Patch "mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mptcp-use-option_mptcp_mpj_syn-in-subflow_check_req.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2ef44173346ebd42a8f49153332acbf455a5a3cf
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Thu Jan 11 19:49:16 2024 +0000

    mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()
    
    [ Upstream commit 66ff70df1a919a066942844bb095d6fcb748d78d ]
    
    syzbot reported that subflow_check_req() was using uninitialized data in
    subflow_check_req() [1]
    
    This is because mp_opt.token is only set when OPTION_MPTCP_MPJ_SYN is also set.
    
    While we are are it, fix mptcp_subflow_init_cookie_req()
    to test for OPTION_MPTCP_MPJ_ACK.
    
    [1]
    
    BUG: KMSAN: uninit-value in subflow_token_join_request net/mptcp/subflow.c:91 [inline]
     BUG: KMSAN: uninit-value in subflow_check_req+0x1028/0x15d0 net/mptcp/subflow.c:209
      subflow_token_join_request net/mptcp/subflow.c:91 [inline]
      subflow_check_req+0x1028/0x15d0 net/mptcp/subflow.c:209
      subflow_v6_route_req+0x269/0x410 net/mptcp/subflow.c:367
      tcp_conn_request+0x153a/0x4240 net/ipv4/tcp_input.c:7164
     subflow_v6_conn_request+0x3ee/0x510
      tcp_rcv_state_process+0x2e1/0x4ac0 net/ipv4/tcp_input.c:6659
      tcp_v6_do_rcv+0x11bf/0x1fe0 net/ipv6/tcp_ipv6.c:1669
      tcp_v6_rcv+0x480b/0x4fb0 net/ipv6/tcp_ipv6.c:1900
      ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438
      ip6_input_finish net/ipv6/ip6_input.c:483 [inline]
      NF_HOOK include/linux/netfilter.h:314 [inline]
      ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492
      dst_input include/net/dst.h:461 [inline]
      ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79
      NF_HOOK include/linux/netfilter.h:314 [inline]
      ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310
      __netif_receive_skb_one_core net/core/dev.c:5532 [inline]
      __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646
      netif_receive_skb_internal net/core/dev.c:5732 [inline]
      netif_receive_skb+0x58/0x660 net/core/dev.c:5791
      tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555
      tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002
      tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048
      call_write_iter include/linux/fs.h:2020 [inline]
      new_sync_write fs/read_write.c:491 [inline]
      vfs_write+0x8ef/0x1490 fs/read_write.c:584
      ksys_write+0x20f/0x4c0 fs/read_write.c:637
      __do_sys_write fs/read_write.c:649 [inline]
      __se_sys_write fs/read_write.c:646 [inline]
      __x64_sys_write+0x93/0xd0 fs/read_write.c:646
      do_syscall_x64 arch/x86/entry/common.c:52 [inline]
      do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x63/0x6b
    
    Local variable mp_opt created at:
      subflow_check_req+0x6d/0x15d0 net/mptcp/subflow.c:145
      subflow_v6_route_req+0x269/0x410 net/mptcp/subflow.c:367
    
    CPU: 1 PID: 5924 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00055-g5eff55d725a4 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
    
    Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests")
    Reported-by: syzbot <syzkaller@xxxxxxxxxxxxxxxx>
    Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Cc: Florian Westphal <fw@xxxxxxxxx>
    Cc: Peter Krystad <peter.krystad@xxxxxxxxxxxxxxx>
    Cc: Matthieu Baerts <matttbe@xxxxxxxxxx>
    Cc: Mat Martineau <martineau@xxxxxxxxxx>
    Cc: Geliang Tang <geliang.tang@xxxxxxxxx>
    Reviewed-by: Simon Horman <horms@xxxxxxxxxx>
    Acked-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Reviewed-by: Mat Martineau <martineau@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240111194917.4044654-5-edumazet@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 297d2465c413..099bdfc12da9 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -155,7 +155,7 @@ static int subflow_check_req(struct request_sock *req,
 	mptcp_get_options(skb, &mp_opt);
 
 	opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC);
-	opt_mp_join = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ);
+	opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYN);
 	if (opt_mp_capable) {
 		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEPASSIVE);
 
@@ -252,7 +252,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req,
 	mptcp_get_options(skb, &mp_opt);
 
 	opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC);
-	opt_mp_join = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ);
+	opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK);
 	if (opt_mp_capable && opt_mp_join)
 		return -EINVAL;
 




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux