syzkaller: BUG: unable to handle kernel NULL pointer dereference in `mptcp_stream_accept`

[cpaasch]

syzkaller-id: cb2ba204f0fc83b81b1f2fddce6a3bd2e98daab2

HEAD: dc7b257

Trace:

TCP: request_sock_subflow_v6: Possible SYN flooding on port [::1]:20003. Sending cookies.
BUG: kernel NULL pointer dereference, address: 0000000000000012
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 5a4ca067 P4D 5a4ca067 PUD 37d4c067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP
CPU: 2 PID: 10955 Comm: syz-executor.5 Not tainted 6.5.0-rc1-gdc7b257ee5dd #37
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
RIP: 0010:mptcp_stream_accept+0x1ee/0x2f0 include/net/inet_sock.h:330
Code: 0a 09 00 48 8b 1b 4c 39 e3 74 07 e8 bc 7c 7f fe eb a1 e8 b5 7c 7f fe 4c 8b 6c 24 08 eb 05 e8 a9 7c 7f fe 49 8b 85 d8 09 00 00 <0f> b6 40 12 88 44 24 07 0f b6 6c 24 07 bf 07 00 00 00 89 ee e8 89
RSP: 0018:ffffc90000d07dc0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888037e8d020 RCX: ffff88803b093300
RDX: 0000000000000000 RSI: ffffffff833822c5 RDI: ffffffff8333896a
RBP: 0000607f82031520 R08: ffff88803b093300 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000003e83 R12: ffff888037e8d020
R13: ffff888037e8c680 R14: ffff888009af7900 R15: ffff888009af6880
FS:  00007fc26d708640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000012 CR3: 0000000066bc5001 CR4: 0000000000370ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_accept+0x1ae/0x260 net/socket.c:1872
netlink: 464 bytes leftover after parsing attributes in process `syz-executor.6'.
 __sys_accept4+0x9b/0x110 net/socket.c:1913
 __do_sys_accept4 net/socket.c:1954 [inline]
 __se_sys_accept4 net/socket.c:1951 [inline]
 __x64_sys_accept4+0x20/0x30 net/socket.c:1951
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x47/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
RIP: 0033:0x7fc26e3da6a9
Code: 5c c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 37 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007fc26d707cd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000120
RAX: ffffffffffffffda RBX: 00000000006bbf80 RCX: 00007fc26e3da6a9
RDX: 0000000020000000 RSI: 00000000200001c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000080000 R11: 0000000000000246 R12: 00000000006bbf8c
R13: fffffffffffffea8 R14: 00000000006bbf80 R15: 000000000001fe40
 </TASK>
Modules linked in:
CR2: 0000000000000012
---[ end trace 0000000000000000 ]---

Kconfig:
Kconfig_k5_lockdep.txt

Reproducer:

# {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
listen(r0, 0x0)
accept4(r0, 0x0, 0x0, 0x80000)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback}, 0x63)
shutdown(r0, 0x0)
sendto$inet6(r1, &(0x7f0000000040)="eb", 0x7fdc, 0x0, 0x0, 0x0)

C-repro:
repro.c.txt

[pabeni]

reporting here the IRC queries.

@cpaasch: does the repro work for you? does it still work if you enable KASAN? if so could you please have run with the following debug change:

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 8b9ff7457d56..7a539aa27341 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2389,8 +2389,8 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
 
        sock_put(ssk);
 
-       if (ssk == msk->first)
-               WRITE_ONCE(msk->first, NULL);
+//     if (ssk == msk->first)
+//             WRITE_ONCE(msk->first, NULL);
 
 out:
        if (need_push)

The idea is that kasan could give some insight on the root cause. I think the following:

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 8b9ff7457d56..a76ea0b827fd 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3809,7 +3809,8 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock,
                /* Do late cleanup for the first subflow as necessary. Also
                 * deal with bad peers not doing a complete shutdown.
                 */
-               if (unlikely(inet_sk_state_load(msk->first) == TCP_CLOSE)) {
+               if (msk->first &&
+                   unlikely(inet_sk_state_load(msk->first) == TCP_CLOSE)) {
                        __mptcp_close_ssk(newsk, msk->first,
                                          mptcp_subflow_ctx(msk->first), 0);
                        if (unlikely(list_is_singular(&msk->conn_list)))

should address the issue, but I don't see why msk->first should be NULL at that point.