| Message ID | 20240308200122.64357-1-kuniyu@amazon.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | tcp/rds: Fix use-after-free around kernel TCP reqsk. | expand |
Hello: This series was applied to netdev/net.git (main) by Paolo Abeni <pabeni@redhat.com>: On Fri, 8 Mar 2024 12:01:20 -0800 you wrote: > syzkaller reported an warning of netns ref tracker for RDS TCP listener, > which commit 740ea3c4a0b2 ("tcp: Clean up kernel listener's reqsk in > inet_twsk_purge()") fixed for per-netns ehash. > > This series fixes the bug in the partial fix and fixes the reported bug > in the global ehash. > > [...] Here is the summary with links: - [v5,net,1/2] tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() https://git.kernel.org/netdev/net/c/a7b7079bc292 - [v5,net,2/2] rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). https://git.kernel.org/netdev/net/c/a28895fc04fa You are awesome, thank you!
On Tue, 12 Mar 2024 15:10:32 +0000 patchwork-bot+netdevbpf@kernel.org wrote: > - [v5,net,1/2] tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() > https://git.kernel.org/netdev/net/c/a7b7079bc292 > - [v5,net,2/2] rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). > https://git.kernel.org/netdev/net/c/a28895fc04fa I think I need to discard these, otherwise I won't be able to fast forward after Linus pulls :( I re-apply later.
On Tue, 12 Mar 2024 08:59:42 -0700 Jakub Kicinski wrote: > On Tue, 12 Mar 2024 15:10:32 +0000 patchwork-bot+netdevbpf@kernel.org > wrote: > > - [v5,net,1/2] tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() > > https://git.kernel.org/netdev/net/c/a7b7079bc292 > > - [v5,net,2/2] rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). > > https://git.kernel.org/netdev/net/c/a28895fc04fa > > I think I need to discard these, otherwise I won't be able to fast > forward after Linus pulls :( I re-apply later. Back in it goes, hopefully we didn't cause too much strife with the reset.
syzkaller reported an warning of netns ref tracker for RDS TCP listener, which commit 740ea3c4a0b2 ("tcp: Clean up kernel listener's reqsk in inet_twsk_purge()") fixed for per-netns ehash. This series fixes the bug in the partial fix and fixes the reported bug in the global ehash. Changes: v5: * Reuse the correct logic for reqsk in inet_twsk_purge(). v4: https://lore.kernel.org/netdev/20240307232151.55963-1-kuniyu@amazon.com/ * Add sk_family/refcnt check in inet_twsk_purge(). v3: https://lore.kernel.org/netdev/20240307224423.53315-1-kuniyu@amazon.com/ * Drop patch 2, 3, 5 * Fix uaf by iterating ehash and purging reqsk during netns dismantle. v2: https://lore.kernel.org/netdev/20240227011041.97375-1-kuniyu@amazon.com/ * Add patch 1, 3, 5 * Use __sock_create() instead of converting socket * Drop Sowmini from CC as it's bounced (patchwork may complain) v1: https://lore.kernel.org/netdev/20240223172448.94084-1-kuniyu@amazon.com/ Eric Dumazet (1): tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() Kuniyuki Iwashima (1): rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). net/ipv4/inet_timewait_sock.c | 41 ++++++++++++++++------------------- net/ipv4/tcp_minisocks.c | 4 ---- 2 files changed, 19 insertions(+), 26 deletions(-)