Dong Chenchen d6bef00498 net: Remove acked SYN flag from packet in the transmit queue correctly ... [ Upstream commit f99cd56230 ] syzkaller report: kernel BUG at net/core/skbuff.c:3452! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.7.0-rc4-00009-gbee0e7762ad2-dirty #135 RIP: 0010:skb_copy_and_csum_bits (net/core/skbuff.c:3452) Call Trace: icmp_glue_bits (net/ipv4/icmp.c:357) __ip_append_data.isra.0 (net/ipv4/ip_output.c:1165) ip_append_data (net/ipv4/ip_output.c:1362 net/ipv4/ip_output.c:1341) icmp_push_reply (net/ipv4/icmp.c:370) __icmp_send (./include/net/route.h:252 net/ipv4/icmp.c:772) ip_fragment.constprop.0 (./include/linux/skbuff.h:1234 net/ipv4/ip_output.c:592 net/ipv4/ip_output.c:577) __ip_finish_output (net/ipv4/ip_output.c:311 net/ipv4/ip_output.c:295) ip_output (net/ipv4/ip_output.c:427) __ip_queue_xmit (net/ipv4/ip_output.c:535) __tcp_transmit_skb (net/ipv4/tcp_output.c:1462) __tcp_retransmit_skb (net/ipv4/tcp_output.c:3387) tcp_retransmit_skb (net/ipv4/tcp_output.c:3404) tcp_retransmit_timer (net/ipv4/tcp_timer.c:604) tcp_write_timer (./include/linux/spinlock.h:391 net/ipv4/tcp_timer.c:716) The panic issue was trigered by tcp simultaneous initiation. The initiation process is as follows: TCP A TCP B 1. CLOSED CLOSED 2. SYN-SENT --> <SEQ=100><CTL=SYN> ... 3. SYN-RECEIVED <-- <SEQ=300><CTL=SYN> <-- SYN-SENT 4. ... <SEQ=100><CTL=SYN> --> SYN-RECEIVED 5. SYN-RECEIVED --> <SEQ=100><ACK=301><CTL=SYN,ACK> ... // TCP B: not send challenge ack for ack limit or packet loss // TCP A: close tcp_close tcp_send_fin if (!tskb && tcp_under_memory_pressure(sk)) tskb = skb_rb_last(&sk->tcp_rtx_queue); //pick SYN_ACK packet TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN; // set FIN flag 6. FIN_WAIT_1 --> <SEQ=100><ACK=301><END_SEQ=102><CTL=SYN,FIN,ACK> ... // TCP B: send challenge ack to SYN_FIN_ACK 7. ... <SEQ=301><ACK=101><CTL=ACK> <-- SYN-RECEIVED //challenge ack // TCP A: <SND.UNA=101> 8. FIN_WAIT_1 --> <SEQ=101><ACK=301><END_SEQ=102><CTL=SYN,FIN,ACK> ... // retransmit panic __tcp_retransmit_skb //skb->len=0 tcp_trim_head len = tp->snd_una - TCP_SKB_CB(skb)->seq // len=101-100 __pskb_trim_head skb->data_len -= len // skb->len=-1, wrap around ... ... ip_fragment icmp_glue_bits //BUG_ON If we use tcp_trim_head() to remove acked SYN from packet that contains data or other flags, skb->len will be incorrectly decremented. We can remove SYN flag that has been acked from rtx_queue earlier than tcp_trim_head(), which can fix the problem mentioned above. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Co-developed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com> Link: https://lore.kernel.org/r/20231210020200.1539875-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-12-20 17:01:49 +01:00
..
6lowpan
9p	9p: v9fs_listxattr: fix %s null argument warning	2023-11-28 17:19:46 +00:00
802
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-18 12:44:56 -07:00
appletalk
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:01:48 +01:00
ax25	ax25: Kconfig: Update link for linux-ax25.org	2023-09-18 12:56:58 +01:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-24 10:51:39 -07:00
bluetooth	Bluetooth: Fix double free in hci_conn_cleanup	2023-11-28 17:19:38 +00:00
bpf	bpf: Prevent inlining of bpf_fentry_test7()	2023-08-30 08:36:17 +02:00
bpfilter
bridge	netfilter: nf_conntrack_bridge: initialize err to 0	2023-11-28 17:19:52 +00:00
caif
can	can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior	2023-10-06 12:54:33 +02:00
ceph	libceph: use kernel_connect()	2023-10-09 13:35:24 +02:00
core	io_uring/af_unix: disable sending io_uring over sockets	2023-12-13 18:45:20 +01:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-01 21:07:46 -07:00
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2023-11-20 11:59:35 +01:00
devlink	devlink: Hold devlink lock on health reporter dump get	2023-10-06 15:56:46 -07:00
dns_resolver
dsa	net: dsa: mark parsed interface mode for legacy switch drivers	2023-08-09 13:08:09 -07:00
ethernet
ethtool	ethtool: don't propagate EOPNOTSUPP from dumps	2023-12-08 08:52:23 +01:00
handshake	net/handshake: fix file ref count in handshake_nl_accept_doit()	2023-10-23 10:19:33 -07:00
hsr	hsr: Prevent use after free in prp_create_tagged_frame()	2023-11-20 11:59:34 +01:00
ieee802154	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
ife
ipv4	net: Remove acked SYN flag from packet in the transmit queue correctly	2023-12-20 17:01:49 +01:00
ipv6	net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX	2023-12-20 17:01:45 +01:00
iucv
kcm	kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().	2023-09-14 10:43:51 +02:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-18 12:44:56 -07:00
l2tp	udp: annotate data-races around udp->encap_type	2023-11-20 11:58:56 +01:00
l3mdev
lapb
llc	llc: verify mac len before reading mac header	2023-11-20 11:59:34 +01:00
mac80211	wifi: mac80211: do not pass AP_VLAN vif pointer to drivers during flush	2023-12-08 08:52:21 +01:00
mac802154
mctp	mctp: perform route lookups under a RCU read-side lock	2023-10-10 19:43:22 -07:00
mpls	networking: Update to register_net_sysctl_sz	2023-08-15 15:26:18 -07:00
mptcp	mptcp: fix setsockopt(IP_TOS) subflow locking	2023-11-28 17:20:14 +00:00
ncsi	Revert ncsi: Propagate carrier gain/loss events to the NCSI controller	2023-11-28 17:20:10 +00:00
netfilter	netfilter: nft_set_pipapo: skip inactive elements during set walk	2023-12-13 18:45:35 +01:00
netlabel	netlabel: Remove unused declaration netlbl_cipsov4_doi_free()	2023-08-02 12:28:22 -07:00
netlink	drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group	2023-12-13 18:45:10 +01:00
netrom	netrom: Deny concurrent connect().	2023-08-28 06:58:46 +01:00
nfc	nfc: nci: fix possible NULL pointer dereference in send_acknowledge()	2023-10-16 17:34:53 -07:00
nsh
openvswitch	net/sched: act_ct: Always fill offloading tuple iifidx	2023-11-20 11:59:37 +01:00
packet	packet: Move reference count in packet_sock to atomic_long_t	2023-12-13 18:45:23 +01:00
phonet
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:45:10 +01:00
qrtr
rds	net: prevent address rewrite in kernel_bind()	2023-10-01 19:31:29 +01:00
rfkill	net: rfkill: reduce data->mtx scope in rfkill_fop_open	2023-10-11 16:55:10 +02:00
rose	net/rose: Fix Use-After-Free in rose_ioctl	2023-12-20 17:01:48 +01:00
rxrpc	rxrpc: Defer the response to a PING ACK until we've parsed it	2023-12-03 07:33:02 +01:00
sched	net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table	2023-12-20 17:01:47 +01:00
sctp	sctp: update hb timer immediately after users change hb_interval	2023-10-04 17:29:58 -07:00
smc	net/smc: fix missing byte order conversion in CLC handshake	2023-12-13 18:45:11 +01:00
strparser
sunrpc	svcrdma: Drop connection after an RDMA Read error	2023-11-28 17:20:02 +00:00
switchdev	net: switchdev: Add a helper to replay objects on a bridge port	2023-07-21 08:54:03 +01:00
tipc	tipc: Fix kernel-infoleak due to uninitialized TLV value	2023-11-28 17:19:51 +00:00
tls	net: tls, update curr on splice as well	2023-12-13 18:45:10 +01:00
unix	bpf, sockmap: af_unix stream sockets need to hold ref for pair sock	2023-12-08 08:52:23 +01:00
vmw_vsock	vsock: read from socket's error queue	2023-11-28 17:19:38 +00:00
wireless	Revert "wifi: cfg80211: fix CQM for non-range use"	2023-12-11 10:40:17 +01:00
x25
xdp	xsk: Skip polling event check for unbound socket	2023-12-13 18:45:06 +01:00
xfrm	ipsec-2023-10-17	2023-10-17 18:21:13 -07:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile
socket.c	net: prevent address rewrite in kernel_bind()	2023-10-01 19:31:29 +01:00
sysctl_net.c	sysctl: Add size to register_net_sysctl function	2023-08-15 15:26:17 -07:00