WSL2-Linux-Kernel/net/mptcp
Mat Martineau 0c3f34beb4 mptcp: Correctly set DATA_FIN timeout when number of retransmits is large
commit 877d11f033 upstream.

Syzkaller with UBSAN uncovered a scenario where a large number of
DATA_FIN retransmits caused a shift-out-of-bounds in the DATA_FIN
timeout calculation:

================================================================================
UBSAN: shift-out-of-bounds in net/mptcp/protocol.c:470:29
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 1 PID: 13059 Comm: kworker/1:0 Not tainted 5.17.0-rc2-00630-g5fbf21c90c60 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: events mptcp_worker
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds.cold+0xb2/0x20e lib/ubsan.c:330
 mptcp_set_datafin_timeout net/mptcp/protocol.c:470 [inline]
 __mptcp_retrans.cold+0x72/0x77 net/mptcp/protocol.c:2445
 mptcp_worker+0x58a/0xa70 net/mptcp/protocol.c:2528
 process_one_work+0x9df/0x16d0 kernel/workqueue.c:2307
 worker_thread+0x95/0xe10 kernel/workqueue.c:2454
 kthread+0x2f4/0x3b0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
================================================================================

This change limits the maximum timeout by limiting the size of the
shift, which keeps all intermediate values in-bounds.

Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/259
Fixes: 6477dd39e6 ("mptcp: Retransmit DATA_FIN")
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-03-08 19:12:48 +01:00
..
Kconfig kunit: mptcp: adhere to KUNIT formatting standard 2021-04-16 17:10:40 -07:00
Makefile kunit: mptcp: adhere to KUNIT formatting standard 2021-04-16 17:10:40 -07:00
crypto.c kunit: mptcp: adhere to KUNIT formatting standard 2021-04-16 17:10:40 -07:00
crypto_test.c mptcp: move crypto test to KUNIT 2020-06-26 16:21:39 -07:00
ctrl.c mptcp: faster active backup recovery 2021-08-14 11:37:25 +01:00
diag.c mptcp: allow dumping subflow context to userspace 2020-03-29 22:14:48 -07:00
mib.c mptcp: add mibs counter for ignored incoming options 2022-03-02 11:47:53 +01:00
mib.h mptcp: add mibs counter for ignored incoming options 2022-03-02 11:47:53 +01:00
mptcp_diag.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00
options.c mptcp: fix a DSS option writing error 2022-01-27 11:03:59 +01:00
pm.c mptcp: add mibs counter for ignored incoming options 2022-03-02 11:47:53 +01:00
pm_netlink.c mptcp: fix race in incoming ADD_ADDR option processing 2022-03-02 11:47:52 +01:00
protocol.c mptcp: Correctly set DATA_FIN timeout when number of retransmits is large 2022-03-08 19:12:48 +01:00
protocol.h mptcp: use delegate action to schedule 3rd ack retrans 2021-12-01 09:04:49 +01:00
sockopt.c mptcp: remove tcp ulp setsockopt support 2021-12-22 09:32:43 +01:00
subflow.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00
syncookies.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00
token.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00
token_test.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00