Eric Dumazet ba5a4fdd63 tcp: make sure treq->af_specific is initialized ... syzbot complained about a recent change in TCP stack, hitting a NULL pointer [1] tcp request sockets have an af_specific pointer, which was used before the blamed change only for SYNACK generation in non SYNCOOKIE mode. tcp requests sockets momentarily created when third packet coming from client in SYNCOOKIE mode were not using treq->af_specific. Make sure this field is populated, in the same way normal TCP requests sockets do in tcp_conn_request(). [1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 3695 Comm: syz-executor864 Not tainted 5.18.0-rc3-syzkaller-00224-g5fd1fe4807f9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:tcp_create_openreq_child+0xe16/0x16b0 net/ipv4/tcp_minisocks.c:534 Code: 48 c1 ea 03 80 3c 02 00 0f 85 e5 07 00 00 4c 8b b3 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 07 00 00 48 8b 3c 24 48 89 de 41 ff 56 08 48 RSP: 0018:ffffc90000de0588 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888076490330 RCX: 0000000000000100 RDX: 0000000000000001 RSI: ffffffff87d67ff0 RDI: 0000000000000008 RBP: ffff88806ee1c7f8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff87d67f00 R11: 0000000000000000 R12: ffff88806ee1bfc0 R13: ffff88801b0e0368 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f517fe58700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffcead76960 CR3: 000000006f97b000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> tcp_v6_syn_recv_sock+0x199/0x23b0 net/ipv6/tcp_ipv6.c:1267 tcp_get_cookie_sock+0xc9/0x850 net/ipv4/syncookies.c:207 cookie_v6_check+0x15c3/0x2340 net/ipv6/syncookies.c:258 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1131 [inline] tcp_v6_do_rcv+0x1148/0x13b0 net/ipv6/tcp_ipv6.c:1486 tcp_v6_rcv+0x3305/0x3840 net/ipv6/tcp_ipv6.c:1725 ip6_protocol_deliver_rcu+0x2e9/0x1900 net/ipv6/ip6_input.c:422 ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:464 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:473 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x27f/0x3b0 net/ipv6/ip6_input.c:297 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 process_backlog+0x3a0/0x7c0 net/core/dev.c:5847 __napi_poll+0xb3/0x6e0 net/core/dev.c:6413 napi_poll net/core/dev.c:6480 [inline] net_rx_action+0x8ec/0xc60 net/core/dev.c:6567 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 Fixes: 5b0b9e4c2c ("tcp: md5: incorrect tcp_header_len for incoming connections") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Francesco Ruggeri <fruggeri@arista.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2022-04-25 12:10:11 +01:00
..
ila	net: ipv6: check return value of rhashtable_init	2021-09-28 12:59:24 +01:00
netfilter	netfilter: nft_fib: add reduce support	2022-03-20 00:29:47 +01:00
addrconf.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-03 11:55:12 -08:00
addrconf_core.c	ipv6: add net device refcount tracker to struct inet6_dev	2021-12-06 16:05:11 -08:00
addrlabel.c
af_inet6.c	ipv6: annotate some data-races around sk->sk_prot	2022-02-18 11:53:28 +00:00
ah6.c	ipv6: ah6: use swap() to make code cleaner	2021-11-18 12:00:15 +00:00
anycast.c
calipso.c
datagram.c
esp6.c	esp: limit skb_page_frag_refill use to a single page	2022-04-13 10:16:11 +02:00
esp6_offload.c	net: Fix esp GSO on inter address family tunnels.	2022-03-07 13:14:04 +01:00
exthdrs.c	ipv6: partially inline ipv6_fixup_options	2022-01-27 19:46:11 -08:00
exthdrs_core.c
exthdrs_offload.c
fib6_notifier.c
fib6_rules.c	ipv6: change fib6_rules_net_exit() to batch mode	2022-02-08 20:41:34 -08:00
fou6.c
icmp.c	ipv6: do not use per netns icmp sockets	2022-01-25 11:25:21 +00:00
inet6_connection_sock.c
inet6_hashtables.c	tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH.	2022-02-09 21:28:36 -08:00
ioam6.c	net: ipv6: Get rcv timestamp if needed when handling hop-by-hop IOAM option	2022-03-03 14:38:48 +00:00
ioam6_iptunnel.c	ipv6: ioam: Insertion frequency in lwtunnel output	2022-02-04 20:24:45 -08:00
ip6_checksum.c
ip6_fib.c	ipv6: annotate accesses to fn->fn_sernum	2022-01-20 20:18:37 -08:00
ip6_flowlabel.c	ipv6: per-netns exclusive flowlabel checks	2022-02-16 20:37:47 -08:00
ip6_gre.c	ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode	2022-04-25 11:40:45 +01:00
ip6_icmp.c
ip6_input.c	net: Postpone skb_clear_delivery_time() until knowing the skb is delivered locally	2022-03-03 14:38:48 +00:00
ip6_offload.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-02-24 17:54:25 -08:00
ip6_offload.h
ip6_output.c	ipv6: fix panic when forwarding a pkt with no in6 dev	2022-04-11 12:28:43 +01:00
ip6_tunnel.c	ip6_tunnel: fix possible NULL deref in ip6_tnl_xmit	2022-02-09 11:56:19 +00:00
ip6_udp_tunnel.c
ip6_vti.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-12-30 12:12:12 -08:00
ip6mr.c	net: ipv6mr: fix unused variable warning with CONFIG_IPV6_PIMSM_V2=n	2022-04-06 15:14:30 +01:00
ipcomp6.c
ipv6_sockglue.c	ipv6: annotate some data-races around sk->sk_prot	2022-02-18 11:53:28 +00:00
Kconfig	ipv6: ioam: Add support for the ip6ip6 encapsulation	2021-10-04 12:53:35 +01:00
Makefile	net: ipv6: use ipv6-y directly instead of ipv6-objs	2021-09-28 13:13:40 +01:00
mcast.c	ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()	2022-03-03 09:47:06 -08:00
mcast_snoop.c
mip6.c
ndisc.c	ipv6: separate ndisc_ns_create() from ndisc_send_ns()	2022-02-21 12:13:45 +00:00
netfilter.c	netfilter: Update ip6_route_me_harder to consider L3 domain	2022-04-25 11:09:20 +02:00
output_core.c
ping.c	net: ping6: support setting basic SOL_IPV6 options via cmsg	2022-02-17 14:22:09 +00:00
proc.c
protocol.c
raw.c	ipv6: raw: check passed optlen before reading	2021-12-29 12:32:56 -08:00
reassembly.c	net: ipv6: Handle delivery_time in ipv6 defrag	2022-03-03 14:38:48 +00:00
route.c	ipv6: make ip6_rt_gc_expire an atomic_t	2022-04-15 14:28:50 -07:00
rpl.c
rpl_iptunnel.c
seg6.c	icmp: ICMPV6: Examine invoking packet for Segment Route Headers.	2022-01-04 12:17:35 +00:00
seg6_hmac.c	net: ipv6: check return value of rhashtable_init	2021-09-28 12:59:24 +01:00
seg6_iptunnel.c	seg6: fix the iif in the IPv6 socket control block	2021-12-09 07:55:42 -08:00
seg6_local.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-01-05 14:36:10 -08:00
sit.c	sit: allow encapsulated IPv6 traffic to be delivered locally	2022-01-12 13:56:07 -08:00
syncookies.c	tcp: make sure treq->af_specific is initialized	2022-04-25 12:10:11 +01:00
sysctl_net_ipv6.c
tcp_ipv6.c	skb: make drop reason booleanable	2022-03-09 11:22:58 +00:00
tcpv6_offload.c	net: move gro definitions to include/net/gro.h	2021-11-16 13:16:54 +00:00
tunnel6.c
udp.c	ipv6: Add reasons for skb drops to __udp6_lib_rcv	2022-02-14 11:24:39 +00:00
udp_impl.h
udp_offload.c	gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers	2021-11-24 17:21:42 -08:00
udplite.c
xfrm6_input.c
xfrm6_output.c	xfrm: fix tunnel model fragmentation behavior	2022-03-01 12:08:40 +01:00
xfrm6_policy.c	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2022-03-15 20:20:02 -07:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c