Skip to content

Commit

Permalink
DO-NOT-MERGE: mptcp: use kmalloc on kasan build
Browse files Browse the repository at this point in the history
Helps detection UaF, which apparently kasan misses
with kmem_cache allocator.

We also need to always set the SOCK_RCU_FREE flag, to
preserved the current code leveraging SLAB_TYPESAFE_BY_RCU.
This latter change will make unreachable some existing
errors path, but I don't see other options.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  • Loading branch information
Paolo Abeni authored and matttbe committed Mar 15, 2022
1 parent e8d86b0 commit 4edee9a
Show file tree
Hide file tree
Showing 3 changed files with 20 additions and 2 deletions.
3 changes: 3 additions & 0 deletions net/ipv4/af_inet.c
Original file line number Diff line number Diff line change
Expand Up @@ -313,7 +313,10 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
answer_flags = answer->flags;
rcu_read_unlock();

#if !IS_ENABLED(CONFIG_KASAN)
/* with kasan we use kmalloc */
WARN_ON(!answer_prot->slab);
#endif

err = -ENOMEM;
sk = sk_alloc(net, PF_INET, GFP_KERNEL, answer_prot, kern);
Expand Down
3 changes: 3 additions & 0 deletions net/ipv6/af_inet6.c
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,10 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
answer_flags = answer->flags;
rcu_read_unlock();

#if !IS_ENABLED(CONFIG_KASAN)
/* with kasan we use kmalloc */
WARN_ON(!answer_prot->slab);
#endif

err = -ENOBUFS;
sk = sk_alloc(net, PF_INET6, GFP_KERNEL, answer_prot, kern);
Expand Down
16 changes: 14 additions & 2 deletions net/mptcp/protocol.c
Original file line number Diff line number Diff line change
Expand Up @@ -2566,6 +2566,10 @@ static int __mptcp_init_sock(struct sock *sk)
timer_setup(&msk->sk.icsk_retransmit_timer, mptcp_retransmit_timer, 0);
timer_setup(&sk->sk_timer, mptcp_timeout_timer, 0);

#if IS_ENABLED(CONFIG_KASAN)
sock_set_flag(sk, SOCK_RCU_FREE);
#endif

return 0;
}

Expand Down Expand Up @@ -2938,7 +2942,9 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
WRITE_ONCE(msk->rcv_wnd_sent, ack_seq);
}

#if !IS_ENABLED(CONFIG_KASAN)
sock_reset_flag(nsk, SOCK_RCU_FREE);
#endif
/* will be fully established after successful MPC subflow creation */
inet_sk_state_store(nsk, TCP_SYN_RECV);

Expand Down Expand Up @@ -3709,6 +3715,12 @@ static int mptcp_napi_poll(struct napi_struct *napi, int budget)
return work_done;
}

#if IS_ENABLED(CONFIG_KASAN)
#define MPTCP_USE_SLAB 0
#else
#define MPTCP_USE_SLAB 1
#endif

void __init mptcp_proto_init(void)
{
struct mptcp_delegated_action *delegated;
Expand All @@ -3732,7 +3744,7 @@ void __init mptcp_proto_init(void)
mptcp_pm_init();
mptcp_token_init();

if (proto_register(&mptcp_prot, 1) != 0)
if (proto_register(&mptcp_prot, MPTCP_USE_SLAB) != 0)
panic("Failed to register MPTCP proto.\n");

inet_register_protosw(&mptcp_protosw);
Expand Down Expand Up @@ -3792,7 +3804,7 @@ int __init mptcp_proto_v6_init(void)
mptcp_v6_prot.destroy = mptcp_v6_destroy;
mptcp_v6_prot.obj_size = sizeof(struct mptcp6_sock);

err = proto_register(&mptcp_v6_prot, 1);
err = proto_register(&mptcp_v6_prot, MPTCP_USE_SLAB);
if (err)
return err;

Expand Down

0 comments on commit 4edee9a

Please sign in to comment.