queue-4.14/esp-skip-tx-bytes-accounting-when-sending-from-a-req.patch

   1 From 97cdc3fd1633623a9a3f2a68839ed3b0d4be8aaa Mon Sep 17 00:00:00 2001
   2 From: Martin Willi <martin@strongswan.org>
   3 Date: Mon, 28 Jan 2019 09:35:35 +0100
   4 Subject: esp: Skip TX bytes accounting when sending from a request socket
   5
   6 [ Upstream commit 09db51241118aeb06e1c8cd393b45879ce099b36 ]
   7
   8 On ESP output, sk_wmem_alloc is incremented for the added padding if a
   9 socket is associated to the skb. When replying with TCP SYNACKs over
  10 IPsec, the associated sk is a casted request socket, only. Increasing
  11 sk_wmem_alloc on a request socket results in a write at an arbitrary
  12 struct offset. In the best case, this produces the following WARNING:
  13
  14 WARNING: CPU: 1 PID: 0 at lib/refcount.c:102 esp_output_head+0x2e4/0x308 [esp4]
  15 refcount_t: addition on 0; use-after-free.
  16 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc3 #2
  17 Hardware name: Marvell Armada 380/385 (Device Tree)
  18 [...]
  19 [<bf0ff354>] (esp_output_head [esp4]) from [<bf1006a4>] (esp_output+0xb8/0x180 [esp4])
  20 [<bf1006a4>] (esp_output [esp4]) from [<c05dee64>] (xfrm_output_resume+0x558/0x664)
  21 [<c05dee64>] (xfrm_output_resume) from [<c05d07b0>] (xfrm4_output+0x44/0xc4)
  22 [<c05d07b0>] (xfrm4_output) from [<c05956bc>] (tcp_v4_send_synack+0xa8/0xe8)
  23 [<c05956bc>] (tcp_v4_send_synack) from [<c0586ad8>] (tcp_conn_request+0x7f4/0x948)
  24 [<c0586ad8>] (tcp_conn_request) from [<c058c404>] (tcp_rcv_state_process+0x2a0/0xe64)
  25 [<c058c404>] (tcp_rcv_state_process) from [<c05958ac>] (tcp_v4_do_rcv+0xf0/0x1f4)
  26 [<c05958ac>] (tcp_v4_do_rcv) from [<c0598a4c>] (tcp_v4_rcv+0xdb8/0xe20)
  27 [<c0598a4c>] (tcp_v4_rcv) from [<c056eb74>] (ip_protocol_deliver_rcu+0x2c/0x2dc)
  28 [<c056eb74>] (ip_protocol_deliver_rcu) from [<c056ee6c>] (ip_local_deliver_finish+0x48/0x54)
  29 [<c056ee6c>] (ip_local_deliver_finish) from [<c056eecc>] (ip_local_deliver+0x54/0xec)
  30 [<c056eecc>] (ip_local_deliver) from [<c056efac>] (ip_rcv+0x48/0xb8)
  31 [<c056efac>] (ip_rcv) from [<c0519c2c>] (__netif_receive_skb_one_core+0x50/0x6c)
  32 [...]
  33
  34 The issue triggers only when not using TCP syncookies, as for syncookies
  35 no socket is associated.
  36
  37 Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
  38 Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
  39 Signed-off-by: Martin Willi <martin@strongswan.org>
  40 Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
  41 Signed-off-by: Sasha Levin <sashal@kernel.org>
  42 ---
  43  net/ipv4/esp4.c | 2 +-
  44  net/ipv6/esp6.c | 2 +-
  45  2 files changed, 2 insertions(+), 2 deletions(-)
  46
  47 diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
  48 index b00e4a43b4dc..d30285c5d52d 100644
  49 --- a/net/ipv4/esp4.c
  50 +++ b/net/ipv4/esp4.c
  51 @@ -307,7 +307,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
  52                         skb->len += tailen;
  53                         skb->data_len += tailen;
  54                         skb->truesize += tailen;
  55 -                       if (sk)
  56 +                       if (sk && sk_fullsock(sk))
  57                                 refcount_add(tailen, &sk->sk_wmem_alloc);
  58
  59                         goto out;
  60 diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
  61 index f112fef79216..ef7822fad0fd 100644
  62 --- a/net/ipv6/esp6.c
  63 +++ b/net/ipv6/esp6.c
  64 @@ -275,7 +275,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
  65                         skb->len += tailen;
  66                         skb->data_len += tailen;
  67                         skb->truesize += tailen;
  68 -                       if (sk)
  69 +                       if (sk && sk_fullsock(sk))
  70                                 refcount_add(tailen, &sk->sk_wmem_alloc);
  71
  72                         goto out;
  73 --
  74 2.19.1
  75