Eric Dumazet eeea10b83a tcp: add tcp_v4_fill_cb()/tcp_v4_restore_cb() ... James Morris reported kernel stack corruption bug [1] while running the SELinux testsuite, and bisected to a recent commit bffa72cf7f ("net: sk_buff rbnode reorg") We believe this commit is fine, but exposes an older bug. SELinux code runs from tcp_filter() and might send an ICMP, expecting IP options to be found in skb->cb[] using regular IPCB placement. We need to defer TCP mangling of skb->cb[] after tcp_filter() calls. This patch adds tcp_v4_fill_cb()/tcp_v4_restore_cb() in a very similar way we added them for IPv6. [1] [ 339.806024] SELinux: failure in selinux_parse_skb(), unable to parse packet [ 339.822505] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81745af5 [ 339.822505] [ 339.852250] CPU: 4 PID: 3642 Comm: client Not tainted 4.15.0-rc1-test #15 [ 339.868498] Hardware name: LENOVO 10FGS0VA1L/30BC, BIOS FWKT68A 01/19/2017 [ 339.885060] Call Trace: [ 339.896875] <IRQ> [ 339.908103] dump_stack+0x63/0x87 [ 339.920645] panic+0xe8/0x248 [ 339.932668] ? ip_push_pending_frames+0x33/0x40 [ 339.946328] ? icmp_send+0x525/0x530 [ 339.958861] ? kfree_skbmem+0x60/0x70 [ 339.971431] __stack_chk_fail+0x1b/0x20 [ 339.984049] icmp_send+0x525/0x530 [ 339.996205] ? netlbl_skbuff_err+0x36/0x40 [ 340.008997] ? selinux_netlbl_err+0x11/0x20 [ 340.021816] ? selinux_socket_sock_rcv_skb+0x211/0x230 [ 340.035529] ? security_sock_rcv_skb+0x3b/0x50 [ 340.048471] ? sk_filter_trim_cap+0x44/0x1c0 [ 340.061246] ? tcp_v4_inbound_md5_hash+0x69/0x1b0 [ 340.074562] ? tcp_filter+0x2c/0x40 [ 340.086400] ? tcp_v4_rcv+0x820/0xa20 [ 340.098329] ? ip_local_deliver_finish+0x71/0x1a0 [ 340.111279] ? ip_local_deliver+0x6f/0xe0 [ 340.123535] ? ip_rcv_finish+0x3a0/0x3a0 [ 340.135523] ? ip_rcv_finish+0xdb/0x3a0 [ 340.147442] ? ip_rcv+0x27c/0x3c0 [ 340.158668] ? inet_del_offload+0x40/0x40 [ 340.170580] ? __netif_receive_skb_core+0x4ac/0x900 [ 340.183285] ? rcu_accelerate_cbs+0x5b/0x80 [ 340.195282] ? __netif_receive_skb+0x18/0x60 [ 340.207288] ? process_backlog+0x95/0x140 [ 340.218948] ? net_rx_action+0x26c/0x3b0 [ 340.230416] ? __do_softirq+0xc9/0x26a [ 340.241625] ? do_softirq_own_stack+0x2a/0x40 [ 340.253368] </IRQ> [ 340.262673] ? do_softirq+0x50/0x60 [ 340.273450] ? __local_bh_enable_ip+0x57/0x60 [ 340.285045] ? ip_finish_output2+0x175/0x350 [ 340.296403] ? ip_finish_output+0x127/0x1d0 [ 340.307665] ? nf_hook_slow+0x3c/0xb0 [ 340.318230] ? ip_output+0x72/0xe0 [ 340.328524] ? ip_fragment.constprop.54+0x80/0x80 [ 340.340070] ? ip_local_out+0x35/0x40 [ 340.350497] ? ip_queue_xmit+0x15c/0x3f0 [ 340.361060] ? __kmalloc_reserve.isra.40+0x31/0x90 [ 340.372484] ? __skb_clone+0x2e/0x130 [ 340.382633] ? tcp_transmit_skb+0x558/0xa10 [ 340.393262] ? tcp_connect+0x938/0xad0 [ 340.403370] ? ktime_get_with_offset+0x4c/0xb0 [ 340.414206] ? tcp_v4_connect+0x457/0x4e0 [ 340.424471] ? __inet_stream_connect+0xb3/0x300 [ 340.435195] ? inet_stream_connect+0x3b/0x60 [ 340.445607] ? SYSC_connect+0xd9/0x110 [ 340.455455] ? __audit_syscall_entry+0xaf/0x100 [ 340.466112] ? syscall_trace_enter+0x1d0/0x2b0 [ 340.476636] ? __audit_syscall_exit+0x209/0x290 [ 340.487151] ? SyS_connect+0xe/0x10 [ 340.496453] ? do_syscall_64+0x67/0x1b0 [ 340.506078] ? entry_SYSCALL64_slow_path+0x25/0x25 Fixes: 971f10eca1 ("tcp: better TCP_SKB_CB layout to reduce cache line misses") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: James Morris <james.l.morris@oracle.com> Tested-by: James Morris <james.l.morris@oracle.com> Tested-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-12-03 12:39:14 -05:00
..
6lowpan	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
9p	Merge branch '9p-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-11-22 20:17:54 -10:00
802	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-12 09:17:05 +09:00
appletalk	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
atm	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
ax25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
batman-adv	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
bluetooth	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
bpf	bpf: add meta pointer for direct access	2017-09-26 13:36:44 -07:00
bridge	net: bridge: add vlan_tunnel to bridge port policies	2017-11-14 21:54:55 +09:00
caif	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
can	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
ceph	We have a set of file locking improvements from Zheng, rbd rw/ro	2017-11-21 05:38:32 -10:00
core	Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-11-25 08:37:16 -10:00
dcb
dccp	tcp/dccp: block bh before arming time_wait timer	2017-12-01 15:07:43 -05:00
decnet	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
dns_resolver	KEYS: Fix race between updating and finding a negative key	2017-10-18 09:12:40 +01:00
dsa	net: dsa: fix 'increment on 0' warning	2017-11-26 04:23:10 +09:00
ethernet
hsr	net: hsr: Convert timers to use timer_setup()	2017-10-25 13:00:27 +09:00
ieee802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
ife	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
ipv4	tcp: add tcp_v4_fill_cb()/tcp_v4_restore_cb()	2017-12-03 12:39:14 -05:00
ipv6	tcp: add tcp_v4_fill_cb()/tcp_v4_restore_cb()	2017-12-03 12:39:14 -05:00
ipx	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
iucv
kcm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
key	af_key: replace BUG_ON on WARN_ON in net_exit hook	2017-11-14 15:45:52 +09:00
l2tp	l2tp: exit_net cleanup check added	2017-11-14 15:45:53 +09:00
l3mdev
lapb	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
llc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
mac80211	mac80211: tear down RX aggregations first	2017-11-27 11:24:59 +01:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
mpls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
ncsi	treewide: setup_timer() -> timer_setup() (2 field)	2017-11-21 15:57:09 -08:00
netfilter	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
netlabel	net/netlabel: Add list_next_rcu() in rcu_dereference().	2017-11-18 10:32:41 +09:00
netlink	netlink: remove unnecessary forward declaration	2017-11-14 21:51:14 +09:00
netrom	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
nfc	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
nsh	openvswitch: enable NSH support	2017-11-08 16:12:33 +09:00
openvswitch	openvswitch: fix the incorrect flow action alloc size	2017-11-26 18:34:59 -05:00
packet	net/packet: fix a race in packet_bind() and packet_notifier()	2017-11-28 11:13:30 -05:00
phonet	phonet: exit_net cleanup check added	2017-11-14 15:45:53 +09:00
psample	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
qrtr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-10 10:00:18 +09:00
rds	Merge branch 'akpm' (patches from Andrew)	2017-11-15 19:42:40 -08:00
rfkill
rose	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
rxrpc	rxrpc: Use correct netns source in rxrpc_release_sock()	2017-12-03 10:05:20 -05:00
sched	act_sample: get rid of tcf_sample_cleanup_rcu()	2017-11-30 10:19:17 -05:00
sctp	sctp: do not abandon the other frags in unsent outq if one msg has outstanding frags	2017-12-01 15:06:24 -05:00
smc	net/smc: Fix preinitialization of buf_desc in __smc_buf_create()	2017-11-24 01:33:34 +09:00
strparser	strparser: Use delayed work instead of timer for msg timeout	2017-10-25 10:37:11 +09:00
sunrpc	SUNRPC: make cache_detail structures const	2017-11-27 16:45:11 -05:00
switchdev	net: bridge: Add/del switchdev object on host join/leave	2017-11-10 13:41:40 +09:00
tipc	tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv()	2017-12-01 15:14:22 -05:00
tls	tls: don't override sk_write_space if tls_set_sw_offload fails.	2017-11-14 16:26:35 +09:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
vmw_vsock	VSOCK: Don't set sk_state to TCP_CLOSE before testing it	2017-11-28 16:01:50 -05:00
wimax	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
wireless	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-29 13:10:25 -08:00
x25	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
xfrm	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
compat.c
Kconfig
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
socket.c	kmemcheck: remove annotations	2017-11-15 18:21:04 -08:00
sysctl_net.c