Kuniyuki Iwashima 744e3773a7 sctp: Fix null-ptr-deref in reuseport_add_sock(). ... [ Upstream commit 9ab0faa7f9ffe31296dbb9bbe6f76c72c14eea18 ] syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb in reuseport_add_sock(). [0] The repro first creates a listener with SO_REUSEPORT. Then, it creates another listener on the same port and concurrently closes the first listener. The second listen() calls reuseport_add_sock() with the first listener as sk2, where sk2->sk_reuseport_cb is not expected to be cleared concurrently, but the close() does clear it by reuseport_detach_sock(). The problem is SCTP does not properly synchronise reuseport_alloc(), reuseport_add_sock(), and reuseport_detach_sock(). The caller of reuseport_alloc() and reuseport_{add,detach}_sock() must provide synchronisation for sockets that are classified into the same reuseport group. Otherwise, such sockets form multiple identical reuseport groups, and all groups except one would be silently dead. 1. Two sockets call listen() concurrently 2. No socket in the same group found in sctp_ep_hashtable[] 3. Two sockets call reuseport_alloc() and form two reuseport groups 4. Only one group hit first in __sctp_rcv_lookup_endpoint() receives incoming packets Also, the reported null-ptr-deref could occur. TCP/UDP guarantees that would not happen by holding the hash bucket lock. Let's apply the locking strategy to __sctp_hash_endpoint() and __sctp_unhash_endpoint(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 10230 Comm: syz-executor119 Not tainted 6.10.0-syzkaller-12585-g301927d2d2eb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:reuseport_add_sock+0x27e/0x5e0 net/core/sock_reuseport.c:350 Code: 00 0f b7 5d 00 bf 01 00 00 00 89 de e8 1b a4 ff f7 83 fb 01 0f 85 a3 01 00 00 e8 6d a0 ff f7 49 8d 7e 12 48 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 4b 02 00 00 41 0f b7 5e 12 49 8d 7e 14 RSP: 0018:ffffc9000b947c98 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff8880252ddf98 RCX: ffff888079478000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000012 RBP: 0000000000000001 R08: ffffffff8993e18d R09: 1ffffffff1fef385 R10: dffffc0000000000 R11: fffffbfff1fef386 R12: ffff8880252ddac0 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f24e45b96c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffcced5f7b8 CR3: 00000000241be000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __sctp_hash_endpoint net/sctp/input.c:762 [inline] sctp_hash_endpoint+0x52a/0x600 net/sctp/input.c:790 sctp_listen_start net/sctp/socket.c:8570 [inline] sctp_inet_listen+0x767/0xa20 net/sctp/socket.c:8625 __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline] __se_sys_listen net/socket.c:1900 [inline] __x64_sys_listen+0x5a/0x70 net/socket.c:1900 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f24e46039b9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f24e45b9228 EFLAGS: 00000246 ORIG_RAX: 0000000000000032 RAX: ffffffffffffffda RBX: 00007f24e468e428 RCX: 00007f24e46039b9 RDX: 00007f24e46039b9 RSI: 0000000000000003 RDI: 0000000000000004 RBP: 00007f24e468e420 R08: 00007f24e45b96c0 R09: 00007f24e45b96c0 R10: 00007f24e45b96c0 R11: 0000000000000246 R12: 00007f24e468e42c R13: 00007f24e465a5dc R14: 0020000000000001 R15: 00007ffcced5f7d8 </TASK> Modules linked in: Fixes: 6ba845740267 ("sctp: process sk_reuseport in sctp_get_port_local") Reported-by: syzbot+e6979a5d2f10ecb700e4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e6979a5d2f10ecb700e4 Tested-by: syzbot+e6979a5d2f10ecb700e4@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Acked-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/20240731234624.94055-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-11-23 23:20:22 +01:00
..
6lowpan
9p	net/9p: fix uninit-value in p9_client_rpc()	2024-11-19 12:27:18 +01:00
802
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-11-18 12:13:00 +01:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2024-11-18 12:11:49 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2024-11-18 12:11:49 +01:00
ax25
batman-adv	batman-adv: fix random jitter calculation	2024-11-19 17:55:48 +01:00
bluetooth	Bluetooth: hci_core: cancel all works upon hci_unregister_dev()	2024-11-19 14:19:50 +01:00
bpf
bpfilter
bridge	net: bridge: fix multicast-to-unicast with fraglist GSO	2024-11-19 11:32:43 +01:00
caif
can	net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new	2024-11-19 14:19:34 +01:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-11-19 14:19:45 +01:00
core	bpf: Fix a segment issue when downgrading gso_size	2024-11-23 23:20:17 +01:00
dcb
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2024-11-18 11:43:07 +01:00
decnet
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-11-18 12:12:43 +01:00
dsa
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-11-19 11:32:39 +01:00
ethtool	ethtool: netlink: do not return SQI value if link is down	2024-11-19 14:19:43 +01:00
hsr	hsr: Handle failures in module init	2024-11-19 08:44:59 +01:00
ieee802154
ife	net: sched: ife: fix potential use-after-free	2024-11-18 12:11:59 +01:00
ipv4	net: nexthop: Initialize all fields in dumped nexthops	2024-11-23 23:20:17 +01:00
ipv6	ipv6: fix ndisc_is_useropt() handling for PIO	2024-11-23 23:20:20 +01:00
iucv	net/iucv: fix use after free in iucv_sock_close()	2024-11-23 23:20:20 +01:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-11-19 08:44:50 +01:00
key
l2tp	net l2tp: drop flow hash on forward	2024-11-19 11:32:42 +01:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-11-18 12:13:22 +01:00
mac80211	wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()	2024-11-19 14:19:47 +01:00
mac802154	Revert "net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()"	2024-11-19 14:52:14 +01:00
mpls
mptcp	mptcp: fix duplicate data handling	2024-11-23 23:20:21 +01:00
ncm
ncsi	net/ncsi: Fix the multi thread manner of NCSI driver	2024-11-19 14:19:00 +01:00
netfilter	netfilter: ipset: Add list flush to cancel_gc	2024-11-23 23:20:21 +01:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-11-18 12:12:25 +01:00
netlink	netlink: annotate lockless accesses to nlk->max_recvmsg_len	2024-11-19 12:26:38 +01:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-11-19 14:19:08 +01:00
nfc	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()	2024-11-19 12:27:10 +01:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-11-19 11:32:42 +01:00
openvswitch	openvswitch: Set the skbuff pkt_type for proper pmtud support.	2024-11-19 12:27:09 +01:00
packet	af_packet: Handle outgoing VLAN packets without hardware offloading	2024-11-23 23:20:12 +01:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-11-19 11:32:46 +01:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2024-11-18 12:11:46 +01:00
qrtr
rds	net/rds: fix possible cp null dereference	2024-11-19 09:22:45 +01:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-11-18 12:12:01 +01:00
rose	net/rose: fix races in rose_kill_by_device()	2024-11-18 12:11:59 +01:00
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-11-18 12:13:25 +01:00
sched	sched: act_ct: take care of padding in struct zones_ht_key	2024-11-23 23:20:20 +01:00
sctp	sctp: Fix null-ptr-deref in reuseport_add_sock().	2024-11-23 23:20:22 +01:00
skb_tracer
smc	net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined	2024-11-23 23:20:06 +01:00
strparser
sunrpc	SUNRPC: avoid soft lockup when transmitting UDP to reachable server.	2024-11-23 23:20:09 +01:00
switchdev
tipc	tipc: Return non-zero value from tipc_udp_addr2str() on error	2024-11-23 23:20:17 +01:00
tls	tls: fix missing memory barrier in tls_init	2024-11-19 12:27:09 +01:00
unix	af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().	2024-11-19 14:19:01 +01:00
vmw_vsock	virtio/vsock: fix logic which reduces credit update messages	2024-11-18 12:12:37 +01:00
wimax
wireless	wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()	2024-11-23 23:20:07 +01:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-11-19 08:44:50 +01:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-11-19 11:32:19 +01:00
xfrm	net: fix __dst_negative_advice() race	2024-11-19 12:27:19 +01:00
compat.c
devres.c
Kconfig
Makefile
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-11-18 12:12:07 +01:00
sysctl_net.c
TEST_MAPPING