mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
![Eric Dumazet](/assets/img/avatar_default.png)
syzbot complained about a recent change in TCP stack,
hitting a NULL pointer [1]
tcp request sockets have an af_specific pointer, which
was used before the blamed change only for SYNACK generation
in non SYNCOOKIE mode.
tcp requests sockets momentarily created when third packet
coming from client in SYNCOOKIE mode were not using
treq->af_specific.
Make sure this field is populated, in the same way normal
TCP requests sockets do in tcp_conn_request().
[1]
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters.
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 3695 Comm: syz-executor864 Not tainted 5.18.0-rc3-syzkaller-00224-g5fd1fe4807f9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:tcp_create_openreq_child+0xe16/0x16b0 net/ipv4/tcp_minisocks.c:534
Code: 48 c1 ea 03 80 3c 02 00 0f 85 e5 07 00 00 4c 8b b3 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 07 00 00 48 8b 3c 24 48 89 de 41 ff 56 08 48
RSP: 0018:ffffc90000de0588 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888076490330 RCX: 0000000000000100
RDX: 0000000000000001 RSI: ffffffff87d67ff0 RDI: 0000000000000008
RBP: ffff88806ee1c7f8 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff87d67f00 R11: 0000000000000000 R12: ffff88806ee1bfc0
R13: ffff88801b0e0368 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f517fe58700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcead76960 CR3: 000000006f97b000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
tcp_v6_syn_recv_sock+0x199/0x23b0 net/ipv6/tcp_ipv6.c:1267
tcp_get_cookie_sock+0xc9/0x850 net/ipv4/syncookies.c:207
cookie_v6_check+0x15c3/0x2340 net/ipv6/syncookies.c:258
tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1131 [inline]
tcp_v6_do_rcv+0x1148/0x13b0 net/ipv6/tcp_ipv6.c:1486
tcp_v6_rcv+0x3305/0x3840 net/ipv6/tcp_ipv6.c:1725
ip6_protocol_deliver_rcu+0x2e9/0x1900 net/ipv6/ip6_input.c:422
ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:464
NF_HOOK include/linux/netfilter.h:307 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:473
dst_input include/net/dst.h:461 [inline]
ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ipv6_rcv+0x27f/0x3b0 net/ipv6/ip6_input.c:297
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405
__netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519
process_backlog+0x3a0/0x7c0 net/core/dev.c:5847
__napi_poll+0xb3/0x6e0 net/core/dev.c:6413
napi_poll net/core/dev.c:6480 [inline]
net_rx_action+0x8ec/0xc60 net/core/dev.c:6567
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
Fixes: 5b0b9e4c2c
("tcp: md5: incorrect tcp_header_len for incoming connections")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
265 lines
7.4 KiB
C
265 lines
7.4 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* IPv6 Syncookies implementation for the Linux kernel
|
|
*
|
|
* Authors:
|
|
* Glenn Griffin <ggriffin.kernel@gmail.com>
|
|
*
|
|
* Based on IPv4 implementation by Andi Kleen
|
|
* linux/net/ipv4/syncookies.c
|
|
*/
|
|
|
|
#include <linux/tcp.h>
|
|
#include <linux/random.h>
|
|
#include <linux/siphash.h>
|
|
#include <linux/kernel.h>
|
|
#include <net/secure_seq.h>
|
|
#include <net/ipv6.h>
|
|
#include <net/tcp.h>
|
|
|
|
#define COOKIEBITS 24 /* Upper bits store count */
|
|
#define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
|
|
|
|
static siphash_aligned_key_t syncookie6_secret[2];
|
|
|
|
/* RFC 2460, Section 8.3:
|
|
* [ipv6 tcp] MSS must be computed as the maximum packet size minus 60 [..]
|
|
*
|
|
* Due to IPV6_MIN_MTU=1280 the lowest possible MSS is 1220, which allows
|
|
* using higher values than ipv4 tcp syncookies.
|
|
* The other values are chosen based on ethernet (1500 and 9k MTU), plus
|
|
* one that accounts for common encap (PPPoe) overhead. Table must be sorted.
|
|
*/
|
|
static __u16 const msstab[] = {
|
|
1280 - 60, /* IPV6_MIN_MTU - 60 */
|
|
1480 - 60,
|
|
1500 - 60,
|
|
9000 - 60,
|
|
};
|
|
|
|
static u32 cookie_hash(const struct in6_addr *saddr,
|
|
const struct in6_addr *daddr,
|
|
__be16 sport, __be16 dport, u32 count, int c)
|
|
{
|
|
const struct {
|
|
struct in6_addr saddr;
|
|
struct in6_addr daddr;
|
|
u32 count;
|
|
__be16 sport;
|
|
__be16 dport;
|
|
} __aligned(SIPHASH_ALIGNMENT) combined = {
|
|
.saddr = *saddr,
|
|
.daddr = *daddr,
|
|
.count = count,
|
|
.sport = sport,
|
|
.dport = dport
|
|
};
|
|
|
|
net_get_random_once(syncookie6_secret, sizeof(syncookie6_secret));
|
|
return siphash(&combined, offsetofend(typeof(combined), dport),
|
|
&syncookie6_secret[c]);
|
|
}
|
|
|
|
static __u32 secure_tcp_syn_cookie(const struct in6_addr *saddr,
|
|
const struct in6_addr *daddr,
|
|
__be16 sport, __be16 dport, __u32 sseq,
|
|
__u32 data)
|
|
{
|
|
u32 count = tcp_cookie_time();
|
|
return (cookie_hash(saddr, daddr, sport, dport, 0, 0) +
|
|
sseq + (count << COOKIEBITS) +
|
|
((cookie_hash(saddr, daddr, sport, dport, count, 1) + data)
|
|
& COOKIEMASK));
|
|
}
|
|
|
|
static __u32 check_tcp_syn_cookie(__u32 cookie, const struct in6_addr *saddr,
|
|
const struct in6_addr *daddr, __be16 sport,
|
|
__be16 dport, __u32 sseq)
|
|
{
|
|
__u32 diff, count = tcp_cookie_time();
|
|
|
|
cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
|
|
|
|
diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
|
|
if (diff >= MAX_SYNCOOKIE_AGE)
|
|
return (__u32)-1;
|
|
|
|
return (cookie -
|
|
cookie_hash(saddr, daddr, sport, dport, count - diff, 1))
|
|
& COOKIEMASK;
|
|
}
|
|
|
|
u32 __cookie_v6_init_sequence(const struct ipv6hdr *iph,
|
|
const struct tcphdr *th, __u16 *mssp)
|
|
{
|
|
int mssind;
|
|
const __u16 mss = *mssp;
|
|
|
|
for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
|
|
if (mss >= msstab[mssind])
|
|
break;
|
|
|
|
*mssp = msstab[mssind];
|
|
|
|
return secure_tcp_syn_cookie(&iph->saddr, &iph->daddr, th->source,
|
|
th->dest, ntohl(th->seq), mssind);
|
|
}
|
|
EXPORT_SYMBOL_GPL(__cookie_v6_init_sequence);
|
|
|
|
__u32 cookie_v6_init_sequence(const struct sk_buff *skb, __u16 *mssp)
|
|
{
|
|
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
|
const struct tcphdr *th = tcp_hdr(skb);
|
|
|
|
return __cookie_v6_init_sequence(iph, th, mssp);
|
|
}
|
|
|
|
int __cookie_v6_check(const struct ipv6hdr *iph, const struct tcphdr *th,
|
|
__u32 cookie)
|
|
{
|
|
__u32 seq = ntohl(th->seq) - 1;
|
|
__u32 mssind = check_tcp_syn_cookie(cookie, &iph->saddr, &iph->daddr,
|
|
th->source, th->dest, seq);
|
|
|
|
return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
|
|
}
|
|
EXPORT_SYMBOL_GPL(__cookie_v6_check);
|
|
|
|
struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
struct tcp_options_received tcp_opt;
|
|
struct inet_request_sock *ireq;
|
|
struct tcp_request_sock *treq;
|
|
struct ipv6_pinfo *np = inet6_sk(sk);
|
|
struct tcp_sock *tp = tcp_sk(sk);
|
|
const struct tcphdr *th = tcp_hdr(skb);
|
|
__u32 cookie = ntohl(th->ack_seq) - 1;
|
|
struct sock *ret = sk;
|
|
struct request_sock *req;
|
|
int full_space, mss;
|
|
struct dst_entry *dst;
|
|
__u8 rcv_wscale;
|
|
u32 tsoff = 0;
|
|
|
|
if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)
|
|
goto out;
|
|
|
|
if (tcp_synq_no_recent_overflow(sk))
|
|
goto out;
|
|
|
|
mss = __cookie_v6_check(ipv6_hdr(skb), th, cookie);
|
|
if (mss == 0) {
|
|
__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
|
|
goto out;
|
|
}
|
|
|
|
__NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
|
|
|
|
/* check for timestamp cookie support */
|
|
memset(&tcp_opt, 0, sizeof(tcp_opt));
|
|
tcp_parse_options(sock_net(sk), skb, &tcp_opt, 0, NULL);
|
|
|
|
if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) {
|
|
tsoff = secure_tcpv6_ts_off(sock_net(sk),
|
|
ipv6_hdr(skb)->daddr.s6_addr32,
|
|
ipv6_hdr(skb)->saddr.s6_addr32);
|
|
tcp_opt.rcv_tsecr -= tsoff;
|
|
}
|
|
|
|
if (!cookie_timestamp_decode(sock_net(sk), &tcp_opt))
|
|
goto out;
|
|
|
|
ret = NULL;
|
|
req = cookie_tcp_reqsk_alloc(&tcp6_request_sock_ops,
|
|
&tcp_request_sock_ipv6_ops, sk, skb);
|
|
if (!req)
|
|
goto out;
|
|
|
|
ireq = inet_rsk(req);
|
|
treq = tcp_rsk(req);
|
|
treq->tfo_listener = false;
|
|
|
|
if (security_inet_conn_request(sk, skb, req))
|
|
goto out_free;
|
|
|
|
req->mss = mss;
|
|
ireq->ir_rmt_port = th->source;
|
|
ireq->ir_num = ntohs(th->dest);
|
|
ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
|
|
ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
|
|
if (ipv6_opt_accepted(sk, skb, &TCP_SKB_CB(skb)->header.h6) ||
|
|
np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
|
|
np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
|
|
refcount_inc(&skb->users);
|
|
ireq->pktopts = skb;
|
|
}
|
|
|
|
ireq->ir_iif = inet_request_bound_dev_if(sk, skb);
|
|
/* So that link locals have meaning */
|
|
if (!sk->sk_bound_dev_if &&
|
|
ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
|
|
ireq->ir_iif = tcp_v6_iif(skb);
|
|
|
|
ireq->ir_mark = inet_request_mark(sk, skb);
|
|
|
|
req->num_retrans = 0;
|
|
ireq->snd_wscale = tcp_opt.snd_wscale;
|
|
ireq->sack_ok = tcp_opt.sack_ok;
|
|
ireq->wscale_ok = tcp_opt.wscale_ok;
|
|
ireq->tstamp_ok = tcp_opt.saw_tstamp;
|
|
req->ts_recent = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
|
|
treq->snt_synack = 0;
|
|
treq->rcv_isn = ntohl(th->seq) - 1;
|
|
treq->snt_isn = cookie;
|
|
treq->ts_off = 0;
|
|
treq->txhash = net_tx_rndhash();
|
|
if (IS_ENABLED(CONFIG_SMC))
|
|
ireq->smc_ok = 0;
|
|
|
|
/*
|
|
* We need to lookup the dst_entry to get the correct window size.
|
|
* This is taken from tcp_v6_syn_recv_sock. Somebody please enlighten
|
|
* me if there is a preferred way.
|
|
*/
|
|
{
|
|
struct in6_addr *final_p, final;
|
|
struct flowi6 fl6;
|
|
memset(&fl6, 0, sizeof(fl6));
|
|
fl6.flowi6_proto = IPPROTO_TCP;
|
|
fl6.daddr = ireq->ir_v6_rmt_addr;
|
|
final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final);
|
|
fl6.saddr = ireq->ir_v6_loc_addr;
|
|
fl6.flowi6_oif = ireq->ir_iif;
|
|
fl6.flowi6_mark = ireq->ir_mark;
|
|
fl6.fl6_dport = ireq->ir_rmt_port;
|
|
fl6.fl6_sport = inet_sk(sk)->inet_sport;
|
|
fl6.flowi6_uid = sk->sk_uid;
|
|
security_req_classify_flow(req, flowi6_to_flowi_common(&fl6));
|
|
|
|
dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
|
|
if (IS_ERR(dst))
|
|
goto out_free;
|
|
}
|
|
|
|
req->rsk_window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
|
|
/* limit the window selection if the user enforce a smaller rx buffer */
|
|
full_space = tcp_full_space(sk);
|
|
if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
|
|
(req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
|
|
req->rsk_window_clamp = full_space;
|
|
|
|
tcp_select_initial_window(sk, full_space, req->mss,
|
|
&req->rsk_rcv_wnd, &req->rsk_window_clamp,
|
|
ireq->wscale_ok, &rcv_wscale,
|
|
dst_metric(dst, RTAX_INITRWND));
|
|
|
|
ireq->rcv_wscale = rcv_wscale;
|
|
ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), dst);
|
|
|
|
ret = tcp_get_cookie_sock(sk, skb, req, dst, tsoff);
|
|
out:
|
|
return ret;
|
|
out_free:
|
|
reqsk_free(req);
|
|
return NULL;
|
|
}
|