Public bug reported:
[Impact]
IPv4 TCP sockets can free IP options while another CPU is still using
them to build a SYN-ACK. A retransmitted SYN can trigger this race when
the child socket owning the options is destroyed.
A similar race exists during TCP request-socket migration: the original
request and its clone share IP options, which can be freed while another
CPU is still reading them. These races can cause a use-after-free in
ip_options_build(), potentially crashing the kernel.
[Fix]
Use kfree_rcu() instead of kfree() in inet_sock_destruct() and
tcp_v4_reqsk_destructor(). Existing RCU-protected readers can then finish
before the IP options are freed.
Upstream commit:
e3f33b0a1d89d738e2b913dab519226eaf76e15b
("ipv4: free inet_opt and ireq_opt after an RCU grace period")
Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting
SYN+ACKs.")
** Affects: linux-nvidia-bos (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172774
Title:
ipv4: free inet_opt and ireq_opt after an RCU grace period
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-nvidia-bos/+bug/2172774/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
