mirror/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
eda40be3a5ff3fdce513d2bcfeaca8cc16cf962a
linux/net/ipv4
History
Kuniyuki Iwashima 3ebc46ca86 tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). 
In dctcp_update_alpha(), we use a module parameter dctcp_shift_g
as follows:

  alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g);
  ...
  delivered_ce <<= (10 - dctcp_shift_g);

It seems syzkaller started fuzzing module parameters and triggered
shift-out-of-bounds [0] by setting 100 to dctcp_shift_g:

  memcpy((void*)0x20000080,
         "/sys/module/tcp_dctcp/parameters/dctcp_shift_g\000", 47);
  res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul,
                /*flags=*/2ul, /*mode=*/0ul);
  memcpy((void*)0x20000000, "100\000", 4);
  syscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul);

Let's limit the max value of dctcp_shift_g by param_set_uint_minmax().

With this patch:

  # echo 10 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g
  # cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g
  10
  # echo 11 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g
  -bash: echo: write error: Invalid argument

[0]:
UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12
shift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x346/0x3a0 lib/ubsan.c:468
 dctcp_update_alpha+0x540/0x570 net/ipv4/tcp_dctcp.c:143
 tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline]
 tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:3948
 tcp_rcv_state_process+0x57a/0x2290 net/ipv4/tcp_input.c:6711
 tcp_v4_do_rcv+0x764/0xc40 net/ipv4/tcp_ipv4.c:1937
 sk_backlog_rcv include/net/sock.h:1106 [inline]
 __release_sock+0x20f/0x350 net/core/sock.c:2983
 release_sock+0x61/0x1f0 net/core/sock.c:3549
 mptcp_subflow_shutdown+0x3d0/0x620 net/mptcp/protocol.c:2907
 mptcp_check_send_data_fin+0x225/0x410 net/mptcp/protocol.c:2976
 __mptcp_close+0x238/0xad0 net/mptcp/protocol.c:3072
 mptcp_close+0x2a/0x1a0 net/mptcp/protocol.c:3127
 inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437
 __sock_release net/socket.c:659 [inline]
 sock_close+0xc0/0x240 net/socket.c:1421
 __fput+0x41b/0x890 fs/file_table.c:422
 task_work_run+0x23b/0x300 kernel/task_work.c:180
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0x9c8/0x2540 kernel/exit.c:878
 do_group_exit+0x201/0x2b0 kernel/exit.c:1027
 __do_sys_exit_group kernel/exit.c:1038 [inline]
 __se_sys_exit_group kernel/exit.c:1036 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xe4/0x240 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7f6c2b5005b6
Code: Unable to access opcode bytes at 0x7f6c2b50058c.
RSP: 002b:00007ffe883eb948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f6c2b5862f0 RCX: 00007f6c2b5005b6
RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
RBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffffc0
R10: 0000000000000006 R11: 0000000000000246 R12: 00007f6c2b5862f0
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
 </TASK>

Reported-by: syzkaller <syzkaller@googlegroups.com>
Reported-by: Yue Sun <samsun1006219@gmail.com>
Reported-by: xingwei lee <xrivendell7@gmail.com>
Closes: https://lore.kernel.org/netdev/CAEkJfYNJM=cw-8x7_Vmj1J6uYVCWMbbvD=EFmDPVBGpTsqOxEA@mail.gmail.com/
Fixes: e3118e8359 ("net: tcp: add DCTCP congestion control algorithm")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240517091626.32772-1-kuniyu@amazon.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2024-05-21 13:34:50 +02:00
..
netfilter
netfilter: use NF_DROP instead of -NF_DROP
2024-05-06 16:29:21 +02:00
af_inet.c
net: gro: move L3 flush checks to tcp_gro_receive and udp_gro_receive_segment
2024-05-13 14:44:06 -07:00
ah4.c
net: fill in MODULE_DESCRIPTION()s for ipv4 modules
2024-02-09 14:12:02 -08:00
arp.c
arp: Convert ioctl(SIOCGARP) to RCU.
2024-05-01 18:37:07 -07:00
bpf_tcp_ca.c
bpf: tcp: Allow to write tp->snd_cwnd_stamp in bpf_tcp_ca
2024-05-02 16:26:56 -07:00
cipso_ipv4.c
netlabel: fix RCU annotation for IPv4 options on socket creation
2024-05-13 14:58:12 -07:00
datagram.c
ipv4: Set the routing scope properly in ip_route_output_ports().
2024-02-12 17:33:05 -08:00
devinet.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-05-14 10:53:19 -07:00
esp4_offload.c
xfrm: Support GRO for IPv4 ESP in UDP encapsulation
2023-10-06 07:30:40 +02:00
esp4.c
Merge tag 'ipsec-next-2024-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next
2024-05-06 19:14:56 -07:00
fib_frontend.c
inet: bring NLM_DONE out to a separate recv() again
2024-04-15 10:25:27 +01:00
fib_lookup.h
…
fib_notifier.c
…
fib_rules.c
fib: remove unnecessary input parameters in fib_default_rule_add
2024-01-03 16:42:48 -08:00
fib_semantics.c
net: add two more call_rcu_hurry()
2024-04-25 15:24:23 -07:00
fib_trie.c
inet: switch inet_dump_fib() to RCU protection
2024-02-26 11:46:13 +00:00
fou_bpf.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
fou_core.c
net: gro: rename skb_gro_header_hard()
2024-03-05 13:30:11 +01:00
fou_nl.c
net: ynl: prefix uAPI header include with uapi/
2023-05-26 10:30:14 +01:00
fou_nl.h
net: ynl: prefix uAPI header include with uapi/
2023-05-26 10:30:14 +01:00
gre_demux.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
gre_offload.c
net: gro: rename skb_gro_header_hard()
2024-03-05 13:30:11 +01:00
icmp.c
net/ipv4: add tracepoint for icmp_send
2024-05-08 10:39:26 +01:00
igmp.c
ipv4: Set scope explicitly in ip_route_output().
2024-04-08 13:20:51 +01:00
inet_connection_sock.c
tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6) non-wildcard addresses.
2024-03-29 14:48:38 -07:00
inet_diag.c
inet_diag: skip over empty buckets
2024-01-23 15:13:55 +01:00
inet_fragment.c
inet: frags: delay fqdir_free_fn()
2024-04-08 10:59:56 +01:00
inet_hashtables.c
tcp: get rid of twsk_unique()
2024-05-09 20:25:55 -07:00
inet_timewait_sock.c
tcp/dccp: do not care about families in inet_twsk_purge()
2024-04-01 21:27:58 -07:00
inetpeer.c
net: ipv4: Simplify the allocation of slab caches in inet_initpeers
2024-01-31 16:39:42 -08:00
ip_forward.c
net: fix IPSTATS_MIB_OUTFORWDATAGRAMS increment after fragment check
2023-10-13 09:58:45 -07:00
ip_fragment.c
net: ipv{6,4}: Remove the now superfluous sentinel elements from ctl_table array
2024-05-03 13:29:42 +01:00
ip_gre.c
net: annotate writes on dev->mtu from ndo_change_mtu()
2024-05-07 16:19:14 -07:00
ip_input.c
inet: introduce dst_rtable() helper
2024-04-30 18:32:38 -07:00
ip_options.c
…
ip_output.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-05-02 12:06:25 -07:00
ip_sockglue.c
inet: Add getsockopt support for IP_ROUTER_ALERT and IPV6_ROUTER_ALERT
2024-03-06 12:37:06 +00:00
ip_tunnel_core.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
ip_tunnel.c
net: annotate writes on dev->mtu from ndo_change_mtu()
2024-05-07 16:19:14 -07:00
ip_vti.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
ipcomp.c
xfrm: ipcomp: add extack to ipcomp{4,6}_init_state
2022-09-29 07:18:00 +02:00
ipconfig.c
net: ipconfig: move ic_nameservers_fallback into #ifdef block
2023-05-22 11:17:55 +01:00
ipip.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
ipmr_base.c
ipmr: adopt rcu_read_lock() in mr_dump()
2022-06-24 11:34:38 +01:00
ipmr.c
ip_tunnel: use a separate struct to store tunnel params in the kernel
2024-04-01 10:49:28 +01:00
Kconfig
net/tcp: Add TCP-AO config and structures
2023-10-27 10:35:44 +01:00
Makefile
bpfilter: remove bpfilter
2024-01-04 10:23:10 -08:00
metrics.c
ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
2023-01-23 21:37:25 -08:00
netfilter.c
xfrm: pass struct net to xfrm_decode_session wrappers
2023-10-06 08:31:53 +02:00
netlink.c
…
nexthop.c
nexthop: fix uninitialized variable in nla_put_nh_group_stats()
2024-03-22 18:03:29 -07:00
ping.c
Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2023-10-16 21:05:33 -07:00
proc.c
net: add <net/proto_memory.h>
2024-04-30 18:46:52 -07:00
protocol.c
…
raw_diag.c
inet_diag: add module pointer to "struct inet_diag_handler"
2024-01-23 15:13:54 +01:00
raw.c
ipv4: Fix uninit-value access in __ip_make_skb()
2024-05-02 10:16:35 +02:00
route.c
net: ipv{6,4}: Remove the now superfluous sentinel elements from ctl_table array
2024-05-03 13:29:42 +01:00
syncookies.c
tcp: annotate data-races around tp->window_clamp
2024-04-05 22:32:37 -07:00
sysctl_net_ipv4.c
net: ipv{6,4}: Remove the now superfluous sentinel elements from ctl_table array
2024-05-03 13:29:42 +01:00
tcp_ao.c
tcp: Fix Use-After-Free in tcp_ao_connect_init
2024-04-23 19:06:39 -07:00
tcp_bbr.c
tcp: Add new args for cong_control in tcp_congestion_ops
2024-05-02 16:26:56 -07:00
tcp_bic.c
…
tcp_bpf.c
tcp_bpf: properly release resources on error paths
2023-10-18 18:09:31 -07:00
tcp_cdg.c
Merge tag 'random-6.1-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random
2022-10-16 15:27:07 -07:00
tcp_cong.c
bpf, net: validate struct_ops when updating value.
2024-03-04 10:03:57 -08:00
tcp_cubic.c
bpf: Remove CONFIG_X86 and CONFIG_DYNAMIC_FTRACE guard from the tcp-cc kfuncs
2024-03-28 18:31:40 -07:00
tcp_dctcp.c
tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
2024-05-21 13:34:50 +02:00
tcp_dctcp.h
…
tcp_diag.c
inet_diag: add module pointer to "struct inet_diag_handler"
2024-01-23 15:13:54 +01:00
tcp_fastopen.c
inet: move inet->defer_connect to inet->inet_flags
2023-08-16 11:09:18 +01:00
tcp_highspeed.c
…
tcp_htcp.c
…
tcp_hybla.c
…
tcp_illinois.c
…
tcp_input.c
Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2024-05-13 16:41:10 -07:00
tcp_ipv4.c
tcp: rstreason: handle timewait cases in the receive path
2024-05-13 17:33:57 -07:00
tcp_lp.c
tcp: rename tcp_time_stamp() to tcp_time_stamp_ts()
2023-10-23 09:35:01 +01:00
tcp_metrics.c
tcp_metrics: use parallel_ops for tcp_metrics_nl_family
2024-04-17 18:31:53 -07:00
tcp_minisocks.c
tcp: rstreason: fully support in tcp_check_req()
2024-05-13 17:33:57 -07:00
tcp_nv.c
…
tcp_offload.c
net: gro: move L3 flush checks to tcp_gro_receive and udp_gro_receive_segment
2024-05-13 14:44:06 -07:00
tcp_output.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-05-09 10:01:01 -07:00
tcp_plb.c
prandom: remove prandom_u32_max()
2022-12-20 03:13:45 +01:00
tcp_rate.c
…
tcp_recovery.c
tcp: fix excessive TLP and RACK timeouts from HZ rounding
2023-10-17 17:25:42 -07:00
tcp_scalable.c
…
tcp_sigpool.c
net/tcp_sigpool: Use kref_get_unless_zero()
2024-01-01 14:42:05 +00:00
tcp_timer.c
rstreason: prepare for active reset
2024-04-26 15:34:00 +02:00
tcp_ulp.c
net/ulp: use consistent error code when blocking ULP
2023-01-19 09:26:16 -08:00
tcp_vegas.c
…
tcp_vegas.h
…
tcp_veno.c
…
tcp_westwood.c
…
tcp_yeah.c
…
tcp.c
tcp: socket option to check for MPTCP fallback to TCP
2024-05-13 14:48:04 -07:00
tunnel4.c
net: fill in MODULE_DESCRIPTION()s for ipv4 modules
2024-02-09 14:12:02 -08:00
udp_bpf.c
bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
2023-03-03 17:25:15 +01:00
udp_diag.c
inet_diag: add module pointer to "struct inet_diag_handler"
2024-01-23 15:13:54 +01:00
udp_impl.h
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
udp_offload.c
net: gro: move L3 flush checks to tcp_gro_receive and udp_gro_receive_segment
2024-05-13 14:44:06 -07:00
udp_tunnel_core.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
udp_tunnel_nic.c
udp_tunnel: Use flex array to simplify code
2023-10-03 11:39:34 +02:00
udp_tunnel_stub.c
…
udp.c
Merge tag 'ipsec-next-2024-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next
2024-05-06 19:14:56 -07:00
udplite.c
udplite: remove UDPLITE_BIT
2023-09-14 16:16:36 +02:00
xfrm4_input.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-05-09 10:01:01 -07:00
xfrm4_output.c
…
xfrm4_policy.c
net: ipv{6,4}: Remove the now superfluous sentinel elements from ctl_table array
2024-05-03 13:29:42 +01:00
xfrm4_protocol.c
net: xfrm: unexport __init-annotated xfrm4_protocol_init()
2022-06-08 10:10:13 -07:00
xfrm4_state.c
…
xfrm4_tunnel.c
net: fill in MODULE_DESCRIPTION()s for ipv4 modules
2024-02-09 14:12:02 -08:00