From patchwork Thu Jan 26 18:54:52 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1732438 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=wUYsDYVN; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4P2qf93ldmz23gY for ; Fri, 27 Jan 2023 05:55:29 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1pL7P8-0007Ne-Q1; Thu, 26 Jan 2023 18:55:22 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1pL7P6-0007MH-Vc for kernel-team@lists.ubuntu.com; Thu, 26 Jan 2023 18:55:20 +0000 Received: from quatroqueijos.. (unknown [179.93.156.234]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id D4D353FDA3 for ; Thu, 26 Jan 2023 18:55:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1674759320; bh=ikE/iMuuGgyulrEtLmiVnSRp+/UtfsJB69TQe12NtfI=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=wUYsDYVNT6aeP1Buj/62R3edlICEZ0dn2CjEyGHgaFr0bdRml0yImq1zk4GVcb4cd r56GI8vSyppU/FJNJwzy6cefBTVVHAyP5n/uKahJzQpP2VUQ3ruKYF3Em5RTYUq/+B QAswXeFfvpi58OEyL3OOExY8/PFsmxOrh8xyrDJeiIlCyeIbqExsf8xcBRLGYe5rrR DFD/WazmY+jjVvaG8fIZJOQR3lu+OtJb0CsV6SMro1kP69Z2TZLiJnbjx5ChYLBbcD QGXk/gJtWeEgt4O1hNwTKPE024/0wY/3U8XJBb7Mq+aX1TcoSCsaSnJ7VD/efuz1E6 O7iCxs0grQgsA== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [UBUNTU OEM-5.14/Jammy 1/2] net/ulp: prevent ULP without clone op from entering the LISTEN status Date: Thu, 26 Jan 2023 15:54:52 -0300 Message-Id: <20230126185456.986615-3-cascardo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230126185456.986615-1-cascardo@canonical.com> References: <20230126185456.986615-1-cascardo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Paolo Abeni When an ULP-enabled socket enters the LISTEN status, the listener ULP data pointer is copied inside the child/accepted sockets by sk_clone_lock(). The relevant ULP can take care of de-duplicating the context pointer via the clone() operation, but only MPTCP and SMC implement such op. Other ULPs may end-up with a double-free at socket disposal time. We can't simply clear the ULP data at clone time, as TLS replaces the socket ops with custom ones assuming a valid TLS ULP context is available. Instead completely prevent clone-less ULP sockets from entering the LISTEN status. Fixes: 734942cc4ea6 ("tcp: ULP infrastructure") Reported-by: slipper Signed-off-by: Paolo Abeni Link: https://lore.kernel.org/r/4b80c3d1dbe3d0ab072f80450c202d9bc88b4b03.1672740602.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski (backported from commit 2c02d41d71f90a5168391b6a5f2954112ba2307c) [cascardo: there is no SOCK_SUPPORT_ZC] [cascardo: backlog parameter on inet_csk_listen_start was removed] CVE-2023-0461 Signed-off-by: Thadeu Lima de Souza Cascardo --- net/ipv4/inet_connection_sock.c | 14 ++++++++++++++ net/ipv4/tcp_ulp.c | 4 ++++ 2 files changed, 18 insertions(+) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index a53f9bf7886f..eb04214bd648 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -1036,12 +1036,26 @@ void inet_csk_prepare_forced_close(struct sock *sk) } EXPORT_SYMBOL(inet_csk_prepare_forced_close); +static int inet_ulp_can_listen(const struct sock *sk) +{ + const struct inet_connection_sock *icsk = inet_csk(sk); + + if (icsk->icsk_ulp_ops && !icsk->icsk_ulp_ops->clone) + return -EINVAL; + + return 0; +} + int inet_csk_listen_start(struct sock *sk, int backlog) { struct inet_connection_sock *icsk = inet_csk(sk); struct inet_sock *inet = inet_sk(sk); int err = -EADDRINUSE; + err = inet_ulp_can_listen(sk); + if (unlikely(err)) + return err; + reqsk_queue_alloc(&icsk->icsk_accept_queue); sk->sk_ack_backlog = 0; diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c index 7c27aa629af1..b5d707a5a31b 100644 --- a/net/ipv4/tcp_ulp.c +++ b/net/ipv4/tcp_ulp.c @@ -136,6 +136,10 @@ static int __tcp_set_ulp(struct sock *sk, const struct tcp_ulp_ops *ulp_ops) if (icsk->icsk_ulp_ops) goto out_err; + err = -EINVAL; + if (!ulp_ops->clone && sk->sk_state == TCP_LISTEN) + goto out_err; + err = ulp_ops->init(sk); if (err) goto out_err; From patchwork Thu Jan 26 18:54:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1732442 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=FHEKdyJM; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4P2qfY16Spz23gY for ; Fri, 27 Jan 2023 05:55:49 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1pL7PS-0007iU-Rr; Thu, 26 Jan 2023 18:55:42 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1pL7PQ-0007gS-U9 for kernel-team@lists.ubuntu.com; Thu, 26 Jan 2023 18:55:40 +0000 Received: from quatroqueijos.. (unknown [179.93.156.234]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id B5E333FDA3 for ; Thu, 26 Jan 2023 18:55:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1674759340; bh=gWEf8zZMNpOMV7niiI47CI8vYltlLEFnE90PBIz2YU0=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=FHEKdyJMdJsVrw08IZbEgB+RcrefsGnP31SKI+JS6HexWXdSrLNPLWp/jmno+PMF3 zIcf35BLLTzfEJg3kd+RXxf6TTsLaS96VrNPNtZ2uVhbps9dyFQNXYcoJCQoaJRwCb g1bs5gOw/k0gru2HFcBBvaKJQhwHbegPGS2JojWZ4I3dbP2r+oY9EDLlCyfXgFA+9e HU1VEawdUgphFDKQ7ag8+O7BsHzI6zoSGlARpXGl5kcJ835ExHhx38hkOs4bJQTb7i EIfU6UNxOrcllxzelDEeyQyV5XFJdoxrejeq1vv6jKtnIJ+20PnRumqCAcZz72yNRz wNDP5FO/Wj02g== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [UBUNTU OEM-5.14/Jammy/OEM-5.17 2/2] net/ulp: use consistent error code when blocking ULP Date: Thu, 26 Jan 2023 15:54:55 -0300 Message-Id: <20230126185456.986615-6-cascardo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230126185456.986615-1-cascardo@canonical.com> References: <20230126185456.986615-1-cascardo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Paolo Abeni The referenced commit changed the error code returned by the kernel when preventing a non-established socket from attaching the ktls ULP. Before to such a commit, the user-space got ENOTCONN instead of EINVAL. The existing self-tests depend on such error code, and the change caused a failure: RUN global.non_established ... tls.c:1673:non_established:Expected errno (22) == ENOTCONN (107) non_established: Test failed at step #3 FAIL global.non_established In the unlikely event existing applications do the same, address the issue by restoring the prior error code in the above scenario. Note that the only other ULP performing similar checks at init time - smc_ulp_ops - also fails with ENOTCONN when trying to attach the ULP to a non-established socket. Reported-by: Sabrina Dubroca Fixes: 2c02d41d71f9 ("net/ulp: prevent ULP without clone op from entering the LISTEN status") Signed-off-by: Paolo Abeni Reviewed-by: Sabrina Dubroca Link: https://lore.kernel.org/r/7bb199e7a93317fb6f8bf8b9b2dc71c18f337cde.1674042685.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski (backported from commit 8ccc99362b60c6f27bb46f36fdaaccf4ef0303de) [cascardo: there is no SOCK_SUPPORT_ZC] CVE-2023-0461 Signed-off-by: Thadeu Lima de Souza Cascardo --- net/ipv4/tcp_ulp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c index b5d707a5a31b..8e135af0d4f7 100644 --- a/net/ipv4/tcp_ulp.c +++ b/net/ipv4/tcp_ulp.c @@ -136,7 +136,7 @@ static int __tcp_set_ulp(struct sock *sk, const struct tcp_ulp_ops *ulp_ops) if (icsk->icsk_ulp_ops) goto out_err; - err = -EINVAL; + err = -ENOTCONN; if (!ulp_ops->clone && sk->sk_state == TCP_LISTEN) goto out_err;