* Re: Any idea to fix the recursive call in tls_setsockopt?
[not found] <CAD-N9QW=ex-+gkwnJNw0eQjFCPcQ-awN_NH5OERjQfo-FC=z4A@mail.gmail.com>
@ 2021-10-02 12:52 ` Pavel Skripkin
0 siblings, 0 replies; only message in thread
From: Pavel Skripkin @ 2021-10-02 12:52 UTC (permalink / raw)
To: Dongliang Mu, Boris Pismenny, John Fastabend, Daniel Borkmann,
Jakub Kicinski, David S. Miller, Dan Carpenter
Cc: netdev, LKML
On 10/2/21 11:38, Dongliang Mu wrote:
[ +CC netdev, LKML ]
> BUG: stack guard page was hit at ffffc90000b87ff8 (stack is
> ffffc90000b88000..ffffc90000b8bfff)
> kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP
> RIP: 0010:tls_setsockopt+0xe/0x650 net/tls/tls_main.c:617
> Call Trace:
> tls_setsockopt+0x6a/0x650 net/tls/tls_main.c:621
> ......
> tls_setsockopt+0x6a/0x650 net/tls/tls_main.c:621
> tls_setsockopt+0x6a/0x650 net/tls/tls_main.c:621
> __sys_setsockopt+0x1b0/0x360 net/socket.c:2176
> __do_sys_setsockopt net/socket.c:2187 [inline]
> __se_sys_setsockopt net/socket.c:2184 [inline]
> __x64_sys_setsockopt+0x22/0x30 net/socket.c:2184
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> My local syzkaller instance finds this bug, however, I am not sure how
> to fix it. So I post the bug report here to seek help. The
> implementation of tls_setsockopt is as follows:
>
> static int tls_setsockopt(struct sock *sk, int level, int optname,
> sockptr_t optval, unsigned int optlen)
> {
> struct tls_context *ctx = tls_get_ctx(sk);
>
> if (level != SOL_TLS)
> return ctx->sk_proto->setsockopt(sk, level, optname, optval,
> optlen);
>
> return do_tls_setsockopt(sk, optname, optval, optlen);
> }
>
> Since I am not familiar with this part code, the fix in my mind is to
> do a sanity check on "ctx->sk_proto->setsockopt" and make sure it is
> not tls_setsockopt.
>
> Any comment here?
>
> --
> My best regards to you.
>
> No System Is Safe!
> Dongliang Mu
>
With regards,
Pavel Skripkin
^ permalink raw reply [flat|nested] only message in thread