releases/4.14.32/tcp-reset-sk_send_head-in-tcp_write_queue_purge.patch

   1 From foo@baz Wed Mar 28 18:38:30 CEST 2018
   2 From: Soheil Hassas Yeganeh <soheil@google.com>
   3 Date: Thu, 15 Mar 2018 12:09:13 -0400
   4 Subject: tcp: reset sk_send_head in tcp_write_queue_purge
   5
   6 From: Soheil Hassas Yeganeh <soheil@google.com>
   7
   8
   9 tcp_write_queue_purge clears all the SKBs in the write queue
  10 but does not reset the sk_send_head. As a result, we can have
  11 a NULL pointer dereference anywhere that we use tcp_send_head
  12 instead of the tcp_write_queue_tail.
  13
  14 For example, after a27fd7a8ed38 (tcp: purge write queue upon RST),
  15 we can purge the write queue on RST. Prior to
  16 75c119afe14f (tcp: implement rb-tree based retransmit queue),
  17 tcp_push will only check tcp_send_head and then accesses
  18 tcp_write_queue_tail to send the actual SKB. As a result, it will
  19 dereference a NULL pointer.
  20
  21 This has been reported twice for 4.14 where we don't have
  22 75c119afe14f:
  23
  24 By Timofey Titovets:
  25
  26 [  422.081094] BUG: unable to handle kernel NULL pointer dereference
  27 at 0000000000000038
  28 [  422.081254] IP: tcp_push+0x42/0x110
  29 [  422.081314] PGD 0 P4D 0
  30 [  422.081364] Oops: 0002 [#1] SMP PTI
  31
  32 By Yongjian Xu:
  33
  34 BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
  35 IP: tcp_push+0x48/0x120
  36 PGD 80000007ff77b067 P4D 80000007ff77b067 PUD 7fd989067 PMD 0
  37 Oops: 0002 [#18] SMP PTI
  38 Modules linked in: tcp_diag inet_diag tcp_bbr sch_fq iTCO_wdt
  39 iTCO_vendor_support pcspkr ixgbe mdio i2c_i801 lpc_ich joydev input_leds shpchp
  40 e1000e igb dca ptp pps_core hwmon mei_me mei ipmi_si ipmi_msghandler sg ses
  41 scsi_transport_sas enclosure ext4 jbd2 mbcache sd_mod ahci libahci megaraid_sas
  42 wmi ast ttm dm_mirror dm_region_hash dm_log dm_mod dax
  43 CPU: 6 PID: 14156 Comm: [ET_NET 6] Tainted: G D 4.14.26-1.el6.x86_64 #1
  44 Hardware name: LENOVO ThinkServer RD440 /ThinkServer RD440, BIOS A0TS80A
  45 09/22/2014
  46 task: ffff8807d78d8140 task.stack: ffffc9000e944000
  47 RIP: 0010:tcp_push+0x48/0x120
  48 RSP: 0018:ffffc9000e947a88 EFLAGS: 00010246
  49 RAX: 00000000000005b4 RBX: ffff880f7cce9c00 RCX: 0000000000000000
  50 RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff8807d00f5000
  51 RBP: ffffc9000e947aa8 R08: 0000000000001c84 R09: 0000000000000000
  52 R10: ffff8807d00f5158 R11: 0000000000000000 R12: ffff8807d00f5000
  53 R13: 0000000000000020 R14: 00000000000256d4 R15: 0000000000000000
  54 FS: 00007f5916de9700(0000) GS:ffff88107fd00000(0000) knlGS:0000000000000000
  55 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  56 CR2: 0000000000000038 CR3: 00000007f8226004 CR4: 00000000001606e0
  57 Call Trace:
  58 tcp_sendmsg_locked+0x33d/0xe50
  59 tcp_sendmsg+0x37/0x60
  60 inet_sendmsg+0x39/0xc0
  61 sock_sendmsg+0x49/0x60
  62 sock_write_iter+0xb6/0x100
  63 do_iter_readv_writev+0xec/0x130
  64 ? rw_verify_area+0x49/0xb0
  65 do_iter_write+0x97/0xd0
  66 vfs_writev+0x7e/0xe0
  67 ? __wake_up_common_lock+0x80/0xa0
  68 ? __fget_light+0x2c/0x70
  69 ? __do_page_fault+0x1e7/0x530
  70 do_writev+0x60/0xf0
  71 ? inet_shutdown+0xac/0x110
  72 SyS_writev+0x10/0x20
  73 do_syscall_64+0x6f/0x140
  74 ? prepare_exit_to_usermode+0x8b/0xa0
  75 entry_SYSCALL_64_after_hwframe+0x3d/0xa2
  76 RIP: 0033:0x3135ce0c57
  77 RSP: 002b:00007f5916de4b00 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
  78 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000003135ce0c57
  79 RDX: 0000000000000002 RSI: 00007f5916de4b90 RDI: 000000000000606f
  80 RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f5916de8c38
  81 R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000464cc
  82 R13: 00007f5916de8c30 R14: 00007f58d8bef080 R15: 0000000000000002
  83 Code: 48 8b 97 60 01 00 00 4c 8d 97 58 01 00 00 41 b9 00 00 00 00 41 89 f3 4c 39
  84 d2 49 0f 44 d1 41 81 e3 00 80 00 00 0f 85 b0 00 00 00 <80> 4a 38 08 44 8b 8f 74
  85 06 00 00 44 89 8f 7c 06 00 00 83 e6 01
  86 RIP: tcp_push+0x48/0x120 RSP: ffffc9000e947a88
  87 CR2: 0000000000000038
  88 ---[ end trace 8d545c2e93515549 ]---
  89
  90 Fixes: a27fd7a8ed38 (tcp: purge write queue upon RST)
  91 Reported-by: Timofey Titovets <nefelim4ag@gmail.com>
  92 Reported-by: Yongjian Xu <yongjianchn@gmail.com>
  93 Signed-off-by: Eric Dumazet <edumazet@google.com>
  94 Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
  95 Tested-by: Yongjian Xu <yongjianchn@gmail.com>
  96
  97 Signed-off-by: David S. Miller <davem@davemloft.net>
  98 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  99 ---
 100  include/net/tcp.h |   11 ++++++-----
 101  1 file changed, 6 insertions(+), 5 deletions(-)
 102
 103 --- a/include/net/tcp.h
 104 +++ b/include/net/tcp.h
 105 @@ -1600,6 +1600,11 @@ enum tcp_chrono {
 106  void tcp_chrono_start(struct sock *sk, const enum tcp_chrono type);
 107  void tcp_chrono_stop(struct sock *sk, const enum tcp_chrono type);
 108
 109 +static inline void tcp_init_send_head(struct sock *sk)
 110 +{
 111 +       sk->sk_send_head = NULL;
 112 +}
 113 +
 114  /* write queue abstraction */
 115  static inline void tcp_write_queue_purge(struct sock *sk)
 116  {
 117 @@ -1610,6 +1615,7 @@ static inline void tcp_write_queue_purge
 118                 sk_wmem_free_skb(sk, skb);
 119         sk_mem_reclaim(sk);
 120         tcp_clear_all_retrans_hints(tcp_sk(sk));
 121 +       tcp_init_send_head(sk);
 122  }
 123
 124  static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk)
 125 @@ -1672,11 +1678,6 @@ static inline void tcp_check_send_head(s
 126                 tcp_sk(sk)->highest_sack = NULL;
 127  }
 128
 129 -static inline void tcp_init_send_head(struct sock *sk)
 130 -{
 131 -       sk->sk_send_head = NULL;
 132 -}
 133 -
 134  static inline void __tcp_add_write_queue_tail(struct sock *sk, struct sk_buff *skb)
 135  {
 136         __skb_queue_tail(&sk->sk_write_queue, skb);