mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 07:38:10 +00:00
4faeee0cf8
Historically connect(AF_UNSPEC) has been abused by syzkaller and other fuzzers to trigger various bugs. A recent one triggers a divide-by-zero [1], and Paolo Abeni was able to diagnose the issue. tcp_recvmsg_locked() has tests about sk_state being not TCP_LISTEN and TCP REPAIR mode being not used. Then later if socket lock is released in sk_wait_data(), another thread can call connect(AF_UNSPEC), then make this socket a TCP listener. When recvmsg() is resumed, it can eventually call tcp_cleanup_rbuf() and attempt a divide by 0 in tcp_rcv_space_adjust() [1] This patch adds a new socket field, counting number of threads blocked in sk_wait_event() and inet_wait_for_connect(). If this counter is not zero, tcp_disconnect() returns an error. This patch adds code in blocking socket system calls, thus should not hurt performance of non blocking ones. Note that we probably could revert commit |
||
---|---|---|
.. | ||
bpfilter | ||
netfilter | ||
af_inet.c | ||
ah4.c | ||
arp.c | ||
bpf_tcp_ca.c | ||
cipso_ipv4.c | ||
datagram.c | ||
devinet.c | ||
esp4.c | ||
esp4_offload.c | ||
fib_frontend.c | ||
fib_lookup.h | ||
fib_notifier.c | ||
fib_rules.c | ||
fib_semantics.c | ||
fib_trie.c | ||
fou_bpf.c | ||
fou_core.c | ||
fou_nl.c | ||
fou_nl.h | ||
gre_demux.c | ||
gre_offload.c | ||
icmp.c | ||
igmp.c | ||
inet_connection_sock.c | ||
inet_diag.c | ||
inet_fragment.c | ||
inet_hashtables.c | ||
inet_timewait_sock.c | ||
inetpeer.c | ||
ip_forward.c | ||
ip_fragment.c | ||
ip_gre.c | ||
ip_input.c | ||
ip_options.c | ||
ip_output.c | ||
ip_sockglue.c | ||
ip_tunnel.c | ||
ip_tunnel_core.c | ||
ip_vti.c | ||
ipcomp.c | ||
ipconfig.c | ||
ipip.c | ||
ipmr.c | ||
ipmr_base.c | ||
Kconfig | ||
Makefile | ||
metrics.c | ||
netfilter.c | ||
netlink.c | ||
nexthop.c | ||
ping.c | ||
proc.c | ||
protocol.c | ||
raw.c | ||
raw_diag.c | ||
route.c | ||
syncookies.c | ||
sysctl_net_ipv4.c | ||
tcp.c | ||
tcp_bbr.c | ||
tcp_bic.c | ||
tcp_bpf.c | ||
tcp_cdg.c | ||
tcp_cong.c | ||
tcp_cubic.c | ||
tcp_dctcp.c | ||
tcp_dctcp.h | ||
tcp_diag.c | ||
tcp_fastopen.c | ||
tcp_highspeed.c | ||
tcp_htcp.c | ||
tcp_hybla.c | ||
tcp_illinois.c | ||
tcp_input.c | ||
tcp_ipv4.c | ||
tcp_lp.c | ||
tcp_metrics.c | ||
tcp_minisocks.c | ||
tcp_nv.c | ||
tcp_offload.c | ||
tcp_output.c | ||
tcp_plb.c | ||
tcp_rate.c | ||
tcp_recovery.c | ||
tcp_scalable.c | ||
tcp_timer.c | ||
tcp_ulp.c | ||
tcp_vegas.c | ||
tcp_vegas.h | ||
tcp_veno.c | ||
tcp_westwood.c | ||
tcp_yeah.c | ||
tunnel4.c | ||
udp.c | ||
udp_bpf.c | ||
udp_diag.c | ||
udp_impl.h | ||
udp_offload.c | ||
udp_tunnel_core.c | ||
udp_tunnel_nic.c | ||
udp_tunnel_stub.c | ||
udplite.c | ||
xfrm4_input.c | ||
xfrm4_output.c | ||
xfrm4_policy.c | ||
xfrm4_protocol.c | ||
xfrm4_state.c | ||
xfrm4_tunnel.c |