netdev - Re: [PATCH v1 net-next] sctp: Don't inherit do_auto_asconf in sctp_clone

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CADvbK_ceAqeASAGppA_sjiofaxzpM_VnJP4G5_BR02exs3tV8A@mail.gmail.com>
Date: Mon, 10 Nov 2025 09:59:15 -0500
From: Xin Long <lucien.xin@...il.com>
To: Kuniyuki Iwashima <kuniyu@...gle.com>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>, "David S. Miller" <davem@...emloft.net>, 
	Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	Simon Horman <horms@...nel.org>, Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org, 
	linux-sctp@...r.kernel.org, 
	syzbot+ba535cb417f106327741@...kaller.appspotmail.com
Subject: Re: [PATCH v1 net-next] sctp: Don't inherit do_auto_asconf in sctp_clone_sock().

On Thu, Nov 6, 2025 at 5:34 PM Kuniyuki Iwashima <kuniyu@...gle.com> wrote:
>
> syzbot reported list_del(&sp->auto_asconf_list) corruption
> in sctp_destroy_sock().
>
> The repro calls setsockopt(SCTP_AUTO_ASCONF, 1) to a SCTP
> listener, calls accept(), and close()s the child socket.
>
> setsockopt(SCTP_AUTO_ASCONF, 1) sets sp->do_auto_asconf
> to 1 and links sp->auto_asconf_list to a per-netns list.
>
> Both fields are placed after sp->pd_lobby in struct sctp_sock,
> and sctp_copy_descendant() did not copy the fields before the
> cited commit.
>
> Also, sctp_clone_sock() did not set them explicitly.
>
> In addition, sctp_auto_asconf_init() is called from
> sctp_sock_migrate(), but it initialises the fields only
> conditionally.
>
> The two fields relied on __GFP_ZERO added in sk_alloc(),
> but sk_clone() does not use it.
>
> Let's clear newsp->do_auto_asconf in sctp_clone_sock().
>
> [0]:
> list_del corruption. prev->next should be ffff8880799e9148, but was ffff8880799e8808. (prev=ffff88803347d9f8)
> kernel BUG at lib/list_debug.c:64!
> Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
> CPU: 0 UID: 0 PID: 6008 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> RIP: 0010:__list_del_entry_valid_or_report+0x15a/0x190 lib/list_debug.c:62
> Code: e8 7b 26 71 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 7c ee 92 fd 49 8b 17 48 c7 c7 80 0a bf 8b 48 89 de 4c 89 f9 e8 07 c6 94 fc 90 <0f> 0b 4c 89 f7 e8 4c 26 71 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 4d
> RSP: 0018:ffffc90003067ad8 EFLAGS: 00010246
> RAX: 000000000000006d RBX: ffff8880799e9148 RCX: b056988859ee6e00
> RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000
> RBP: dffffc0000000000 R08: ffffc90003067807 R09: 1ffff9200060cf00
> R10: dffffc0000000000 R11: fffff5200060cf01 R12: 1ffff1100668fb3f
> R13: dffffc0000000000 R14: ffff88803347d9f8 R15: ffff88803347d9f8
> FS:  00005555823e5500(0000) GS:ffff88812613e000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000200000000480 CR3: 00000000741ce000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  __list_del_entry_valid include/linux/list.h:132 [inline]
>  __list_del_entry include/linux/list.h:223 [inline]
>  list_del include/linux/list.h:237 [inline]
>  sctp_destroy_sock+0xb4/0x370 net/sctp/socket.c:5163
>  sk_common_release+0x75/0x310 net/core/sock.c:3961
>  sctp_close+0x77e/0x900 net/sctp/socket.c:1550
>  inet_release+0x144/0x190 net/ipv4/af_inet.c:437
>  __sock_release net/socket.c:662 [inline]
>  sock_close+0xc3/0x240 net/socket.c:1455
>  __fput+0x44c/0xa70 fs/file_table.c:468
>  task_work_run+0x1d4/0x260 kernel/task_work.c:227
>  resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
>  exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43
>  exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
>  syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
>  syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
>  do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Fixes: 16942cf4d3e3 ("sctp: Use sk_clone() in sctp_accept().")
> Reported-by: syzbot+ba535cb417f106327741@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/690d2185.a70a0220.22f260.000e.GAE@google.com/
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...gle.com>
> ---
>  include/net/sctp/structs.h | 4 ----
>  net/sctp/socket.c          | 1 +
>  2 files changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
> index 5900196d65fd..affee44bd38e 100644
> --- a/include/net/sctp/structs.h
> +++ b/include/net/sctp/structs.h
> @@ -228,10 +228,6 @@ struct sctp_sock {
>
>         atomic_t pd_mode;
>
> -       /* Fields after this point will be skipped on copies, like on accept
> -        * and peeloff operations
> -        */
> -
>         /* Receive to here while partial delivery is in effect. */
>         struct sk_buff_head pd_lobby;
>
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index 38d2932acebf..d808096f5ab1 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -4885,6 +4885,7 @@ static struct sock *sctp_clone_sock(struct sock *sk,
>         }
>  #endif
>
> +       newsp->do_auto_asconf = 0;
>         skb_queue_head_init(&newsp->pd_lobby);
>
>         newsp->ep = sctp_endpoint_new(newsk, GFP_KERNEL);
> --
> 2.51.2.1041.gc1ab5b90ca-goog
>
Acked-by: Xin Long <lucien.xin@...il.com>

Thanks.