qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tcp: Fix uninitialized access in skb frags array for Rx 0cp. 

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2028279
Tested: LNST, Tier1

Upstream commit:
commit 70701b83e208767f2720d8cd3e6a62cddafb3a30
Author: Arjun Roy <arjunroy@google.com>
Date:   Thu Nov 11 15:52:15 2021 -0800

    tcp: Fix uninitialized access in skb frags array for Rx 0cp.

    TCP Receive zerocopy iterates through the SKB queue via
    tcp_recv_skb(), acquiring a pointer to an SKB and an offset within
    that SKB to read from. From there, it iterates the SKB frags array to
    determine which offset to start remapping pages from.

    However, this is built on the assumption that the offset read so far
    within the SKB is smaller than the SKB length. If this assumption is
    violated, we can attempt to read an invalid frags array element, which
    would cause a fault.

    tcp_recv_skb() can cause such an SKB to be returned when the TCP FIN
    flag is set. Therefore, we must guard against this occurrence inside
    skb_advance_frag().

    One way that we can reproduce this error follows:
    1) In a receiver program, call getsockopt(TCP_ZEROCOPY_RECEIVE) with:
    char some_array[32 * 1024];
    struct tcp_zerocopy_receive zc = {
      .copybuf_address  = (__u64) &some_array[0],
      .copybuf_len = 32 * 1024,
    };

    2) In a sender program, after a TCP handshake, send the following
    sequence of packets:
      i) Seq = [X, X+4000]
      ii) Seq = [X+4000, X+5000]
      iii) Seq = [X+4000, X+5000], Flags = FIN | URG, urgptr=1000

    (This can happen without URG, if we have a signal pending, but URG is
    a convenient way to reproduce the behaviour).

    In this case, the following event sequence will occur on the receiver:

    tcp_zerocopy_receive():
    -> receive_fallback_to_copy() // copybuf_len >= inq
    -> tcp_recvmsg_locked() // reads 5000 bytes, then breaks due to URG
    -> tcp_recv_skb() // yields skb with skb->len == offset
    -> tcp_zerocopy_set_hint_for_skb()
    -> skb_advance_to_frag() // will returns a frags ptr. >= nr_frags
    -> find_next_mappable_frag() // will dereference this bad frags ptr.

    With this patch, skb_advance_to_frag() will no longer return an
    invalid frags pointer, and will return NULL instead, fixing the issue.

    Signed-off-by: Arjun Roy <arjunroy@google.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Fixes: 05255b823a ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive")
    Link: https://lore.kernel.org/r/20211111235215.2605384-1-arjunroy.kdev@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Paolo Abeni 2021-12-01 22:39:45 +01:00
parent 61a6bc470c
commit 7b94dec6c5
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/ipv4/tcp.c
View File

@ -1779,6 +1779,9 @@ static skb_frag_t *skb_advance_to_frag(struct sk_buff *skb, u32 offset_skb,
{
skb_frag_t *frag;
if (unlikely(offset_skb >= skb->len))
return NULL;
offset_skb -= skb_headlen(skb);
if ((int)offset_skb < 0 || skb_has_frag_list(skb))
return NULL;