• Eric Dumazet's avatar
    tcp: fix NULL deref in tcp_v4_send_ack() · e62a123b
    Eric Dumazet authored
    Neal reported crashes with this stack trace :
    
     RIP: 0010:[<ffffffff8c57231b>] tcp_v4_send_ack+0x41/0x20f
    ...
     CR2: 0000000000000018 CR3: 000000044005c000 CR4: 00000000001427e0
    ...
      [<ffffffff8c57258e>] tcp_v4_reqsk_send_ack+0xa5/0xb4
      [<ffffffff8c1a7caa>] tcp_check_req+0x2ea/0x3e0
      [<ffffffff8c19e420>] tcp_rcv_state_process+0x850/0x2500
      [<ffffffff8c1a6d21>] tcp_v4_do_rcv+0x141/0x330
      [<ffffffff8c56cdb2>] sk_backlog_rcv+0x21/0x30
      [<ffffffff8c098bbd>] tcp_recvmsg+0x75d/0xf90
      [<ffffffff8c0a8700>] inet_recvmsg+0x80/0xa0
      [<ffffffff8c17623e>] sock_aio_read+0xee/0x110
      [<ffffffff8c066fcf>] do_sync_read+0x6f/0xa0
      [<ffffffff8c0673a1>] SyS_read+0x1e1/0x290
      [<ffffffff8c5ca262>] system_call_fastpath+0x16/0x1b
    
    The problem here is the skb we provide to tcp_v4_send_ack() had to
    be parked in the backlog of a new TCP fastopen child because this child
    was owned by the user at the time an out of window packet arrived.
    
    Before queuing a packet, TCP has to set skb->dev to NULL as the device
    could disappear before packet is removed from the queue.
    
    Fix this issue by using the net pointer provided by the socket (being a
    timewait or a request socket).
    
    IPv6 is immune to the bug : tcp_v6_send_response() already gets the net
    pointer from the socket if provided.
    
    Fixes: 168a8f58 ("tcp: TCP Fast Open Server - main code path")
    Reported-by: default avatarNeal Cardwell <ncardwell@google.com>
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Cc: Jerry Chu <hkchu@google.com>
    Cc: Yuchung Cheng <ycheng@google.com>
    Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e62a123b
tcp_ipv4.c 61.1 KB