From 5f5e01d186b2f72a29255dd0c0a93c35e25ae477 Mon Sep 17 00:00:00 2001 From: Nayana Bidari Date: Mon, 18 Mar 2024 10:48:39 -0700 Subject: [PATCH] Fix panic while setting TCP_CORK off. TCP sender is initialized only in established state, check if sender is available before disabling the TCP_CORK timer. Reported-by: syzbot+653ff342d39edb34a49c@syzkaller.appspotmail.com PiperOrigin-RevId: 616879762 --- pkg/tcpip/transport/tcp/endpoint.go | 4 +++- test/syscalls/linux/tcp_socket.cc | 9 +++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/pkg/tcpip/transport/tcp/endpoint.go b/pkg/tcpip/transport/tcp/endpoint.go index ba277f246..b59238110 100644 --- a/pkg/tcpip/transport/tcp/endpoint.go +++ b/pkg/tcpip/transport/tcp/endpoint.go @@ -1763,7 +1763,9 @@ func (e *endpoint) OnCorkOptionSet(v bool) { if !v { e.LockUser() defer e.UnlockUser() - e.snd.corkTimer.disable() + if e.snd != nil { + e.snd.corkTimer.disable() + } // Handle the corked data. if e.EndpointState().connected() { e.sendData(nil /* next */) diff --git a/test/syscalls/linux/tcp_socket.cc b/test/syscalls/linux/tcp_socket.cc index e0780eb24..8d6b7ff60 100644 --- a/test/syscalls/linux/tcp_socket.cc +++ b/test/syscalls/linux/tcp_socket.cc @@ -2696,6 +2696,15 @@ TEST_P(SimpleTcpSocketTest, EpollListeningSocket) { save_and_connect_thread.Join(); } +TEST_P(SimpleTcpSocketTest, SetTCPCorkOff) { + int fd; + ASSERT_THAT(fd = socket(GetParam(), SOCK_STREAM, IPPROTO_TCP), + SyscallSucceeds()); + + ASSERT_THAT( + setsockopt(fd, IPPROTO_TCP, TCP_CORK, &kSockOptOff, sizeof(kSockOptOff)), + SyscallSucceeds()); +} #endif // __linux__ INSTANTIATE_TEST_SUITE_P(AllInetTests, SimpleTcpSocketTest,