Eric Dumazet 878d951c67 inet: lock the socket in ip_sock_set_tos() ... Christoph Paasch reported a panic in TCP stack [1] Indeed, we should not call sk_dst_reset() without holding the socket lock, as __sk_dst_get() callers do not all rely on bare RCU. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 12bad6067 P4D 12bad6067 PUD 12bad5067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 1 PID: 2750 Comm: syz-executor.5 Not tainted 6.6.0-rc4-g7a5720a344e7 #49 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:tcp_get_metrics+0x118/0x8f0 net/ipv4/tcp_metrics.c:321 Code: c7 44 24 70 02 00 8b 03 89 44 24 48 c7 44 24 4c 00 00 00 00 66 c7 44 24 58 02 00 66 ba 02 00 b1 01 89 4c 24 04 4c 89 7c 24 10 <49> 8b 0f 48 8b 89 50 05 00 00 48 89 4c 24 30 33 81 00 02 00 00 69 RSP: 0018:ffffc90000af79b8 EFLAGS: 00010293 RAX: 000000000100007f RBX: ffff88812ae8f500 RCX: ffff88812b5f8f01 RDX: 0000000000000002 RSI: ffffffff8300f080 RDI: 0000000000000002 RBP: 0000000000000002 R08: 0000000000000003 R09: ffffffff8205eca0 R10: 0000000000000002 R11: ffff88812b5f8f00 R12: ffff88812a9e0580 R13: 0000000000000000 R14: ffff88812ae8fbd2 R15: 0000000000000000 FS: 00007f70a006b640(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000012bad7003 CR4: 0000000000170ee0 Call Trace: <TASK> tcp_fastopen_cache_get+0x32/0x140 net/ipv4/tcp_metrics.c:567 tcp_fastopen_cookie_check+0x28/0x180 net/ipv4/tcp_fastopen.c:419 tcp_connect+0x9c8/0x12a0 net/ipv4/tcp_output.c:3839 tcp_v4_connect+0x645/0x6e0 net/ipv4/tcp_ipv4.c:323 __inet_stream_connect+0x120/0x590 net/ipv4/af_inet.c:676 tcp_sendmsg_fastopen+0x2d6/0x3a0 net/ipv4/tcp.c:1021 tcp_sendmsg_locked+0x1957/0x1b00 net/ipv4/tcp.c:1073 tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1336 __sock_sendmsg+0x83/0xd0 net/socket.c:730 __sys_sendto+0x20a/0x2a0 net/socket.c:2194 __do_sys_sendto net/socket.c:2206 [inline] Fixes: e08d0b3d17 ("inet: implement lockless IP_TOS") Reported-by: Christoph Paasch <cpaasch@apple.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20231018090014.345158-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2023-10-19 13:13:13 +02:00
..
bpf.c	bpf: Add update_socket_protocol hook	2023-08-16 10:22:16 -07:00
crypto.c
crypto_test.c
ctrl.c	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
diag.c
fastopen.c
Kconfig
Makefile	mptcp: add struct mptcp_sched_ops	2023-08-22 17:31:18 -07:00
mib.c
mib.h
mptcp_diag.c
options.c	mptcp: fix bogus receive window shrinkage with multiple subflows	2023-09-18 12:47:55 +01:00
pm.c	mptcp: drop last_snd and MPTCP_RESET_SCHEDULER	2023-08-22 17:31:18 -07:00
pm_netlink.c	mptcp: drop last_snd and MPTCP_RESET_SCHEDULER	2023-08-22 17:31:18 -07:00
pm_userspace.c	mptcp: userspace pm allow creating id 0 subflow	2023-10-05 09:34:32 -07:00
protocol.c	mptcp: fix delegated action races	2023-10-05 09:34:31 -07:00
protocol.h	mptcp: fix delegated action races	2023-10-05 09:34:31 -07:00
sched.c	mptcp: register default scheduler	2023-08-22 17:31:19 -07:00
sockopt.c	inet: lock the socket in ip_sock_set_tos()	2023-10-19 13:13:13 +02:00
subflow.c	mptcp: fix delegated action races	2023-10-05 09:34:31 -07:00
syncookies.c
token.c
token_test.c