lkml.org 
[lkml]   [2021]   [Oct]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: Any idea to fix the recursive call in tls_setsockopt?
From
On 10/2/21 11:38, Dongliang Mu wrote:

[ +CC netdev, LKML ]

> BUG: stack guard page was hit at ffffc90000b87ff8 (stack is
> ffffc90000b88000..ffffc90000b8bfff)
> kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP
> RIP: 0010:tls_setsockopt+0xe/0x650 net/tls/tls_main.c:617
> Call Trace:
> tls_setsockopt+0x6a/0x650 net/tls/tls_main.c:621
> ......
> tls_setsockopt+0x6a/0x650 net/tls/tls_main.c:621
> tls_setsockopt+0x6a/0x650 net/tls/tls_main.c:621
> __sys_setsockopt+0x1b0/0x360 net/socket.c:2176
> __do_sys_setsockopt net/socket.c:2187 [inline]
> __se_sys_setsockopt net/socket.c:2184 [inline]
> __x64_sys_setsockopt+0x22/0x30 net/socket.c:2184
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> My local syzkaller instance finds this bug, however, I am not sure how
> to fix it. So I post the bug report here to seek help. The
> implementation of tls_setsockopt is as follows:
>
> static int tls_setsockopt(struct sock *sk, int level, int optname,
> sockptr_t optval, unsigned int optlen)
> {
> struct tls_context *ctx = tls_get_ctx(sk);
>
> if (level != SOL_TLS)
> return ctx->sk_proto->setsockopt(sk, level, optname, optval,
> optlen);
>
> return do_tls_setsockopt(sk, optname, optval, optlen);
> }
>
> Since I am not familiar with this part code, the fix in my mind is to
> do a sanity check on "ctx->sk_proto->setsockopt" and make sure it is
> not tls_setsockopt.
>
> Any comment here?
>
> --
> My best regards to you.
>
> No System Is Safe!
> Dongliang Mu
>


With regards,
Pavel Skripkin

\
 
 \ /
  Last update: 2021-10-02 14:53    [W:0.060 / U:0.012 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site