Eric Dumazet 9f29f6f8da tcp: make sure treq->af_specific is initialized ... [ Upstream commit ba5a4fdd63ae0c575707030db0b634b160baddd7 ] syzbot complained about a recent change in TCP stack, hitting a NULL pointer [1] tcp request sockets have an af_specific pointer, which was used before the blamed change only for SYNACK generation in non SYNCOOKIE mode. tcp requests sockets momentarily created when third packet coming from client in SYNCOOKIE mode were not using treq->af_specific. Make sure this field is populated, in the same way normal TCP requests sockets do in tcp_conn_request(). [1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 3695 Comm: syz-executor864 Not tainted 5.18.0-rc3-syzkaller-00224-g5fd1fe4807f9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:tcp_create_openreq_child+0xe16/0x16b0 net/ipv4/tcp_minisocks.c:534 Code: 48 c1 ea 03 80 3c 02 00 0f 85 e5 07 00 00 4c 8b b3 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 07 00 00 48 8b 3c 24 48 89 de 41 ff 56 08 48 RSP: 0018:ffffc90000de0588 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888076490330 RCX: 0000000000000100 RDX: 0000000000000001 RSI: ffffffff87d67ff0 RDI: 0000000000000008 RBP: ffff88806ee1c7f8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff87d67f00 R11: 0000000000000000 R12: ffff88806ee1bfc0 R13: ffff88801b0e0368 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f517fe58700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffcead76960 CR3: 000000006f97b000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> tcp_v6_syn_recv_sock+0x199/0x23b0 net/ipv6/tcp_ipv6.c:1267 tcp_get_cookie_sock+0xc9/0x850 net/ipv4/syncookies.c:207 cookie_v6_check+0x15c3/0x2340 net/ipv6/syncookies.c:258 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1131 [inline] tcp_v6_do_rcv+0x1148/0x13b0 net/ipv6/tcp_ipv6.c:1486 tcp_v6_rcv+0x3305/0x3840 net/ipv6/tcp_ipv6.c:1725 ip6_protocol_deliver_rcu+0x2e9/0x1900 net/ipv6/ip6_input.c:422 ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:464 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:473 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x27f/0x3b0 net/ipv6/ip6_input.c:297 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 process_backlog+0x3a0/0x7c0 net/core/dev.c:5847 __napi_poll+0xb3/0x6e0 net/core/dev.c:6413 napi_poll net/core/dev.c:6480 [inline] net_rx_action+0x8ec/0xc60 net/core/dev.c:6567 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 Fixes: 5b0b9e4c2c89 ("tcp: md5: incorrect tcp_header_len for incoming connections") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Francesco Ruggeri <fruggeri@arista.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-05-09 09:05:04 +02:00
..
9p	net: 9p: drop duplicate word in comment	2020-07-15 20:34:11 -07:00
bluetooth	Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg}	2022-04-13 21:00:59 +02:00
caif	net: caif: add proper error handling	2021-06-10 13:39:24 +02:00
iucv
netfilter	netfilter: nf_queue: fix possible use-after-free	2022-03-08 19:09:33 +01:00
netns	ipv6: make ip6_rt_gc_expire an atomic_t	2022-04-27 13:53:51 +02:00
nfc	NFC: add NCI_UNREG flag to eliminate the race	2021-11-26 10:39:18 +01:00
phonet
sctp	sctp: use call_rcu to free endpoint	2022-01-05 12:40:30 +01:00
tc_act	net/sched: act_vlan: Fix modify to allow 0	2021-07-14 16:56:19 +02:00
6lowpan.h
act_api.h	net: sched: fix err handler in tcf_action_init()	2021-04-14 08:42:05 +02:00
addrconf.h	Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values"	2022-02-01 17:25:47 +01:00
af_ieee802154.h
af_rxrpc.h	rxrpc: Make rxrpc_kernel_get_srtt() indicate validity	2020-08-20 18:21:28 +01:00
af_unix.h
af_vsock.h	vsock: each transport cycles only on its own sockets	2022-03-23 09:13:27 +01:00
ah.h
arp.h	ipv4: Invalidate neighbour for broadcast address upon address addition	2022-04-13 21:00:57 +02:00
atmclip.h
ax25.h	ax25: fix reference count leaks of ax25_dev	2022-04-20 09:23:31 +02:00
ax88796.h
bareudp.h	bareudp: Reverted support to enable & disable rx metadata collection	2020-07-21 18:30:47 -07:00
bond_3ad.h	bonding: fix data-races around agg_select_timer	2022-02-23 12:01:02 +01:00
bond_alb.h	bonding: make tx_rebalance_counter an atomic	2021-12-14 11:32:36 +01:00
bond_options.h
bonding.h	bonding: Add struct bond_ipesc to manage SA	2021-07-28 14:35:33 +02:00
bpf_sk_storage.h	bpf: Change bpf_sk_storage_*() to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON	2020-09-25 13:58:01 -07:00
busy_poll.h	net: annotate data race around sk_ll_usec	2021-07-31 08:16:11 +02:00
calipso.h
cfg80211-wext.h
cfg80211.h	cfg80211: fix management registrations locking	2021-11-02 19:48:20 +01:00
cfg802154.h
checksum.h	net: Force inlining of checksum functions in net/checksum.h	2022-03-02 11:42:50 +01:00
cipso_ipv4.h	cipso: Remove unused inline functions	2020-07-15 07:45:24 -07:00
cls_cgroup.h
codel_impl.h
codel_qdisc.h
codel.h
compat.h	net: simplify cBPF setsockopt compat handling	2020-07-19 18:16:40 -07:00
datalink.h
dcbevent.h
dcbnl.h
devlink.h	devlink: Add enable_remote_dev_reset generic parameter	2020-10-09 12:06:53 -07:00
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h
dsa.h	net: dsa: propagate switchdev vlan_filtering prepare phase to drivers	2020-10-05 05:56:48 -07:00
dsfield.h
dst_cache.h	wireguard: device: reset peer src endpoint when netns exits	2021-12-08 09:03:22 +01:00
dst_metadata.h	net: fix a memleak when uncloning an skb dst and its metadata	2022-02-16 12:54:26 +01:00
dst_ops.h
dst.h	net: Consolidate common blackhole dst ops	2021-03-30 14:32:05 +02:00
erspan.h
esp.h	esp: limit skb_page_frag_refill use to a single page	2022-04-27 13:53:48 +02:00
espintcp.h
ethoc.h
failover.h
fib_notifier.h
fib_rules.h	ipv6: fix memory leak in fib6_rule_suppress	2021-12-08 09:03:21 +01:00
firewire.h
flow_dissector.h	net/sched: flower: fix parsing of ethertype following VLAN header	2022-04-20 09:23:11 +02:00
flow_offload.h	net: Fix offloading indirect devices dependency on qdisc order creation	2021-09-18 13:40:30 +02:00
flow.h	ipv4: Initialize flowi4_multipath_hash in data path	2020-09-14 14:54:56 -07:00
fou.h
fq_impl.h	net/fq_impl: use skb_get_hash instead of skb_get_hash_perturb	2020-07-31 09:24:24 +02:00
fq.h	net/fq_impl: use skb_get_hash instead of skb_get_hash_perturb	2020-07-31 09:24:24 +02:00
garp.h
gen_stats.h
genetlink.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-05 18:40:01 -07:00
geneve.h
gre.h
gro_cells.h
gtp.h
gue.h
hwbm.h
icmp.h	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-03-04 11:38:46 +01:00
ieee80211_radiotap.h	mac80211: add radiotap flag to prevent sequence number overwrite	2020-07-31 09:27:00 +02:00
ieee802154_netdev.h
if_inet6.h
ife.h
ila.h
inet_common.h
inet_connection_sock.h	tcp: switch orphan_count to bare per-cpu counters	2021-11-18 14:04:08 +01:00
inet_ecn.h	inet_ecn: Fix endianness of checksum update when setting ECT(1)	2020-12-01 17:16:54 -08:00
inet_frag.h	inet: frags: annotate races around fqdir->dead and fqdir->high_thresh	2022-01-27 10:54:33 +01:00
inet_hashtables.h	tcp: fix race condition when creating child sockets from syncookies	2020-11-23 16:32:33 -08:00
inet_sock.h	inet: remove inet_sk_copy_descendant()	2020-08-26 07:33:19 -07:00
inet_timewait_sock.h
inet6_connection_sock.h
inet6_hashtables.h
inetpeer.h
ip_fib.h	ipv4: convert fib_num_tclassid_users to atomic_t	2021-12-08 09:03:26 +01:00
ip_tunnels.h	ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode	2022-05-09 09:05:04 +02:00
ip_vs.h	ipvs: remove dependency on ip6_tables	2020-08-31 23:06:51 +02:00
ip.h	ipv4: avoid using shared IP generator for connected sockets	2022-02-01 17:25:44 +01:00
ip6_checksum.h
ip6_fib.h	ipv6: annotate accesses to fn->fn_sernum	2022-02-01 17:25:44 +01:00
ip6_route.h	net: ipv6: fix returned variable type in ip6_skb_dst_mtu	2021-08-12 13:22:07 +02:00
ip6_tunnel.h	ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode	2022-05-09 09:05:04 +02:00
ipcomp.h
ipconfig.h
ipv6_frag.h	inet: frags: annotate races around fqdir->dead and fqdir->high_thresh	2022-01-27 10:54:33 +01:00
ipv6_stubs.h	net: ipv6: add fib6_nh_release_dsts stub	2021-12-01 09:19:05 +01:00
ipv6.h	ipv6: per-netns exclusive flowlabel checks	2022-02-23 12:01:01 +01:00
ipx.h
iw_handler.h
kcm.h
l3mdev.h
lag.h
lapb.h
lib80211.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h	net: llc: fix skb_over_panic	2021-08-04 12:46:43 +02:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h	llc: fix out-of-bound array index in llc_sk_dev_hash()	2021-11-18 14:04:27 +01:00
lwtunnel.h
mac80211.h	mac80211: Fix NULL ptr deref for injected rate info	2021-06-23 14:42:52 +02:00
mac802154.h
macsec.h	net: macsec: fix the length used to copy the key for offloading	2021-07-14 16:56:28 +02:00
mip6.h
mld.h
mpls_iptunnel.h
mpls.h
mptcp.h	net: tcp: drop unused function argument from mptcp_incoming_options	2020-09-24 20:17:01 -07:00
mrp.h
ncsi.h
ndisc.h	ipv6: ndisc: adjust ndisc_ifinfo_sysctl_change prototype	2020-08-24 06:40:07 -07:00
neighbour.h	net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE	2021-11-18 14:04:29 +01:00
net_failover.h
net_namespace.h	net: make get_net_ns return error if NET_NS is disabled	2021-06-23 14:42:44 +02:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h	netlink: export policy in extended ACK	2020-10-09 20:22:32 -07:00
netprio_cgroup.h
netrom.h
nexthop.h	net: ipv4: Fix rtnexthop len when RTA_FLOW is present	2021-10-06 15:55:53 +02:00
nl802154.h	net: ieee802154: handle iftypes as u32	2021-12-01 09:19:03 +01:00
nsh.h
p8022.h
page_pool.h	mm: fix struct page layout on 32-bit systems	2021-05-19 10:13:17 +02:00
pie.h
ping.h
pkt_cls.h	net: zero-initialize tc skb extension on allocation	2021-06-03 09:00:51 +02:00
pkt_sched.h	net: prevent user from passing illegal stab size	2021-10-17 10:43:33 +02:00
pptp.h
protocol.h
psample.h	psample: Add a fwd declaration for skbuff	2021-08-18 08:59:11 +02:00
psnap.h
raw.h
rawv6.h
red.h	sch_red: fix off-by-one checks in red_check_params()	2021-04-14 08:42:07 +02:00
regulatory.h	net/wireless: regulatory.h: drop duplicate word in comment	2020-07-31 09:24:23 +02:00
request_sock.h	tcp: bpf: Optionally store mac header in TCP_SAVE_SYN	2020-08-24 14:35:00 -07:00
rose.h
route.h	ipv4: remove sparse error in ip_neigh_gw4()	2022-02-01 17:25:48 +01:00
rpl.h
rsi_91x.h
rtnetlink.h	can: dev: Move device back to init netns on owning netns delete	2021-03-30 14:32:08 +02:00
rtnh.h
sch_generic.h	net_sched: restore "mpu xxx" handling	2022-01-27 10:54:35 +01:00
scm.h
secure_seq.h
seg6_hmac.h
seg6_local.h
seg6.h
slhc_vj.h
smc.h	net/smc: introduce CHID callback for ISM devices	2020-09-28 15:19:03 -07:00
snmp.h
sock_reuseport.h
sock.h	esp: Fix possible buffer overflow in ESP transformation	2022-03-23 09:13:29 +01:00
Space.h
stp.h
strparser.h	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 14:04:27 +01:00
switchdev.h	switchdev: mrp: Remove SWITCHDEV_ATTR_ID_MRP_PORT_STAT	2021-02-17 11:02:29 +01:00
tcp_states.h
tcp.h	tcp: make sure treq->af_specific is initialized	2022-05-09 09:05:04 +02:00
timewait_sock.h
tipc.h
tls_toe.h
tls.h	net/tls: Fix flipped sign in tls_err_abort() calls	2021-11-02 19:48:19 +01:00
transp_v6.h
tso.h
tun_proto.h
udp_tunnel.h	udp: call udp_encap_enable for v6 sockets when enabling encap	2022-04-08 14:39:54 +02:00
udp.h	udp: call udp_encap_enable for v6 sockets when enabling encap	2022-04-08 14:39:54 +02:00
udplite.h
vsock_addr.h
vxlan.h	net: sched: only keep the available bits when setting vxlan md->gbp	2020-09-14 16:49:39 -07:00
wext.h
wimax.h	net: wimax: fix duplicate words in comments	2020-07-15 20:34:02 -07:00
x25.h
x25device.h
xdp_priv.h
xdp_sock_drv.h	xsk: i40e: ice: ixgbe: mlx5: Test for dma_need_sync earlier for better performance	2020-08-31 21:15:04 +02:00
xdp_sock.h	xsk: Fix race in SKB mode transmit with shared cq	2021-01-17 14:17:05 +01:00
xdp.h	xdp: Remove the xdp_attachment_flags_ok() callback	2020-12-09 16:27:42 +01:00
xfrm.h	xfrm: Check if_id in xfrm_migrate	2022-03-19 13:44:43 +01:00
xsk_buff_pool.h	xsk: Fix missing validation for skb and unaligned mode	2021-07-14 16:56:23 +02:00