Skip to content

Commit e0833d1

Browse files
q2venkuba-moo
authored andcommitted
dccp/tcp: Fixup bhash2 bucket when connect() fails.
If a socket bound to a wildcard address fails to connect(), we only reset saddr and keep the port. Then, we have to fix up the bhash2 bucket; otherwise, the bucket has an inconsistent address in the list. Also, listen() for such a socket will fire the WARN_ON() in inet_csk_get_port(). [0] Note that when a system runs out of memory, we give up fixing the bucket and unlink sk from bhash and bhash2 by inet_put_port(). [0]: WARNING: CPU: 0 PID: 207 at net/ipv4/inet_connection_sock.c:548 inet_csk_get_port (net/ipv4/inet_connection_sock.c:548 (discriminator 1)) Modules linked in: CPU: 0 PID: 207 Comm: bhash2_prev_rep Not tainted 6.1.0-rc3-00799-gc8421681c845 #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014 RIP: 0010:inet_csk_get_port (net/ipv4/inet_connection_sock.c:548 (discriminator 1)) Code: 74 a7 eb 93 48 8b 54 24 18 0f b7 cb 4c 89 e6 4c 89 ff e8 48 b2 ff ff 49 8b 87 18 04 00 00 e9 32 ff ff ff 0f 0b e9 34 ff ff ff <0f> 0b e9 42 ff ff ff 41 8b 7f 50 41 8b 4f 54 89 fe 81 f6 00 00 ff RSP: 0018:ffffc900003d7e50 EFLAGS: 00010202 RAX: ffff8881047fb500 RBX: 0000000000004e20 RCX: 0000000000000000 RDX: 000000000000000a RSI: 00000000fffffe00 RDI: 00000000ffffffff RBP: ffffffff8324dc00 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000004e20 R15: ffff8881054e1280 FS: 00007f8ac04dc740(0000) GS:ffff88842fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020001540 CR3: 00000001055fa003 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> inet_csk_listen_start (net/ipv4/inet_connection_sock.c:1205) inet_listen (net/ipv4/af_inet.c:228) __sys_listen (net/socket.c:1810) __x64_sys_listen (net/socket.c:1819 net/socket.c:1817 net/socket.c:1817) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) RIP: 0033:0x7f8ac051de5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 af 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc1c177248 EFLAGS: 00000206 ORIG_RAX: 0000000000000032 RAX: ffffffffffffffda RBX: 0000000020001550 RCX: 00007f8ac051de5d RDX: ffffffffffffff80 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007ffc1c177270 R08: 0000000000000018 R09: 0000000000000007 R10: 0000000020001540 R11: 0000000000000206 R12: 00007ffc1c177388 R13: 0000000000401169 R14: 0000000000403e18 R15: 00007f8ac0723000 </TASK> Fixes: 28044fc ("net: Add a bhash2 table hashed by port and address") Reported-by: syzbot <[email protected]> Reported-by: Mat Martineau <[email protected]> Signed-off-by: Kuniyuki Iwashima <[email protected]> Acked-by: Joanne Koong <[email protected]> Reviewed-by: Eric Dumazet <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]>
1 parent 8c5dae4 commit e0833d1

File tree

8 files changed

+41
-16
lines changed

8 files changed

+41
-16
lines changed

include/net/inet_hashtables.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,7 @@ inet_bhash2_addr_any_hashbucket(const struct sock *sk, const struct net *net, in
282282
* rcv_saddr field should already have been updated when this is called.
283283
*/
284284
int inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family);
285+
void inet_bhash2_reset_saddr(struct sock *sk);
285286

286287
void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
287288
struct inet_bind2_bucket *tb2, unsigned short port);

net/dccp/ipv4.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -143,8 +143,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
143143
* This unhashes the socket and releases the local port, if necessary.
144144
*/
145145
dccp_set_state(sk, DCCP_CLOSED);
146-
if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
147-
inet_reset_saddr(sk);
146+
inet_bhash2_reset_saddr(sk);
148147
ip_rt_put(rt);
149148
sk->sk_route_caps = 0;
150149
inet->inet_dport = 0;

net/dccp/ipv6.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -970,8 +970,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
970970

971971
late_failure:
972972
dccp_set_state(sk, DCCP_CLOSED);
973-
if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
974-
inet_reset_saddr(sk);
973+
inet_bhash2_reset_saddr(sk);
975974
__sk_dst_reset(sk);
976975
failure:
977976
inet->inet_dport = 0;

net/dccp/proto.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -279,8 +279,7 @@ int dccp_disconnect(struct sock *sk, int flags)
279279

280280
inet->inet_dport = 0;
281281

282-
if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
283-
inet_reset_saddr(sk);
282+
inet_bhash2_reset_saddr(sk);
284283

285284
sk->sk_shutdown = 0;
286285
sock_reset_flag(sk, SOCK_DONE);

net/ipv4/inet_hashtables.c

Lines changed: 34 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -871,7 +871,7 @@ static void inet_update_saddr(struct sock *sk, void *saddr, int family)
871871
#endif
872872
}
873873

874-
int inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family)
874+
static int __inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family, bool reset)
875875
{
876876
struct inet_hashinfo *hinfo = tcp_or_dccp_get_hashinfo(sk);
877877
struct inet_bind_hashbucket *head, *head2;
@@ -883,7 +883,11 @@ int inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family)
883883

884884
if (!inet_csk(sk)->icsk_bind2_hash) {
885885
/* Not bind()ed before. */
886-
inet_update_saddr(sk, saddr, family);
886+
if (reset)
887+
inet_reset_saddr(sk);
888+
else
889+
inet_update_saddr(sk, saddr, family);
890+
887891
return 0;
888892
}
889893

@@ -892,8 +896,19 @@ int inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family)
892896
* allocation fails.
893897
*/
894898
new_tb2 = kmem_cache_alloc(hinfo->bind2_bucket_cachep, GFP_ATOMIC);
895-
if (!new_tb2)
899+
if (!new_tb2) {
900+
if (reset) {
901+
/* The (INADDR_ANY, port) bucket might have already
902+
* been freed, then we cannot fixup icsk_bind2_hash,
903+
* so we give up and unlink sk from bhash/bhash2 not
904+
* to leave inconsistency in bhash2.
905+
*/
906+
inet_put_port(sk);
907+
inet_reset_saddr(sk);
908+
}
909+
896910
return -ENOMEM;
911+
}
897912

898913
bhash = inet_bhashfn(net, port, hinfo->bhash_size);
899914
head = &hinfo->bhash[bhash];
@@ -909,7 +924,10 @@ int inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family)
909924
inet_bind2_bucket_destroy(hinfo->bind2_bucket_cachep, inet_csk(sk)->icsk_bind2_hash);
910925
spin_unlock(&head2->lock);
911926

912-
inet_update_saddr(sk, saddr, family);
927+
if (reset)
928+
inet_reset_saddr(sk);
929+
else
930+
inet_update_saddr(sk, saddr, family);
913931

914932
head2 = inet_bhashfn_portaddr(hinfo, sk, net, port);
915933

@@ -930,8 +948,20 @@ int inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family)
930948

931949
return 0;
932950
}
951+
952+
int inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family)
953+
{
954+
return __inet_bhash2_update_saddr(sk, saddr, family, false);
955+
}
933956
EXPORT_SYMBOL_GPL(inet_bhash2_update_saddr);
934957

958+
void inet_bhash2_reset_saddr(struct sock *sk)
959+
{
960+
if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
961+
__inet_bhash2_update_saddr(sk, NULL, 0, true);
962+
}
963+
EXPORT_SYMBOL_GPL(inet_bhash2_reset_saddr);
964+
935965
/* RFC 6056 3.3.4. Algorithm 4: Double-Hash Port Selection Algorithm
936966
* Note that we use 32bit integers (vs RFC 'short integers')
937967
* because 2^16 is not a multiple of num_ephemeral and this

net/ipv4/tcp.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3114,8 +3114,7 @@ int tcp_disconnect(struct sock *sk, int flags)
31143114

31153115
inet->inet_dport = 0;
31163116

3117-
if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
3118-
inet_reset_saddr(sk);
3117+
inet_bhash2_reset_saddr(sk);
31193118

31203119
sk->sk_shutdown = 0;
31213120
sock_reset_flag(sk, SOCK_DONE);

net/ipv4/tcp_ipv4.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -331,8 +331,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
331331
* if necessary.
332332
*/
333333
tcp_set_state(sk, TCP_CLOSE);
334-
if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
335-
inet_reset_saddr(sk);
334+
inet_bhash2_reset_saddr(sk);
336335
ip_rt_put(rt);
337336
sk->sk_route_caps = 0;
338337
inet->inet_dport = 0;

net/ipv6/tcp_ipv6.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -346,8 +346,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
346346

347347
late_failure:
348348
tcp_set_state(sk, TCP_CLOSE);
349-
if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
350-
inet_reset_saddr(sk);
349+
inet_bhash2_reset_saddr(sk);
351350
failure:
352351
inet->inet_dport = 0;
353352
sk->sk_route_caps = 0;

0 commit comments

Comments
 (0)