index 83fe7f62f7f10ab111512a3ef15a97a04c79cb4a..5bfd76a31af6da6473d306d95c296180141f54e0 100644
> > --- a/net/ipv4/tcp_timer.c
> > +++ b/net/ipv4/tcp_timer.c
> > @@ -485,8 +485,12 @@ static bool tcp_rtx_probe0_timed_out(const struct sock *sk,
> >  {
> >         const struct tcp_sock *tp = tcp_sk(sk);
> >         const int timeout = TCP_RTO_MAX * 2;
> > -       u32 rcv_delta;
> > +       s32 rcv_delta;
> >
> > +       /* Note: timer interrupt might have been delayed by at least one jiffy,
> > +        * and tp->rcv_tstamp might very well have been written recently.
> > +        * rcv_delta can thus be negative.
> > +        */
> >         rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp;
> >         if (rcv_delta <= timeout)
> >                 return false;
>
> Nice catch!
>
> Is this a sufficient fix? The icsk_timeout field is unsigned long and
> rcv_tstamp is u32. So on 64-bit architectures icsk_timeout is u64 and
> rcv_tstamp is u32. AFAICT it is not safe to subtract a u32 jiffies
> timestamp from a u64 jiffies timestamp and expect to get an answer we
> can use in this simple way (at least in general, after a few weeks of
> uptime when the u32 jiffies value has wrapped and the u64 value has
> not).
>
> I wonder if we also need something like this for a complete fix:
>
> - rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp;
> + rcv_delta = (u32)inet_csk(sk)->icsk_timeout - tp->rcv_tstamp;

We do this kind of (unsigned long) -> u32 conversions in many other places,
and they work if we store the result in a 32bit field (we do not care
of upper 32bits on 64bit kernels)

rcv_delta is s32, it does not matter if we cast (u32) to
inet_csk(sk)->icsk_timeout

Compiler  generates the same code (and result) :

mov    0x430(%rdi),%eax  // low 32bit of  inet_csk(sk)->icsk_timeout
sub    0x5b4(%rdi),%eax // tp->rcv_tstamp
cmp    $0x3a980,%eax
jle    aa8 <tcp_rtx_probe0_timed_out+0x38>

Thanks !