• Florian Westphal's avatar
    mptcp: handle tcp fallback when using syn cookies · ae2dd716
    Florian Westphal authored
    We can't deal with syncookie mode yet, the syncookie rx path will create
    tcp reqsk, i.e. we get OOB access because we treat tcp reqsk as mptcp reqsk one:
    
    TCP: SYN flooding on port 20002. Sending cookies.
    BUG: KASAN: slab-out-of-bounds in subflow_syn_recv_sock+0x451/0x4d0 net/mptcp/subflow.c:191
    Read of size 1 at addr ffff8881167bc148 by task syz-executor099/2120
     subflow_syn_recv_sock+0x451/0x4d0 net/mptcp/subflow.c:191
     tcp_get_cookie_sock+0xcf/0x520 net/ipv4/syncookies.c:209
     cookie_v6_check+0x15a5/0x1e90 net/ipv6/syncookies.c:252
     tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1123 [inline]
     [..]
    
    Bug can be reproduced via "sysctl net.ipv4.tcp_syncookies=2".
    
    Note that MPTCP should work with syncookies (4th ack would carry needed
    state), but it appears better to sort that out in -next so do tcp
    fallback for now.
    
    I removed the MPTCP ifdef for tcp_rsk "is_mptcp" member because
    if (IS_ENABLED()) is easier to read than "#ifdef IS_ENABLED()/#endif" pair.
    
    Cc: Eric Dumazet <edumazet@google.com>
    Fixes: cec37a6e ("mptcp: Handle MP_CAPABLE options for outgoing connections")
    Reported-by: default avatarChristoph Paasch <cpaasch@apple.com>
    Tested-by: default avatarChristoph Paasch <cpaasch@apple.com>
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    ae2dd716
syncookies.c 7.18 KB