mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-08-25 02:09:42 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/mptcp
History
Mat Martineau 877d11f033 mptcp: Correctly set DATA_FIN timeout when number of retransmits is large 
Syzkaller with UBSAN uncovered a scenario where a large number of
DATA_FIN retransmits caused a shift-out-of-bounds in the DATA_FIN
timeout calculation:

================================================================================
UBSAN: shift-out-of-bounds in net/mptcp/protocol.c:470:29
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 1 PID: 13059 Comm: kworker/1:0 Not tainted 5.17.0-rc2-00630-g5fbf21c90c60 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: events mptcp_worker
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds.cold+0xb2/0x20e lib/ubsan.c:330
 mptcp_set_datafin_timeout net/mptcp/protocol.c:470 [inline]
 __mptcp_retrans.cold+0x72/0x77 net/mptcp/protocol.c:2445
 mptcp_worker+0x58a/0xa70 net/mptcp/protocol.c:2528
 process_one_work+0x9df/0x16d0 kernel/workqueue.c:2307
 worker_thread+0x95/0xe10 kernel/workqueue.c:2454
 kthread+0x2f4/0x3b0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
================================================================================

This change limits the maximum timeout by limiting the size of the
shift, which keeps all intermediate values in-bounds.

Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/259
Fixes: 6477dd39e6 ("mptcp: Retransmit DATA_FIN")
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-02-24 21:54:54 -08:00
..
crypto.c kunit: mptcp: adhere to KUNIT formatting standard 2021-04-16 17:10:40 -07:00
crypto_test.c
ctrl.c mptcp: faster active backup recovery 2021-08-14 11:37:25 +01:00
diag.c
Kconfig kunit: mptcp: adhere to KUNIT formatting standard 2021-04-16 17:10:40 -07:00
Makefile kunit: mptcp: adhere to KUNIT formatting standard 2021-04-16 17:10:40 -07:00
mib.c mptcp: add mibs counter for ignored incoming options 2022-02-19 12:28:00 +00:00
mib.h mptcp: add mibs counter for ignored incoming options 2022-02-19 12:28:00 +00:00
mptcp_diag.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-09-30 14:49:21 -07:00
options.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-01-09 17:00:17 -08:00
pm.c mptcp: add mibs counter for ignored incoming options 2022-02-19 12:28:00 +00:00
pm_netlink.c mptcp: fix race in incoming ADD_ADDR option processing 2022-02-19 12:28:00 +00:00
protocol.c mptcp: Correctly set DATA_FIN timeout when number of retransmits is large 2022-02-24 21:54:54 -08:00
protocol.h mptcp: Use struct_group() to avoid cross-field memset() 2022-01-21 19:26:03 -08:00
sockopt.c mptcp: cleanup MPJ subflow list handling 2022-01-07 11:27:07 +00:00
subflow.c mptcp: reuse __mptcp_make_csum in validate_data_csum 2022-01-07 19:00:44 -08:00
syncookies.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00
token.c mptcp: full disconnect implementation 2022-01-07 11:27:06 +00:00
token_test.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00