Eric Dumazet eeea10b83a tcp: add tcp_v4_fill_cb()/tcp_v4_restore_cb() ...

James Morris reported kernel stack corruption bug [1] while
running the SELinux testsuite, and bisected to a recent
commit bffa72cf7f9d ("net: sk_buff rbnode reorg")

We believe this commit is fine, but exposes an older bug.

SELinux code runs from tcp_filter() and might send an ICMP,
expecting IP options to be found in skb->cb[] using regular IPCB placement.

We need to defer TCP mangling of skb->cb[] after tcp_filter() calls.

This patch adds tcp_v4_fill_cb()/tcp_v4_restore_cb() in a very
similar way we added them for IPv6.

[1]
[  339.806024] SELinux: failure in selinux_parse_skb(), unable to parse packet
[  339.822505] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81745af5
[  339.822505]
[  339.852250] CPU: 4 PID: 3642 Comm: client Not tainted 4.15.0-rc1-test #15
[  339.868498] Hardware name: LENOVO 10FGS0VA1L/30BC, BIOS FWKT68A   01/19/2017
[  339.885060] Call Trace:
[  339.896875]  <IRQ>
[  339.908103]  dump_stack+0x63/0x87
[  339.920645]  panic+0xe8/0x248
[  339.932668]  ? ip_push_pending_frames+0x33/0x40
[  339.946328]  ? icmp_send+0x525/0x530
[  339.958861]  ? kfree_skbmem+0x60/0x70
[  339.971431]  __stack_chk_fail+0x1b/0x20
[  339.984049]  icmp_send+0x525/0x530
[  339.996205]  ? netlbl_skbuff_err+0x36/0x40
[  340.008997]  ? selinux_netlbl_err+0x11/0x20
[  340.021816]  ? selinux_socket_sock_rcv_skb+0x211/0x230
[  340.035529]  ? security_sock_rcv_skb+0x3b/0x50
[  340.048471]  ? sk_filter_trim_cap+0x44/0x1c0
[  340.061246]  ? tcp_v4_inbound_md5_hash+0x69/0x1b0
[  340.074562]  ? tcp_filter+0x2c/0x40
[  340.086400]  ? tcp_v4_rcv+0x820/0xa20
[  340.098329]  ? ip_local_deliver_finish+0x71/0x1a0
[  340.111279]  ? ip_local_deliver+0x6f/0xe0
[  340.123535]  ? ip_rcv_finish+0x3a0/0x3a0
[  340.135523]  ? ip_rcv_finish+0xdb/0x3a0
[  340.147442]  ? ip_rcv+0x27c/0x3c0
[  340.158668]  ? inet_del_offload+0x40/0x40
[  340.170580]  ? __netif_receive_skb_core+0x4ac/0x900
[  340.183285]  ? rcu_accelerate_cbs+0x5b/0x80
[  340.195282]  ? __netif_receive_skb+0x18/0x60
[  340.207288]  ? process_backlog+0x95/0x140
[  340.218948]  ? net_rx_action+0x26c/0x3b0
[  340.230416]  ? __do_softirq+0xc9/0x26a
[  340.241625]  ? do_softirq_own_stack+0x2a/0x40
[  340.253368]  </IRQ>
[  340.262673]  ? do_softirq+0x50/0x60
[  340.273450]  ? __local_bh_enable_ip+0x57/0x60
[  340.285045]  ? ip_finish_output2+0x175/0x350
[  340.296403]  ? ip_finish_output+0x127/0x1d0
[  340.307665]  ? nf_hook_slow+0x3c/0xb0
[  340.318230]  ? ip_output+0x72/0xe0
[  340.328524]  ? ip_fragment.constprop.54+0x80/0x80
[  340.340070]  ? ip_local_out+0x35/0x40
[  340.350497]  ? ip_queue_xmit+0x15c/0x3f0
[  340.361060]  ? __kmalloc_reserve.isra.40+0x31/0x90
[  340.372484]  ? __skb_clone+0x2e/0x130
[  340.382633]  ? tcp_transmit_skb+0x558/0xa10
[  340.393262]  ? tcp_connect+0x938/0xad0
[  340.403370]  ? ktime_get_with_offset+0x4c/0xb0
[  340.414206]  ? tcp_v4_connect+0x457/0x4e0
[  340.424471]  ? __inet_stream_connect+0xb3/0x300
[  340.435195]  ? inet_stream_connect+0x3b/0x60
[  340.445607]  ? SYSC_connect+0xd9/0x110
[  340.455455]  ? __audit_syscall_entry+0xaf/0x100
[  340.466112]  ? syscall_trace_enter+0x1d0/0x2b0
[  340.476636]  ? __audit_syscall_exit+0x209/0x290
[  340.487151]  ? SyS_connect+0xe/0x10
[  340.496453]  ? do_syscall_64+0x67/0x1b0
[  340.506078]  ? entry_SYSCALL64_slow_path+0x25/0x25

Fixes: 971f10eca186 ("tcp: better TCP_SKB_CB layout to reduce cache line misses")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: James Morris <james.l.morris@oracle.com>
Tested-by: James Morris <james.l.morris@oracle.com>
Tested-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2017-12-03 12:39:14 -05:00

..

netfilter

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2017-11-08 14:22:50 +09:00

af_inet.c

net: accept UFO datagrams from tuntap and packet

2017-11-24 01:37:35 +09:00

ah4.c

net: use -ENOSPC for transient busy indication

2017-11-03 22:11:17 +08:00

arp.c

ipv4: mark expected switch fall-throughs

2017-10-18 14:10:29 +01:00

cipso_ipv4.c

tcp/dccp: fix ireq->opt races

2017-10-21 01:33:19 +01:00

datagram.c

net: Set sk_txhash from a random number

2015-07-29 22:44:04 -07:00

devinet.c

net: Add extack to validator_info structs used for address notifier

2017-10-20 13:15:07 +01:00

esp4_offload.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-09-01 17:42:05 -07:00

esp4.c

net: use -ENOSPC for transient busy indication

2017-11-03 22:11:17 +08:00

fib_frontend.c

ipv4: fix validate_source for VRF setup

2017-11-01 21:25:15 +09:00

fib_lookup.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

fib_notifier.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

fib_rules.c

net: fib_rules: Implement notification logic in core

2017-08-03 15:35:59 -07:00

fib_semantics.c

tcp: Namespace-ify sysctl_tcp_default_congestion_control

2017-11-15 14:09:52 +09:00

fib_trie.c

net: Add extack to fib_notifier_info

2017-11-01 11:50:43 +09:00

fou.c

gue: fix remcsum when GRO on and CHECKSUM_PARTIAL boundary is outer UDP

2017-08-01 16:09:14 -07:00

gre_demux.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-06-30 05:03:36 -04:00

gre_offload.c

gso: fix payload length when gso_size is zero

2017-10-08 10:12:15 -07:00

icmp.c

ipv4: icmp: use BUG_ON instead of if condition followed by BUG

2017-10-24 18:44:42 +09:00

igmp.c

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

inet_connection_sock.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-10-30 21:09:24 +09:00

inet_diag.c

inet_diag: allow protocols to provide additional data

2017-09-01 18:38:09 -07:00

inet_fragment.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2017-11-15 11:56:19 -08:00

inet_hashtables.c

soreuseport: fix initialization race

2017-10-22 02:03:51 +01:00

inet_timewait_sock.c

Merge branch 'akpm' (patches from Andrew)

2017-11-15 19:42:40 -08:00

inetpeer.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-10-05 18:19:22 -07:00

ip_forward.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ip_fragment.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-11-04 09:26:51 +09:00

ip_gre.c

ip_gre: add the support for i/o_flags update via ioctl

2017-11-10 14:39:53 +09:00

ip_input.c

IPv4: early demux can return an error code

2017-10-01 03:55:47 +01:00

ip_options.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ip_output.c

udp: remove unreachable ufo branches

2017-08-22 14:27:18 -07:00

ip_sockglue.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ip_tunnel_core.c

net: store port/representator id in metadata_dst

2017-06-25 11:42:01 -04:00

ip_tunnel.c

ipv4: speedup ipv6 tunnels dismantle

2017-09-19 16:32:24 -07:00

ip_vti.c

ip_vti: remove the useless err_count check in vti_xmit

2017-11-01 11:57:32 +09:00

ipcomp.c

ipv4: coding style: comparison for equality with NULL

2015-04-03 12:11:15 -04:00

ipconfig.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ipip.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-10-30 21:09:24 +09:00

ipmr.c

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

Kconfig

ip: update policy routing config help

2017-10-12 22:57:11 -07:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

netfilter.c

netfilter: use skb_to_full_sk in ip_route_me_harder

2017-02-28 12:49:36 +01:00

ping.c

net: convert sock.sk_refcnt from atomic_t to refcount_t

2017-07-01 07:39:08 -07:00

proc.c

tcp: retire FACK loss detection

2017-11-11 18:53:16 +09:00

protocol.c

net: Add sysctl to toggle early demux for tcp and udp

2017-03-24 13:17:07 -07:00

raw_diag.c

net: ipv6: add second dif to raw socket lookups

2017-08-07 11:39:22 -07:00

raw.c

net: ipv4: add second dif to multicast source filter

2017-08-07 11:39:22 -07:00

route.c

route: also update fnhe_genid when updating a route cache

2017-11-18 10:32:41 +09:00

syncookies.c

tcp: Namespace-ify sysctl_tcp_workaround_signed_windows

2017-10-28 19:24:38 +09:00

sysctl_net_ipv4.c

tcp: Namespace-ify sysctl_tcp_default_congestion_control

2017-11-15 14:09:52 +09:00

tcp_bbr.c

tcp_bbr: init pacing rate on first RTT sample

2017-07-15 14:43:29 -07:00

tcp_bic.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_cdg.c

tcp: cdg: make struct tcp_cdg static

2017-10-16 21:24:25 +01:00

tcp_cong.c

tcp: Namespace-ify sysctl_tcp_default_congestion_control

2017-11-15 14:09:52 +09:00

tcp_cubic.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_dctcp.c

Revert "dctcp: update cwnd on congestion event"

2016-12-06 11:34:24 -05:00

tcp_diag.c

tcp_diag: report TCP MD5 signing keys and addresses

2017-09-01 18:38:09 -07:00

tcp_fastopen.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-11-04 09:26:51 +09:00

tcp_highspeed.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_htcp.c

tcp: fix cwnd undo in Reno and HTCP congestion controls

2017-08-06 21:25:10 -07:00

tcp_hybla.c

tcp: make undo_cwnd mandatory for congestion modules

2016-11-21 13:20:17 -05:00

tcp_illinois.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_input.c

tcp: when scheduling TLP, time of RTO should account for current ACK

2017-11-19 12:25:26 +09:00

tcp_ipv4.c

tcp: add tcp_v4_fill_cb()/tcp_v4_restore_cb()

2017-12-03 12:39:14 -05:00

tcp_lp.c

tcp: switch TCP TS option (RFC 7323) to 1ms clock

2017-05-17 16:06:01 -04:00

tcp_metrics.c

tcp: retire FACK loss detection

2017-11-11 18:53:16 +09:00

tcp_minisocks.c

tcp/dccp: block bh before arming time_wait timer

2017-12-01 15:07:43 -05:00

tcp_nv.c

tcp_nv: use do_div() instead of expensive div64_u64()

2017-11-04 22:34:52 +09:00

tcp_offload.c

tcp: gso: avoid refcount_t warning from tcp_gso_segment()

2017-11-10 18:07:15 +09:00

tcp_output.c

tcp: when scheduling TLP, time of RTO should account for current ACK

2017-11-19 12:25:26 +09:00

tcp_probe.c

tcp: remove redundant argument from tcp_rcv_established()

2017-07-24 17:28:12 -07:00

tcp_rate.c

tcp: export do_tcp_sendpages and tcp_rate_check_app_limited functions

2017-06-15 12:12:40 -04:00

tcp_recovery.c

tcp: higher throughput under reordering with adaptive RACK reordering wnd

2017-11-05 23:15:42 +09:00

tcp_scalable.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_timer.c

tcp: tcp_mtu_probing() cleanup

2017-11-05 22:14:23 +09:00

tcp_ulp.c

tcp: ulp: avoid module refcnt leak in tcp_set_ulp

2017-08-14 22:17:05 -07:00

tcp_vegas.c

tcp: fix under-evaluated ssthresh in TCP Vegas

2017-09-29 06:07:00 +01:00

tcp_vegas.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

tcp_veno.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp_westwood.c

tcp: Revert "tcp: remove CA_ACK_SLOWPATH"

2017-08-30 11:20:08 -07:00

tcp_yeah.c

tcp: consolidate congestion control undo functions

2017-08-06 21:25:10 -07:00

tcp.c

tcp: use sequence distance to detect reordering

2017-11-11 18:53:16 +09:00

tunnel4.c

tunnels: correct conditional build of MPLS and IPv6

2016-07-11 13:27:06 -07:00

udp_diag.c

net: ipv6: add second dif to udp socket lookups

2017-08-07 11:39:22 -07:00

udp_impl.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

udp_offload.c

net: accept UFO datagrams from tuntap and packet

2017-11-24 01:37:35 +09:00

udp_tunnel.c

net: add infrastructure to un-offload UDP tunnel port

2017-07-24 13:52:59 -07:00

udp.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2017-11-15 11:56:19 -08:00

udplite.c

udplite: call proper backlog handlers

2016-11-24 15:32:14 -05:00

xfrm4_input.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xfrm4_mode_beet.c

networking: make skb_pull & friends return void pointers

2017-06-16 11:48:39 -04:00

xfrm4_mode_transport.c

xfrm: Add encapsulation header offsets while SKB is not encrypted

2017-04-14 10:07:39 +02:00

xfrm4_mode_tunnel.c

xfrm: Add encapsulation header offsets while SKB is not encrypted

2017-04-14 10:07:39 +02:00

xfrm4_output.c

xfrm: Add an IPsec hardware offloading API

2017-04-14 10:06:10 +02:00

xfrm4_policy.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xfrm4_protocol.c

xfrm: input: constify xfrm_input_afinfo

2017-02-09 10:22:17 +01:00

xfrm4_state.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xfrm4_tunnel.c

sit: add IPv4 over IPv4 support

2013-05-31 17:19:05 -07:00