CVE-2024-47684

In the Linux kernel, the following vulnerability has been resolved:

tcp: check skb is non-NULL in tcp_rto_delta_us()

We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic

kernel that are running ceph and recently hit a null ptr dereference in

tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also

saw it getting hit from the RACK case as well. Here are examples of the oops

messages we saw in each of those cases:

Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020

Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode

Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page

Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0

Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI

Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu

Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023

Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160

Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3

Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246

Jul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000

Jul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60

Jul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8

Jul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900

Jul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30

Jul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000

Jul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Jul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0

Jul 26 15:05:02 rx [11061395.913822] PKRU: 55555554

Jul 26 15:05:02 rx [11061395.916786] Call Trace:

Jul 26 15:05:02 rx [11061395.919488]

Jul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f

Jul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9

Jul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380

Jul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0

Jul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50

Jul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0

Jul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20

Jul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450

Jul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140

Jul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90

Jul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0

Jul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40

Jul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160

Jul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160

Jul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220

Jul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240

Jul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0

Jul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240

Jul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130

Jul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280

Jul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10

Jul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30

Jul 26 15:05:02 rx [11061396.017718] ? lapic_next_even

---truncated---