netdev - Re: [PATCH net] net: restrict SO_REUSEPORT to TCP, UDP and SCTP sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20241231183339.6ee59b64@dsl-u17-10>
Date: Tue, 31 Dec 2024 18:33:39 +0000
From: David Laight <david.laight.linux@...il.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski
 <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
 Simon Horman <horms@...nel.org>, eric.dumazet@...il.com,
 syzbot+b3e02953598f447d4d2a@...kaller.appspotmail.com, Martin KaFai Lau
 <kafai@...com>
Subject: Re: [PATCH net] net: restrict SO_REUSEPORT to TCP, UDP and SCTP
 sockets

On Mon, 30 Dec 2024 19:34:30 +0000
Eric Dumazet <edumazet@...gle.com> wrote:

> After blamed commit, crypto sockets could accidentally be destroyed
> from RCU callback, as spotted by zyzbot [1].
> 
> Trying to acquire a mutex in RCU callback is not allowed.
> 
> Restrict SO_REUSEPORT socket option to TCP, UDP and SCTP sockets.
> 
...
> 
> Fixes: 8c7138b33e5c ("net: Unpublish sk from sk_reuseport_cb before call_rcu")
> Reported-by: syzbot+b3e02953598f447d4d2a@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6772f2f4.050a0220.2f3838.04cb.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Martin KaFai Lau <kafai@...com>
> ---
>  include/net/sock.h | 7 +++++++
>  net/core/sock.c    | 6 +++++-
>  2 files changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/include/net/sock.h b/include/net/sock.h
> index 7464e9f9f47c..4010fd759e2a 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -2730,6 +2730,13 @@ static inline bool sk_is_tcp(const struct sock *sk)
>  	       sk->sk_protocol == IPPROTO_TCP;
>  }
>  
> +static inline bool sk_is_sctp(const struct sock *sk)
> +{
> +	return sk_is_inet(sk) &&
> +	       sk->sk_type == SOCK_STREAM &&
> +	       sk->sk_protocol == IPPROTO_SCTP;
> +}

Isn't SCTP SOCK_SEQPACKET ?
In any case the sk_type test is redundant (for inet sockets).

If support is needed for raw (ip) sockets is it enough to just
check sk_is_inet() ?

	David

> +
>  static inline bool sk_is_udp(const struct sock *sk)
>  {
>  	return sk_is_inet(sk) &&
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 74729d20cd00..56e8517da8dc 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -1295,7 +1295,11 @@ int sk_setsockopt(struct sock *sk, int level, int optname,
>  		sk->sk_reuse = (valbool ? SK_CAN_REUSE : SK_NO_REUSE);
>  		break;
>  	case SO_REUSEPORT:
> -		sk->sk_reuseport = valbool;
> +		if (valbool && !sk_is_tcp(sk) && !sk_is_udp(sk) &&
> +		    !sk_is_sctp(sk))
> +			ret = -EOPNOTSUPP;
> +		else
> +			sk->sk_reuseport = valbool;
>  		break;
>  	case SO_DONTROUTE:
>  		sock_valbool_flag(sk, SOCK_LOCALROUTE, valbool);