Paolo Abeni a66805c9b2 mptcp: error out earlier on disconnect ... [ Upstream commit 581302298524e9d77c4c44ff5156a6cd112227ae ] Eric reported a division by zero splat in the MPTCP protocol: Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 6094 Comm: syz-executor317 Not tainted 6.12.0-rc5-syzkaller-00291-g05b92660cdfe #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__tcp_select_window+0x5b4/0x1310 net/ipv4/tcp_output.c:3163 Code: f6 44 01 e3 89 df e8 9b 75 09 f8 44 39 f3 0f 8d 11 ff ff ff e8 0d 74 09 f8 45 89 f4 e9 04 ff ff ff e8 00 74 09 f8 44 89 f0 99 <f7> 7c 24 14 41 29 d6 45 89 f4 e9 ec fe ff ff e8 e8 73 09 f8 48 89 RSP: 0018:ffffc900041f7930 EFLAGS: 00010293 RAX: 0000000000017e67 RBX: 0000000000017e67 RCX: ffffffff8983314b RDX: 0000000000000000 RSI: ffffffff898331b0 RDI: 0000000000000004 RBP: 00000000005d6000 R08: 0000000000000004 R09: 0000000000017e67 R10: 0000000000003e80 R11: 0000000000000000 R12: 0000000000003e80 R13: ffff888031d9b440 R14: 0000000000017e67 R15: 00000000002eb000 FS: 00007feb5d7f16c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007feb5d8adbb8 CR3: 0000000074e4c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __tcp_cleanup_rbuf+0x3e7/0x4b0 net/ipv4/tcp.c:1493 mptcp_rcv_space_adjust net/mptcp/protocol.c:2085 [inline] mptcp_recvmsg+0x2156/0x2600 net/mptcp/protocol.c:2289 inet_recvmsg+0x469/0x6a0 net/ipv4/af_inet.c:885 sock_recvmsg_nosec net/socket.c:1051 [inline] sock_recvmsg+0x1b2/0x250 net/socket.c:1073 __sys_recvfrom+0x1a5/0x2e0 net/socket.c:2265 __do_sys_recvfrom net/socket.c:2283 [inline] __se_sys_recvfrom net/socket.c:2279 [inline] __x64_sys_recvfrom+0xe0/0x1c0 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7feb5d857559 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007feb5d7f1208 EFLAGS: 00000246 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 00007feb5d8e1318 RCX: 00007feb5d857559 RDX: 000000800000000e RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007feb5d8e1310 R08: 0000000000000000 R09: ffffffff81000000 R10: 0000000000000100 R11: 0000000000000246 R12: 00007feb5d8e131c R13: 00007feb5d8ae074 R14: 000000800000000e R15: 00000000fffffdef and provided a nice reproducer. The root cause is the current bad handling of racing disconnect. After the blamed commit below, sk_wait_data() can return (with error) with the underlying socket disconnected and a zero rcv_mss. Catch the error and return without performing any additional operations on the current socket. Reported-by: Eric Dumazet <edumazet@google.com> Fixes: 419ce133ab ("tcp: allow again tcp_disconnect() when threads are waiting") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/8c82ecf71662ecbc47bf390f9905de70884c9f2d.1731060874.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-11-22 15:38:31 +01:00
..
6lowpan
9p	9p: fix slab cache name creation for real	2024-11-17 15:08:59 +01:00
802
8021q	net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb	2024-05-17 12:02:07 +02:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:01:50 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:01:48 +01:00
ax25	ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()	2024-06-21 14:38:14 +02:00
batman-adv	batman-adv: Don't accept TT entries for out-of-spec VIDs	2024-07-05 09:34:04 +02:00
bluetooth	Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs	2024-11-08 16:28:19 +01:00
bpf	bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled	2024-11-08 16:28:19 +01:00
bpfilter	net: Use umd_cleanup_helper()	2023-05-31 13:06:57 +02:00
bridge	bridge: Handle error of rtnl_register_module().	2024-10-17 15:24:29 +02:00
caif	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
can	can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().	2024-10-04 16:28:58 +02:00
ceph	libceph: init the cursor when preparing sparse read in msgr2	2024-10-17 15:24:10 +02:00
core	bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6	2024-11-17 15:08:57 +01:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-01 21:07:46 -07:00
dccp	tcp/dccp: do not care about families in inet_twsk_purge()	2024-08-29 17:33:46 +02:00
devlink	devlink: fix port new reply cmd type	2024-03-26 18:20:11 -04:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:35:41 -08:00
dsa	net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events	2024-10-10 11:58:07 +02:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:32:46 +02:00
ethtool	ethtool: check device is present when getting link settings	2024-09-04 13:28:26 +02:00
handshake	net/handshake: Fix handshake_req_destroy_test1	2024-02-23 09:24:50 +01:00
hsr	hsr: Simplify code for announcing HSR nodes timer setup	2024-05-17 12:02:24 +02:00
ieee802154	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:42:30 +00:00
ipv4	xfrm: respect ip protocols rules criteria when performing dst lookups	2024-11-01 01:58:28 +01:00
ipv6	netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()	2024-11-08 16:28:19 +01:00
iucv	s390/iucv: fix receive buffer virtual vs physical address confusion	2024-08-29 17:33:39 +02:00
kcm	kcm: Serialise kcm_sendmsg() for the same socket.	2024-08-29 17:33:46 +02:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-18 12:44:56 -07:00
l2tp	genetlink: hold RCU in genlmsg_mcast()	2024-11-01 01:58:23 +01:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-02-05 20:14:36 +00:00
mac80211	Revert "wifi: mac80211: fix RCU list iterations"	2024-11-14 13:19:38 +01:00
mac802154	mac802154: Fix potential RCU dereference issue in mac802154_scan_worker	2024-10-10 11:57:59 +02:00
mctp	mctp: Handle error of rtnl_register_module().	2024-10-17 15:24:29 +02:00
mpls	mpls: Handle error of rtnl_register_module().	2024-10-17 15:24:30 +02:00
mptcp	mptcp: error out earlier on disconnect	2024-11-22 15:38:31 +01:00
ncsi	net/ncsi: Fix the multi thread manner of NCSI driver	2024-06-21 14:38:14 +02:00
netfilter	netfilter: nf_tables: wait for rcu grace period on net_device removal	2024-11-14 13:19:32 +01:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:35:14 -08:00
netlink	netlink: terminate outstanding dump on socket close	2024-11-22 15:38:30 +01:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-06-27 13:49:06 +02:00
nfc	nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies	2024-08-19 06:04:28 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 12:02:02 +02:00
openvswitch	net: ovs: fix ovs_drop_reasons error	2024-08-29 17:33:50 +02:00
packet	af_packet: Handle outgoing VLAN packets without hardware offloading	2024-08-03 08:54:13 +02:00
phonet	phonet: Handle error of rtnl_register_module().	2024-10-17 15:24:30 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:45:10 +01:00
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-10-04 16:29:41 +02:00
rds	net:rds: Fix possible deadlock in rds_message_put	2024-08-19 06:04:27 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:42:41 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:42:31 +00:00
rxrpc	rxrpc: Fix missing locking causing hanging calls	2024-11-14 13:19:32 +01:00
sched	net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT	2024-11-08 16:28:18 +01:00
sctp	sctp: fix possible UAF in sctp_v6_available()	2024-11-22 15:38:30 +01:00
smc	net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid	2024-11-01 01:58:22 +01:00
strparser
sunrpc	sunrpc: handle -ENOTCONN in xs_tcp_setup_socket()	2024-11-14 13:19:30 +01:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-03-01 13:35:06 +01:00
tipc	tipc: guard against string buffer overrun	2024-10-10 11:57:25 +02:00
tls	tls: fix missing memory barrier in tls_init	2024-06-12 11:12:50 +02:00
unix	af_unix: Remove put_pid()/put_cred() in copy_peercred().	2024-09-12 11:11:29 +02:00
vmw_vsock	vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans	2024-11-14 13:19:41 +01:00
wireless	wifi: cfg80211: clear wdev->cqm_config pointer on free	2024-11-08 16:28:23 +01:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:19:41 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-04-17 11:19:28 +02:00
xfrm	xfrm: validate new SA's prefixlen using SA family when sel.family is unset	2024-11-01 01:58:34 +01:00
compat.c
devres.c
Kconfig	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
Kconfig.debug
Makefile
socket.c	net: explicitly clear the sk pointer, when pf->create fails	2024-10-17 15:24:35 +02:00
sysctl_net.c	sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)	2024-08-11 12:47:13 +02:00