[Bug 297006] a bad server SYN packet can crash a rack/fastopen client

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297006

            Bug ID: 297006
           Summary: a bad server SYN packet can crash a rack/fastopen
                    client
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: [email protected]
          Reporter: [email protected]
 Attachment #273122 text/plain
         mime type:

Created attachment 273122
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273122&action=edit
tickle a crash in rack_setup_offset_for_rsm()

I've attached a demo that replies to a RACK/fastopen client with a
packet with TCP flags of just SYN instead of SYN+ACK. It causes a
non-INVARIANTS client to crash in rack_setup_offset_for_rsm() because
this call returns NULL:

        src_rsm->m = sbsndmbuf(&rack->rc_inp->inp_socket->so_snd,
                               (src_rsm->r_start - rack->rc_tp->snd_una),
                               &src_rsm->soff);

With INVARIANTS, this fails:

                KASSERT((m != NULL),
                      ("rsm:%p nrsm:%p hit at soff:%u null m",
                       src_rsm, rsm, soff));

# uname -a
FreeBSD xxx 16.0-CURRENT FreeBSD 16.0-CURRENT #37 main-n275529-da69298e9825:
Fri Jul 17 07:08:15 AST 2026    
root@xxx:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# cc tcp19a.c
# ./a.out
Kernel page fault with the following non-sleepable locks held:
exclusive rw tcpinp (tcpinp) r = 0 (0xfffff8001c2e3030) locked @
/usr/src/sys/ne
tinet/in_pcb.c:1528
Kernel page fault with 1 sleep inhibitors
stack backtrace:
#0 0xffffffff80c8f79c at witness_debugger+0x6c
#1 0xffffffff80c9109c at witness_warn+0x4bc
#2 0xffffffff811dd7f7 at trap_pfault+0x97
#3 0xffffffff811abde8 at calltrap+0x8
#4 0xffffffff82e3dfa8 at rack_update_entry+0x88
#5 0xffffffff82e2a385 at rack_log_output+0x195
#6 0xffffffff82e1b909 at rack_output+0x4929
#7 0xffffffff82e200f0 at rack_do_segment_nounlock+0x2af0
#8 0xffffffff82e1d582 at rack_do_segment+0x102
#9 0xffffffff80e6b062 at tcp_input_with_port+0x1232
#10 0xffffffff80e6bcdb at tcp_input+0xb
#11 0xffffffff80e58648 at ip_input+0x298
#12 0xffffffff80d8b5df at netisr_dispatch_src+0xbf
#13 0xffffffff80d6c65a at ether_demux+0x17a
#14 0xffffffff80d6dc7a at ether_nh_input+0x3ea
#15 0xffffffff80d8b5df at netisr_dispatch_src+0xbf
#16 0xffffffff80d6cac9 at ether_input+0xe9
#17 0xffffffff80d72e58 at tunwrite+0x588

Fatal trap 12: page fault while in kernel mode
cpuid = 8; apic id = 08
fault virtual address   = 0x18
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff82e2d0f2
stack pointer           = 0x28:0xfffffe00d7167260
frame pointer           = 0x28:0xfffffe00d7167280
processor eflags        = interrupt enabled, resume, IOPL = 0
current thread          = 705/100171 (a.out/a.out)
rdi: 0000000000000000 rsi: 0000000000000001 rdx: fffff8005bbc21c0
rcx: 0000000000000000  r8: 0000000000000000  r9: 0000000000000000
rax: 0000000000000000 rbx: fffff8005bbc2180 rbp: fffffe00d7167280
r10: fffffe00d7167150 r11: 000001ff28fff5d1 r12: fffff8005b3cadc0
r13: 00000000ce05dfbf r14: fffffe01257db980 r15: fffff8005b3cad80
panic: page fault
cpuid = 8
time = 1784804795
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x36/frame 0xfffffe00d7166f90
vpanic() at vpanic+0x149/frame 0xfffffe00d71670c0
panic() at panic+0x43/frame 0xfffffe00d7167120
trap_pfault() at trap_pfault+0x449/frame 0xfffffe00d7167190
calltrap() at calltrap+0x8/frame 0xfffffe00d7167190
--- trap 0xc, rip = 0xffffffff82e2d0f2, rsp = 0xfffffe00d7167260, rbp =
0xfffffe00d7167280 ---
rack_setup_offset_for_rsm() at rack_setup_offset_for_rsm+0x1c2/frame
0xfffffe00d7167280
rack_update_entry() at rack_update_entry+0x88/frame 0xfffffe00d71672e0
rack_log_output() at rack_log_output+0x195/frame 0xfffffe00d7167380
rack_output() at rack_output+0x4929/frame 0xfffffe00d71676c0
rack_do_segment_nounlock() at rack_do_segment_nounlock+0x2af0/frame
0xfffffe00d7167880
rack_do_segment() at rack_do_segment+0x102/frame 0xfffffe00d71678f0
tcp_input_with_port() at tcp_input_with_port+0x1232/frame 0xfffffe00d7167a40
tcp_input() at tcp_input+0xb/frame 0xfffffe00d7167a50
ip_input() at ip_input+0x298/frame 0xfffffe00d7167ab0
netisr_dispatch_src() at netisr_dispatch_src+0xbf/frame 0xfffffe00d7167b10
ether_demux() at ether_demux+0x17a/frame 0xfffffe00d7167b50
ether_nh_input() at ether_nh_input+0x3ea/frame 0xfffffe00d7167ba0
netisr_dispatch_src() at netisr_dispatch_src+0xbf/frame 0xfffffe00d7167c00
ether_input() at ether_input+0xe9/frame 0xfffffe00d7167c60
tunwrite() at tunwrite+0x588/frame 0xfffffe00d7167cd0
devfs_write_f() at devfs_write_f+0xfe/frame 0xfffffe00d7167d30
dofilewrite() at dofilewrite+0x82/frame 0xfffffe00d7167d80
sys_write() at sys_write+0x132/frame 0xfffffe00d7167df0
amd64_syscall() at amd64_syscall+0x17c/frame 0xfffffe00d7167f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d7167f30
--- syscall (4, FreeBSD ELF64, write), rip = 0x80073072a, rsp = 0x7fffffffd7e8,

-- 
You are receiving this mail because:
You are the assignee for the bug.