kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/net/core
History
Toshiaki Makita 7fc0ebb103 vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi 
commit 7ce2367254 upstream.

Syzkaller spotted an old bug which leads to reading skb beyond tail by 4
bytes on vlan tagged packets.
This is caused because skb_vlan_tagged_multi() did not check
skb_headlen.

BUG: KMSAN: uninit-value in eth_type_vlan include/linux/if_vlan.h:283 [inline]
BUG: KMSAN: uninit-value in skb_vlan_tagged_multi include/linux/if_vlan.h:656 [inline]
BUG: KMSAN: uninit-value in vlan_features_check include/linux/if_vlan.h:672 [inline]
BUG: KMSAN: uninit-value in dflt_features_check net/core/dev.c:2949 [inline]
BUG: KMSAN: uninit-value in netif_skb_features+0xd1b/0xdc0 net/core/dev.c:3009
CPU: 1 PID: 3582 Comm: syzkaller435149 Not tainted 4.16.0+ #82
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x185/0x1d0 lib/dump_stack.c:53
  kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
  __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676
  eth_type_vlan include/linux/if_vlan.h:283 [inline]
  skb_vlan_tagged_multi include/linux/if_vlan.h:656 [inline]
  vlan_features_check include/linux/if_vlan.h:672 [inline]
  dflt_features_check net/core/dev.c:2949 [inline]
  netif_skb_features+0xd1b/0xdc0 net/core/dev.c:3009
  validate_xmit_skb+0x89/0x1320 net/core/dev.c:3084
  __dev_queue_xmit+0x1cb2/0x2b60 net/core/dev.c:3549
  dev_queue_xmit+0x4b/0x60 net/core/dev.c:3590
  packet_snd net/packet/af_packet.c:2944 [inline]
  packet_sendmsg+0x7c57/0x8a10 net/packet/af_packet.c:2969
  sock_sendmsg_nosec net/socket.c:630 [inline]
  sock_sendmsg net/socket.c:640 [inline]
  sock_write_iter+0x3b9/0x470 net/socket.c:909
  do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776
  do_iter_write+0x30d/0xd40 fs/read_write.c:932
  vfs_writev fs/read_write.c:977 [inline]
  do_writev+0x3c9/0x830 fs/read_write.c:1012
  SYSC_writev+0x9b/0xb0 fs/read_write.c:1085
  SyS_writev+0x56/0x80 fs/read_write.c:1082
  do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x43ffa9
RSP: 002b:00007fff2cff3948 EFLAGS: 00000217 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ffa9
RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004018d0
R13: 0000000000401960 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
  kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
  kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
  kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
  kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321
  slab_post_alloc_hook mm/slab.h:445 [inline]
  slab_alloc_node mm/slub.c:2737 [inline]
  __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369
  __kmalloc_reserve net/core/skbuff.c:138 [inline]
  __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206
  alloc_skb include/linux/skbuff.h:984 [inline]
  alloc_skb_with_frags+0x1d4/0xb20 net/core/skbuff.c:5234
  sock_alloc_send_pskb+0xb56/0x1190 net/core/sock.c:2085
  packet_alloc_skb net/packet/af_packet.c:2803 [inline]
  packet_snd net/packet/af_packet.c:2894 [inline]
  packet_sendmsg+0x6444/0x8a10 net/packet/af_packet.c:2969
  sock_sendmsg_nosec net/socket.c:630 [inline]
  sock_sendmsg net/socket.c:640 [inline]
  sock_write_iter+0x3b9/0x470 net/socket.c:909
  do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776
  do_iter_write+0x30d/0xd40 fs/read_write.c:932
  vfs_writev fs/read_write.c:977 [inline]
  do_writev+0x3c9/0x830 fs/read_write.c:1012
  SYSC_writev+0x9b/0xb0 fs/read_write.c:1085
  SyS_writev+0x56/0x80 fs/read_write.c:1082
  do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2

Fixes: 58e998c6d2 ("offloading: Force software GSO for multiple vlan tags.")
Reported-and-tested-by: syzbot+0bbe42c764feafa82c5a@syzkaller.appspotmail.com
Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: The unchecked read is in netif_skb_features()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-10-21 08:45:30 +01:00
..
datagram.c Revert "[stable-only] net: add length argument to skb_copy_and_csum_datagram_iovec" 2016-01-25 10:44:07 +00:00
dev.c vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi 2018-10-21 08:45:30 +01:00
dev_addr_lists.c net: fix uninit-value in __hw_addr_add_ex() 2018-10-21 08:45:18 +01:00
dev_ioctl.c net_tstamp: Add SIOCGHWTSTAMP ioctl to match SIOCSHWTSTAMP 2013-11-19 19:07:21 +00:00
drop_monitor.c drop_monitor: consider inserted data in genlmsg_end 2017-03-16 02:27:22 +00:00
dst.c ipv4: add reference counting to metrics 2017-11-11 13:33:21 +00:00
ethtool.c ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings 2015-10-28 10:33:20 +00:00
fib_rules.c fib_rules: Fix dump_rules() not to exit early 2015-10-19 11:23:19 +01:00
filter.c rose: limit sk_filter trim to payload 2017-02-23 03:54:46 +00:00
flow.c flowcache: Fix kernel panic in flow_cache_flush_task 2015-03-12 15:46:26 +00:00
flow_dissector.c net: Rename skb->rxhash to skb->hash 2014-03-26 15:58:20 -04:00
gen_estimator.c net_sched: add 64bit rate estimators 2013-06-11 02:51:03 -07:00
gen_stats.c gen_stats.c: Duplicate xstats buffer for later use 2015-03-12 16:27:17 +00:00
iovec.c net: sendmsg: fix NULL pointer dereference 2014-07-29 12:20:22 -07:00
link_watch.c arch: Mass conversion of smp_mb__*() 2014-04-18 14:20:48 +02:00
Makefile net: Add a software TSO helper API 2014-05-22 14:57:15 -04:00
neighbour.c net: fix deadlock while clearing neighbor proxy table 2018-10-21 08:45:24 +01:00
net-procfs.c rps: selective flow shedding during softnet overflow 2013-05-20 13:48:04 -07:00
net-sysfs.c net: don't decrement kobj reference count on init failure 2017-11-26 13:50:21 +00:00
net-sysfs.h net: netdev_kobject_init: annotate with __init 2014-01-05 20:27:54 -05:00
net-traces.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
net_namespace.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-05-24 00:32:30 -04:00
netclassid_cgroup.c cgroup: remove css_parent() 2014-05-16 13:22:48 -04:00
netevent.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
netpoll.c netpoll: Use skb_irq_freeable to make zap_completion_queue safe. 2014-04-01 17:53:36 -04:00
netprio_cgroup.c cgroup: remove css_parent() 2014-05-16 13:22:48 -04:00
pktgen.c dst: Increase alignment of metrics to allow extra flag on pointers 2017-11-11 13:33:20 +00:00
ptp_classifier.c net: filter: let unattached filters use sock_fprog_kern 2014-05-23 16:48:05 -04:00
request_sock.c net: remove unnecessary return's 2014-02-13 18:33:38 -05:00
rtnetlink.c net: enable interface alias removal via rtnl 2018-01-01 20:51:54 +00:00
scm.c unix: correctly track in-flight fds in sending process user_struct 2016-02-25 10:51:00 +00:00
secure_seq.c inetpeer: get rid of ip_id_count 2014-06-02 11:00:41 -07:00
skbuff.c net: initialize skb->peeked when cloning 2018-10-21 08:45:18 +01:00
sock.c net: Set sk_prot_creator when cloning sockets to the right proto 2018-09-25 23:47:21 +01:00
sock_diag.c net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump 2014-04-24 13:44:53 -04:00
stream.c net: replace macros net_random and net_srandom with direct calls to prandom 2014-01-14 15:15:25 -08:00
sysctl_net_core.c net:Add sysctl_max_skb_frags 2016-03-24 10:00:44 +00:00
timestamping.c net: ptp: move PTP classifier in its own file 2014-04-01 16:43:18 -04:00
tso.c net: tso: fix unaligned access to crafted TCP header in helper API 2014-11-05 16:39:43 +00:00
user_dma.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
utils.c net: avoid dependency of net_get_random_once on nop patching 2014-05-14 00:37:34 -04:00