mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/net/ipv4
History
Florian Westphal ae2dd71649 mptcp: handle tcp fallback when using syn cookies 
We can't deal with syncookie mode yet, the syncookie rx path will create
tcp reqsk, i.e. we get OOB access because we treat tcp reqsk as mptcp reqsk one:

TCP: SYN flooding on port 20002. Sending cookies.
BUG: KASAN: slab-out-of-bounds in subflow_syn_recv_sock+0x451/0x4d0 net/mptcp/subflow.c:191
Read of size 1 at addr ffff8881167bc148 by task syz-executor099/2120
 subflow_syn_recv_sock+0x451/0x4d0 net/mptcp/subflow.c:191
 tcp_get_cookie_sock+0xcf/0x520 net/ipv4/syncookies.c:209
 cookie_v6_check+0x15a5/0x1e90 net/ipv6/syncookies.c:252
 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1123 [inline]
 [..]

Bug can be reproduced via "sysctl net.ipv4.tcp_syncookies=2".

Note that MPTCP should work with syncookies (4th ack would carry needed
state), but it appears better to sort that out in -next so do tcp
fallback for now.

I removed the MPTCP ifdef for tcp_rsk "is_mptcp" member because
if (IS_ENABLED()) is easier to read than "#ifdef IS_ENABLED()/#endif" pair.

Cc: Eric Dumazet <edumazet@google.com>
Fixes: cec37a6e41 ("mptcp: Handle MP_CAPABLE options for outgoing connections")
Reported-by: Christoph Paasch <cpaasch@apple.com>
Tested-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2020-01-29 17:45:20 +01:00
..
bpfilter
…
netfilter netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct 2020-01-13 19:22:10 +01:00
Kconfig xfrm: add espintcp (RFC 8229) 2019-12-09 09:59:07 +01:00
Makefile bpf: tcp: Support tcp_congestion_ops in bpf 2020-01-09 08:46:18 -08:00
af_inet.c net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port) 2019-11-26 13:20:46 -08:00
ah4.c
…
arp.c
…
bpf_tcp_ca.c bpf: Add BPF_FUNC_tcp_send_ack helper 2020-01-09 08:46:18 -08:00
cipso_ipv4.c
…
datagram.c inet: stop leaking jiffies on the wire 2019-11-01 14:57:52 -07:00
devinet.c inet: protect against too small mtu values. 2019-12-07 11:55:11 -08:00
esp4.c xfrm: add espintcp (RFC 8229) 2019-12-09 09:59:07 +01:00
esp4_offload.c xfrm: support output_mark for offload ESP packets 2020-01-15 12:18:35 +01:00
fib_frontend.c ipv4: move fib4_has_custom_rules() helper to public header 2019-11-21 14:45:55 -08:00
fib_lookup.h ipv4: Add "offload" and "trap" indications to routes 2020-01-14 18:53:35 -08:00
fib_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib_rules.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib_semantics.c ipv4: Add "offload" and "trap" indications to routes 2020-01-14 18:53:35 -08:00
fib_trie.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net 2020-01-19 22:10:04 +01:00
fou.c fou: Fix IPv6 netlink policy 2020-01-23 14:32:52 +01:00
gre_demux.c gre: refetch erspan header from skb->data after pskb_may_pull() 2019-12-07 11:53:27 -08:00
gre_offload.c net: remove the check argument from __skb_gro_checksum_convert 2020-01-03 12:24:34 -08:00
icmp.c net: icmp: fix data-race in cmp_global_allow() 2019-11-08 12:32:43 -08:00
igmp.c igmp: uninline ip_mc_validate_checksum() 2019-10-04 14:26:46 -07:00
inet_connection_sock.c tcp/ipv4: remove AF_INET_FAMILY 2020-01-21 12:03:51 +01:00
inet_diag.c tcp/dccp: fix possible race __inet_lookup_established() 2019-12-13 21:40:49 -08:00
inet_fragment.c inet: frags: re-introduce skb coalescing for local delivery 2019-08-08 15:55:10 -07:00
inet_hashtables.c tcp/dccp: fix possible race __inet_lookup_established() 2019-12-13 21:40:49 -08:00
inet_timewait_sock.c
…
inetpeer.c inetpeer: fix data-race in inet_putpeer / inet_putpeer 2019-11-07 16:15:56 -08:00
ip_forward.c ipv4: Revert removal of rt_uses_gateway 2019-09-20 18:23:33 -07:00
ip_fragment.c inet: frags: re-introduce skb coalescing for local delivery 2019-08-08 15:55:10 -07:00
ip_gre.c treewide: Use sizeof_field() macro 2019-12-09 10:36:44 -08:00
ip_input.c ipv4: use dst hint for ipv4 list receive 2019-11-21 14:45:55 -08:00
ip_options.c netfilter: nf_tables: add support for matching IPv4 options 2019-06-21 18:35:51 +02:00
ip_output.c net: ipv4: use skb_list_walk_safe helper for gso segments 2020-01-14 11:48:41 -08:00
ip_sockglue.c
…
ip_tunnel.c net, ip_tunnel: fix namespaces move 2020-01-21 16:05:21 +01:00
ip_tunnel_core.c lwtunnel: check erspan options before allocating tun_info 2019-11-21 11:47:39 -08:00
ip_vti.c vti[6]: fix packet tx through bpf_redirect() 2020-01-14 08:55:38 +01:00
ipcomp.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 2019-07-05 15:01:15 -07:00
ipconfig.c net: ipconfig: Wait for deferred device probes 2019-11-20 12:39:53 -08:00
ipip.c ipip: validate header length in ipip_tunnel_xmit 2019-07-25 17:23:40 -07:00
ipmr.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-16 21:51:42 -08:00
ipmr_base.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
metrics.c
…
netfilter.c
…
netlink.c
…
nexthop.c net: include struct nhmsg size in nh nlmsg size 2020-01-27 10:54:08 +01:00
ping.c ip: support SO_MARK cmsg 2019-09-13 21:44:19 +02:00
proc.c tcp: export count for rehash attempts 2020-01-26 15:28:47 +01:00
protocol.c
…
raw.c netfilter: drop bridge nf reset from nf_reset 2019-10-01 18:42:15 +02:00
raw_diag.c net: don't warn in inet diag when IPV6 is disabled 2019-07-03 11:26:35 -07:00
route.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-01-26 10:40:21 +01:00
syncookies.c mptcp: handle tcp fallback when using syn cookies 2020-01-29 17:45:20 +01:00
sysctl_net_ipv4.c net-tcp: Disable TCP ssthresh metrics cache by default 2019-12-09 20:17:48 -08:00
tcp.c tcp: export count for rehash attempts 2020-01-26 15:28:47 +01:00
tcp_bbr.c tcp_bbr: improve arithmetic division in bbr_update_bw() 2020-01-21 10:45:49 +01:00
tcp_bic.c
…
tcp_bpf.c bpf: Sockmap/tls, fix pop data with SK_DROP return code 2020-01-15 23:26:13 +01:00
tcp_cdg.c
…
tcp_cong.c bpf: tcp: Support tcp_congestion_ops in bpf 2020-01-09 08:46:18 -08:00
tcp_cubic.c tcp_cubic: refactor code to perform a divide only when needed 2019-12-30 14:44:27 -08:00
tcp_dctcp.c
…
tcp_dctcp.h
…
tcp_diag.c net: annotate lockless accesses to sk->sk_max_ack_backlog 2019-11-06 16:14:48 -08:00
tcp_fastopen.c tcp: add TCP_INFO status for failed client TFO 2019-10-25 19:25:37 -07:00
tcp_highspeed.c
…
tcp_htcp.c
…
tcp_hybla.c
…
tcp_illinois.c
…
tcp_input.c mptcp: handle tcp fallback when using syn cookies 2020-01-29 17:45:20 +01:00
tcp_ipv4.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2020-01-23 08:10:16 +01:00
tcp_lp.c
…
tcp_metrics.c net-tcp: Disable TCP ssthresh metrics cache by default 2019-12-09 20:17:48 -08:00
tcp_minisocks.c bpf: tcp: Support tcp_congestion_ops in bpf 2020-01-09 08:46:18 -08:00
tcp_nv.c
…
tcp_offload.c
…
tcp_output.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-01-26 10:40:21 +01:00
tcp_rate.c
…
tcp_recovery.c
…
tcp_scalable.c
…
tcp_timer.c tcp: export count for rehash attempts 2020-01-26 15:28:47 +01:00
tcp_ulp.c bpf: Sockmap/tls, push write_space updates through ulp updates 2020-01-15 23:26:13 +01:00
tcp_vegas.c
…
tcp_vegas.h
…
tcp_veno.c
…
tcp_westwood.c
…
tcp_yeah.c
…
tunnel4.c
…
udp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-01-26 10:40:21 +01:00
udp_diag.c
…
udp_impl.h
…
udp_offload.c udp: Support UDP fraglist GRO/GSO. 2020-01-27 11:00:21 +01:00
udp_tunnel.c
…
udplite.c
…
xfrm4_input.c
…
xfrm4_output.c netfilter: Support iif matches in POSTROUTING 2019-11-15 23:44:48 +01:00
xfrm4_policy.c net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2019-12-24 22:28:54 -08:00
xfrm4_protocol.c xfrm: add route lookup to xfrm4_rcv_encap 2019-12-09 09:59:07 +01:00
xfrm4_state.c
…
xfrm4_tunnel.c
…