tcp: fix various issues for sockets morphing to listen state (02b2faaf) · Commits · 戴 / test

Dmitry Vyukov reported a divide by 0 triggered by syzkaller, exploiting tcp_disconnect() path that was never really considered and/or used before syzkaller ;) I was not able to reproduce the bug, but it seems issues here are the three possible actions that assumed they would never trigger on a listener. 1) tcp_write_timer_handler 2) tcp_delack_timer_handler 3) MTU reduction Only IPv6 MTU reduction was properly testing TCP_CLOSE and TCP_LISTEN states from tcp_v6_mtu_reduced() Signed-off-by:

Eric Dumazet <edumazet@google.com> Reported-by:

Dmitry Vyukov <dvyukov@google.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/tcp_ipv4.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -279,10 +279,13 @@ EXPORT_SYMBOL(tcp_v4_connect);
		*/
		void tcp_v4_mtu_reduced(struct sock *sk)
		{
		struct dst_entry *dst;
		struct inet_sock *inet = inet_sk(sk);
		u32 mtu = tcp_sk(sk)->mtu_info;
		struct dst_entry *dst;
		u32 mtu;

		if ((1 << sk->sk_state) & (TCPF_LISTEN \| TCPF_CLOSE))
		return;
		mtu = tcp_sk(sk)->mtu_info;
		dst = inet_csk_update_pmtu(sk, mtu);
		if (!dst)
		return;

net/ipv4/tcp_timer.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -249,7 +249,8 @@ void tcp_delack_timer_handler(struct sock *sk)

		sk_mem_reclaim_partial(sk);

		if (sk->sk_state == TCP_CLOSE \|\| !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
		if (((1 << sk->sk_state) & (TCPF_CLOSE \| TCPF_LISTEN)) \|\|
		!(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
		goto out;

		if (time_after(icsk->icsk_ack.timeout, jiffies)) {
		@@ -552,7 +553,8 @@ void tcp_write_timer_handler(struct sock *sk)
		struct inet_connection_sock *icsk = inet_csk(sk);
		int event;

		if (sk->sk_state == TCP_CLOSE \|\| !icsk->icsk_pending)
		if (((1 << sk->sk_state) & (TCPF_CLOSE \| TCPF_LISTEN)) \|\|
		!icsk->icsk_pending)
		goto out;

		if (time_after(icsk->icsk_timeout, jiffies)) {

Admin message