In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: Don’t call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().<\/p>\n
tcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for
\nTCP_LISTEN since commit 073d89808c06 (“net: fix data-races around
\nsk->sk_forward_alloc”).<\/p>\n
However, there is still a small race window between tcp_v6_rcv()
\nand tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN
\nto TCP_CLOSE, causing skb_clone_and_charge_r() to be called
\nlocklessly and resulting in the splat below. [0]<\/p>\n
Let’s avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well.<\/p>\n
This is fine for non-listeners because tcp_rcv_state_process()
\ndrops skb for TCP_CLOSE and opt_skb was freed immediately anyway.<\/p>\n
[0]:
\nsk->sk_forward_alloc
\nWARNING: net\/ipv4\/af_inet.c:162 at inet_sock_destruct+0x64d\/0x810 net\/ipv4\/af_inet.c:162, CPU#1: ksoftirqd\/1\/28
\nModules linked in:
\nCPU: 1 UID: 0 PID: 28 Comm: ksoftirqd\/1 Not tainted 7.2.0 #17 PREEMPT(full)
\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04\/01\/2014
\nRIP: 0010:inet_sock_destruct+0x64d\/0x810 net\/ipv4\/af_inet.c:162
\nCode: 3d 49 ff e9 06 fd ff ff e8 d0 5b 83 f8 90 0f 0b 90 e9 35 fe ff ff e8 c2 5b 83 f8 90 0f 0b 90 e9 c5 fe ff ff e8 b4 5b 83 f8 90 0b 90 e9 04 ff ff ff e8 a6 5b 83 f8 90 0f 0b 90 e9 65 fe ff ff
\nRSP: 0018:ffffc90000677bb8 EFLAGS: 00010246
\nRAX: 0000000000000000 RBX: ffff8880117bde80 RCX: ffffffff8957eb41
\nRDX: ffff88801dad5d00 RSI: ffffffff8957ec3c RDI: 0000000000000005
\nRBP: 00000000fffff000 R08: ffffffff8957eb41 R09: 00000000fffff000
\nR10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000
\nR13: ffff8880117bdf10 R14: ffffffff81c08eb7 R15: 0000000000000003
\nFS: 0000000000000000(0000) GS:ffff8880d7ae5000(0000) knlGS:0000000000000000
\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
\nCR2: 00007f93a1021138 CR3: 00000000207a9000 CR4: 0000000000350ef0
\nCall Trace:<\/p>\n
__sk_destruct+0x82\/0xae0 net\/core\/sock.c:2356
\n rcu_do_batch kernel\/rcu\/tree.c:2645 [inline]
\n rcu_core+0x59c\/0x1100 kernel\/rcu\/tree.c:2897
\n handle_softirqs+0x1e4\/0x9b0 kernel\/softirq.c:622
\n run_ksoftirqd kernel\/softirq.c:1076 [inline]
\n run_ksoftirqd+0x38\/0x60 kernel\/softirq.c:1068
\n smpboot_thread_fn+0x458\/0xc80 kernel\/smpboot.c:160
\n kthread+0x396\/0x4a0 kernel\/kthread.c:436
\n ret_from_fork+0x8e0\/0xe40 arch\/x86\/kernel\/process.c:158
\n ret_from_fork_asm+0x1a\/0x30 arch\/x86\/entry\/entry_64.S:245<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: Don’t call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().<\/p>\n
tcp_v6_do_rcv() no longer calls skb_clone_and_c<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33369","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}