| Message ID | 3a0b48a0fa62632115c30267700936028c898388.1608628900.git.pabeni@redhat.com |
|---|---|
| State | Accepted, archived |
| Commit | 0b6dd0e5543ad8183a1e229ce2cb4d9c0cbadb63 |
| Delegated to: | Matthieu Baerts |
| Headers | show |
| Series | mptcp: fix for issue/121 | expand |
On Tue, 22 Dec 2020, Paolo Abeni wrote: > Syzkaller found a way to trigger division by zero > in mptcp_subflow_cleanup_rbuf(). > > The current checks implemented into tcp_can_send_ack() > are too week, let's be more accurate. > > Reported-by: Christoph Paasch <cpaasch@apple.com> > Fixes: ea4ca586b16f ("mptcp: refine MPTCP-level ack scheduling") > Fixes: fd8976790a6c ("mptcp: be careful on MPTCP-level ack.") > Signed-off-by: Paolo Abeni <pabeni@redhat.com> > --- > net/mptcp/protocol.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c > index d3e28f1c2313..7cdee23580bf 100644 > --- a/net/mptcp/protocol.c > +++ b/net/mptcp/protocol.c > @@ -427,7 +427,7 @@ static bool mptcp_subflow_active(struct mptcp_subflow_context *subflow) > static bool tcp_can_send_ack(const struct sock *ssk) > { > return !((1 << inet_sk_state_load(ssk)) & > - (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_TIME_WAIT | TCPF_CLOSE)); > + (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_TIME_WAIT | TCPF_CLOSE | TCPF_LISTEN)); > } > > static void mptcp_send_ack(struct mptcp_sock *msk) > -- > 2.26.2 Looks good to me, thanks Paolo. Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com> -- Mat Martineau Intel
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index d3e28f1c2313..7cdee23580bf 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -427,7 +427,7 @@ static bool mptcp_subflow_active(struct mptcp_subflow_context *subflow) static bool tcp_can_send_ack(const struct sock *ssk) { return !((1 << inet_sk_state_load(ssk)) & - (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_TIME_WAIT | TCPF_CLOSE)); + (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_TIME_WAIT | TCPF_CLOSE | TCPF_LISTEN)); } static void mptcp_send_ack(struct mptcp_sock *msk)
Syzkaller found a way to trigger division by zero in mptcp_subflow_cleanup_rbuf(). The current checks implemented into tcp_can_send_ack() are too week, let's be more accurate. Reported-by: Christoph Paasch <cpaasch@apple.com> Fixes: ea4ca586b16f ("mptcp: refine MPTCP-level ack scheduling") Fixes: fd8976790a6c ("mptcp: be careful on MPTCP-level ack.") Signed-off-by: Paolo Abeni <pabeni@redhat.com> --- net/mptcp/protocol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)