In the Linux kernel, the following vulnerability has been resolved:
tcp: tcprtxsynack() can be called from process context
Laurent reported the enclosed report [1]
This bug triggers with following coditions:
0) Kernel built with CONFIGDEBUGPREEMPT=y
1) A new passive FastOpen TCP socket is created. This FO socket waits for an ACK coming from client to be a complete ESTABLISHED one. 2) A socket operation on this socket goes through locksock() releasesock() dance. 3) While the socket is owned by the user in step 2), a retransmit of the SYN is received and stored in socket backlog. 4) At releasesock() time, the socket backlog is processed while in process context. 5) A SYNACK packet is cooked in response of the SYN retransmit. 6) -> tcprtx_synack() is called in process context.
Before blamed commit, tcprtxsynack() was always called from BH handler, from a timer handler.
Fix this by using TCPINCSTATS() & NETINCSTATS() which do not assume caller is in non preemptible context.
[1] BUG: using _thiscpuadd() in preemptible [00000000] code: epollpep/2180 caller is tcprtxsynack.part.0+0x36/0xc0 CPU: 10 PID: 2180 Comm: epollpep Tainted: G OE 5.16.0-0.bpo.4-amd64 #1 Debian 5.16.12-1~bpo11+1 Hardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021 Call Trace: <TASK> dumpstacklvl+0x48/0x5e checkpreemptiondisabled+0xde/0xe0 tcprtxsynack.part.0+0x36/0xc0 tcprtxsynack+0x8d/0xa0 ? kmemcachealloc+0x2e0/0x3e0 ? apparmorfileallocsecurity+0x3b/0x1f0 inetrtxsynack+0x16/0x30 tcpcheckreq+0x367/0x610 tcprcvstateprocess+0x91/0xf60 ? getnohztimertarget+0x18/0x1a0 ? locktimerbase+0x61/0x80 ? preemptcountadd+0x68/0xa0 tcpv4dorcv+0xbd/0x270 _releasesock+0x6d/0xb0 releasesock+0x2b/0x90 socksetsockopt+0x138/0x1140 ? _sysgetsockname+0x7e/0xc0 ? aaskperm+0x3e/0x1a0 _syssetsockopt+0x198/0x1e0 _x64syssetsockopt+0x21/0x30 dosyscall64+0x38/0xc0 entrySYSCALL64after_hwframe+0x44/0xae
[
{
"id": "CVE-2022-49372-032745b0",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdc28a8fb43cc476e33b11519235adb816ce00e8",
"deprecated": false,
"digest": {
"line_hashes": [
"80848074839259274654163193122027928498",
"318332182713465107409157452379825512578",
"326791057706130069686499378610556507268",
"141634432606236919329841019361485630845",
"110306263066312305432526165119102316919"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49372-07f433f6",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58bd38cbc961fd799842b7be8c5222310f04b908",
"deprecated": false,
"digest": {
"line_hashes": [
"243191650961846020418248936935660804129",
"62139448687278271349422714398147328712",
"326791057706130069686499378610556507268",
"141634432606236919329841019361485630845",
"110306263066312305432526165119102316919"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49372-457862fa",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a0f7f84148445c9f02f226928803a870139d820",
"deprecated": false,
"digest": {
"line_hashes": [
"80848074839259274654163193122027928498",
"318332182713465107409157452379825512578",
"326791057706130069686499378610556507268",
"141634432606236919329841019361485630845",
"110306263066312305432526165119102316919"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49372-99415319",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d05c2fdf8e10528bb6751bd95243e862d5402a9b",
"deprecated": false,
"digest": {
"line_hashes": [
"243191650961846020418248936935660804129",
"62139448687278271349422714398147328712",
"326791057706130069686499378610556507268",
"141634432606236919329841019361485630845",
"110306263066312305432526165119102316919"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49372-bbf5795e",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88cd232146207ff1d41dededed5e77c0d4438113",
"deprecated": false,
"digest": {
"line_hashes": [
"80848074839259274654163193122027928498",
"318332182713465107409157452379825512578",
"326791057706130069686499378610556507268",
"141634432606236919329841019361485630845",
"110306263066312305432526165119102316919"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49372-c07196fb",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3db889f883e65bbd3b1401279bfc1e9ed255c481",
"deprecated": false,
"digest": {
"line_hashes": [
"243191650961846020418248936935660804129",
"62139448687278271349422714398147328712",
"326791057706130069686499378610556507268",
"141634432606236919329841019361485630845",
"91562483565185982913632922310492446965"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49372-c812f67c",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c348b0f8d035fc4bdc040796889beec7218bd1b8",
"deprecated": false,
"digest": {
"line_hashes": [
"243191650961846020418248936935660804129",
"62139448687278271349422714398147328712",
"326791057706130069686499378610556507268",
"141634432606236919329841019361485630845",
"91562483565185982913632922310492446965"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49372-c89ea194",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a375c822497ed6ad6b5da0792a12a6f1af10c0b",
"deprecated": false,
"digest": {
"line_hashes": [
"80848074839259274654163193122027928498",
"318332182713465107409157452379825512578",
"326791057706130069686499378610556507268",
"141634432606236919329841019361485630845",
"110306263066312305432526165119102316919"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2022-49372-e40cd21f",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8e1bc6029acac796293310aacef7b7336f35b6a",
"deprecated": false,
"digest": {
"line_hashes": [
"80848074839259274654163193122027928498",
"318332182713465107409157452379825512578",
"326791057706130069686499378610556507268",
"141634432606236919329841019361485630845",
"110306263066312305432526165119102316919"
],
"threshold": 0.9
},
"signature_type": "Line"
}
]