]>
Commit | Line | Data |
---|---|---|
1 | From 97cdc3fd1633623a9a3f2a68839ed3b0d4be8aaa Mon Sep 17 00:00:00 2001 | |
2 | From: Martin Willi <martin@strongswan.org> | |
3 | Date: Mon, 28 Jan 2019 09:35:35 +0100 | |
4 | Subject: esp: Skip TX bytes accounting when sending from a request socket | |
5 | ||
6 | [ Upstream commit 09db51241118aeb06e1c8cd393b45879ce099b36 ] | |
7 | ||
8 | On ESP output, sk_wmem_alloc is incremented for the added padding if a | |
9 | socket is associated to the skb. When replying with TCP SYNACKs over | |
10 | IPsec, the associated sk is a casted request socket, only. Increasing | |
11 | sk_wmem_alloc on a request socket results in a write at an arbitrary | |
12 | struct offset. In the best case, this produces the following WARNING: | |
13 | ||
14 | WARNING: CPU: 1 PID: 0 at lib/refcount.c:102 esp_output_head+0x2e4/0x308 [esp4] | |
15 | refcount_t: addition on 0; use-after-free. | |
16 | CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc3 #2 | |
17 | Hardware name: Marvell Armada 380/385 (Device Tree) | |
18 | [...] | |
19 | [<bf0ff354>] (esp_output_head [esp4]) from [<bf1006a4>] (esp_output+0xb8/0x180 [esp4]) | |
20 | [<bf1006a4>] (esp_output [esp4]) from [<c05dee64>] (xfrm_output_resume+0x558/0x664) | |
21 | [<c05dee64>] (xfrm_output_resume) from [<c05d07b0>] (xfrm4_output+0x44/0xc4) | |
22 | [<c05d07b0>] (xfrm4_output) from [<c05956bc>] (tcp_v4_send_synack+0xa8/0xe8) | |
23 | [<c05956bc>] (tcp_v4_send_synack) from [<c0586ad8>] (tcp_conn_request+0x7f4/0x948) | |
24 | [<c0586ad8>] (tcp_conn_request) from [<c058c404>] (tcp_rcv_state_process+0x2a0/0xe64) | |
25 | [<c058c404>] (tcp_rcv_state_process) from [<c05958ac>] (tcp_v4_do_rcv+0xf0/0x1f4) | |
26 | [<c05958ac>] (tcp_v4_do_rcv) from [<c0598a4c>] (tcp_v4_rcv+0xdb8/0xe20) | |
27 | [<c0598a4c>] (tcp_v4_rcv) from [<c056eb74>] (ip_protocol_deliver_rcu+0x2c/0x2dc) | |
28 | [<c056eb74>] (ip_protocol_deliver_rcu) from [<c056ee6c>] (ip_local_deliver_finish+0x48/0x54) | |
29 | [<c056ee6c>] (ip_local_deliver_finish) from [<c056eecc>] (ip_local_deliver+0x54/0xec) | |
30 | [<c056eecc>] (ip_local_deliver) from [<c056efac>] (ip_rcv+0x48/0xb8) | |
31 | [<c056efac>] (ip_rcv) from [<c0519c2c>] (__netif_receive_skb_one_core+0x50/0x6c) | |
32 | [...] | |
33 | ||
34 | The issue triggers only when not using TCP syncookies, as for syncookies | |
35 | no socket is associated. | |
36 | ||
37 | Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") | |
38 | Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") | |
39 | Signed-off-by: Martin Willi <martin@strongswan.org> | |
40 | Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> | |
41 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
42 | --- | |
43 | net/ipv4/esp4.c | 2 +- | |
44 | net/ipv6/esp6.c | 2 +- | |
45 | 2 files changed, 2 insertions(+), 2 deletions(-) | |
46 | ||
47 | diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c | |
48 | index b00e4a43b4dc..d30285c5d52d 100644 | |
49 | --- a/net/ipv4/esp4.c | |
50 | +++ b/net/ipv4/esp4.c | |
51 | @@ -307,7 +307,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * | |
52 | skb->len += tailen; | |
53 | skb->data_len += tailen; | |
54 | skb->truesize += tailen; | |
55 | - if (sk) | |
56 | + if (sk && sk_fullsock(sk)) | |
57 | refcount_add(tailen, &sk->sk_wmem_alloc); | |
58 | ||
59 | goto out; | |
60 | diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c | |
61 | index f112fef79216..ef7822fad0fd 100644 | |
62 | --- a/net/ipv6/esp6.c | |
63 | +++ b/net/ipv6/esp6.c | |
64 | @@ -275,7 +275,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info | |
65 | skb->len += tailen; | |
66 | skb->data_len += tailen; | |
67 | skb->truesize += tailen; | |
68 | - if (sk) | |
69 | + if (sk && sk_fullsock(sk)) | |
70 | refcount_add(tailen, &sk->sk_wmem_alloc); | |
71 | ||
72 | goto out; | |
73 | -- | |
74 | 2.19.1 | |
75 |