From patchwork Fri Jun 5 17:32:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Davide Caratti X-Patchwork-Id: 1304290 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.01.org (client-ip=198.145.21.10; helo=ml01.01.org; envelope-from=mptcp-bounces@lists.01.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=aSMP689r; dkim-atps=neutral Received: from ml01.01.org (ml01.01.org [198.145.21.10]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49dqVM1R7Fz9sSf for ; Sat, 6 Jun 2020 03:32:58 +1000 (AEST) Received: from ml01.vlan13.01.org (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id D31521009F03B; Fri, 5 Jun 2020 10:27:42 -0700 (PDT) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=207.211.31.120; helo=us-smtp-1.mimecast.com; envelope-from=dcaratti@redhat.com; receiver= Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 92AAE1009F036 for ; Fri, 5 Jun 2020 10:27:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1591378369; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FCrDaNBptE/EAr0ZYeFR1AD9sChDpOH9Lmsq97Y7dkE=; b=aSMP689rKYP0bLQ+VSjWoQndFvn9Ni9O9Qwlaq7gEg6K0iNHcaNH/KekK2RPLyO0J7trYg X14OjaU28Rc08Goe/OBZMqd18UjyOIKi0OvQzkR/sDRjExI38K2IfYdkGXj43vtDP3g98C lCTELGjcm9vRn+iqhIXqY8VHoevoR4w= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-309-0jMomlIxPNq1tX8QfCV9ZQ-1; Fri, 05 Jun 2020 13:32:48 -0400 X-MC-Unique: 0jMomlIxPNq1tX8QfCV9ZQ-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 4BBADBFC0 for ; Fri, 5 Jun 2020 17:32:47 +0000 (UTC) Received: from new-host-5.redhat.com (unknown [10.40.194.191]) by smtp.corp.redhat.com (Postfix) with ESMTP id AECB760F80 for ; Fri, 5 Jun 2020 17:32:46 +0000 (UTC) From: Davide Caratti To: mptcp@lists.01.org Date: Fri, 5 Jun 2020 19:32:42 +0200 Message-Id: <20200605173242.2644099-1-dcaratti@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Message-ID-Hash: WCFWTI6IVAPH7QGW4ZUGQYE232MDJUOS X-Message-ID-Hash: WCFWTI6IVAPH7QGW4ZUGQYE232MDJUOS X-MailFrom: dcaratti@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header X-Mailman-Version: 3.1.1 Precedence: list Subject: [MPTCP] [PATCH mptcp-next v2] [DO-NOT-MERGE] mptcp: use kmalloc on kasan build List-Id: Discussions regarding MPTCP upstreaming Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: From: Paolo Abeni Helps detection UaF, which apparently kasan misses with kmem_cache allocator. We also need to always set the SOCK_RCU_FREE flag, to preserved the current code leveraging SLAB_TYPESAFE_BY_RCU. This latter change will make unreachable some existing errors path, but I don't see other options. Signed-off-by: Paolo Abeni --- net/ipv4/af_inet.c | 3 +++ net/ipv6/af_inet6.c | 3 +++ net/mptcp/protocol.c | 15 +++++++++++++-- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 02aa5cb3a4fd..53da7a4683d3 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -316,7 +316,10 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, answer_flags = answer->flags; rcu_read_unlock(); +#if !IS_ENABLED(CONFIG_KASAN) + /* with kasan we use kmalloc */ WARN_ON(!answer_prot->slab); +#endif err = -ENOBUFS; sk = sk_alloc(net, PF_INET, GFP_KERNEL, answer_prot, kern); diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index b304b882e031..14358a623e88 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -177,7 +177,10 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, answer_flags = answer->flags; rcu_read_unlock(); +#if !IS_ENABLED(CONFIG_KASAN) WARN_ON(!answer_prot->slab); + /* with kasan we use kmalloc */ +#endif err = -ENOBUFS; sk = sk_alloc(net, PF_INET6, GFP_KERNEL, answer_prot, kern); diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 99c019879833..1138caaae330 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1265,6 +1265,9 @@ static int __mptcp_init_sock(struct sock *sk) /* re-use the csk retrans timer for MPTCP-level retrans */ timer_setup(&msk->sk.icsk_retransmit_timer, mptcp_retransmit_timer, 0); +#if IS_ENABLED(CONFIG_KASAN) + sock_set_flag(sk, SOCK_RCU_FREE); +#endif return 0; } @@ -1458,7 +1461,9 @@ struct sock *mptcp_sk_clone(const struct sock *sk, msk->ack_seq = ack_seq; } +#if !IS_ENABLED(CONFIG_KASAN) sock_reset_flag(nsk, SOCK_RCU_FREE); +#endif /* will be fully established after successful MPC subflow creation */ inet_sk_state_store(nsk, TCP_SYN_RECV); bh_unlock_sock(nsk); @@ -2079,6 +2084,12 @@ static struct inet_protosw mptcp_protosw = { .flags = INET_PROTOSW_ICSK, }; +#if IS_ENABLED(CONFIG_KASAN) +#define MPTCP_USE_SLAB 0 +#else +#define MPTCP_USE_SLAB 1 +#endif + void __init mptcp_proto_init(void) { mptcp_prot.h.hashinfo = tcp_prot.h.hashinfo; @@ -2090,7 +2101,7 @@ void __init mptcp_proto_init(void) mptcp_pm_init(); mptcp_token_init(); - if (proto_register(&mptcp_prot, 1) != 0) + if (proto_register(&mptcp_prot, MPTCP_USE_SLAB) != 0) panic("Failed to register MPTCP proto.\n"); inet_register_protosw(&mptcp_protosw); @@ -2152,7 +2163,7 @@ int __init mptcp_proto_v6_init(void) mptcp_v6_prot.destroy = mptcp_v6_destroy; mptcp_v6_prot.obj_size = sizeof(struct mptcp6_sock); - err = proto_register(&mptcp_v6_prot, 1); + err = proto_register(&mptcp_v6_prot, MPTCP_USE_SLAB); if (err) return err;