linux/net/bridge
Nikolay Aleksandrov c964429ef5 net: bridge: xmit: make sure we have at least eth header len bytes
commit 8bd67ebb50 upstream.

syzbot triggered an uninit value[1] error in bridge device's xmit path
by sending a short (less than ETH_HLEN bytes) skb. To fix it check if
we can actually pull that amount instead of assuming.

Tested with dropwatch:
 drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3)
 origin: software
 timestamp: Mon May 13 11:31:53 2024 778214037 nsec
 protocol: 0x88a8
 length: 2
 original length: 2
 drop reason: PKT_TOO_SMALL

[1]
BUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65
 br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65
 __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
 netdev_start_xmit include/linux/netdevice.h:4917 [inline]
 xmit_one net/core/dev.c:3531 [inline]
 dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547
 __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341
 dev_queue_xmit include/linux/netdevice.h:3091 [inline]
 __bpf_tx_skb net/core/filter.c:2136 [inline]
 __bpf_redirect_common net/core/filter.c:2180 [inline]
 __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187
 ____bpf_clone_redirect net/core/filter.c:2460 [inline]
 bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432
 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997
 __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425
 bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058
 bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269
 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678
 __do_sys_bpf kernel/bpf/syscall.c:5767 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5765 [inline]
 __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765
 x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-11-14 13:13:40 +01:00
..
netfilter netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:05:24 +02:00
br.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-08-13 06:41:22 -07:00
br_arp_nd_proxy.c net: bridge: when suppression is enabled exclude RARP packets 2021-03-22 13:30:24 -07:00
br_cfm.c bridge: cfm: remove redundant return 2021-06-22 10:35:15 -07:00
br_cfm_netlink.c bridge: cfm: fix enum typo in br_cc_ccm_tx_parse 2024-02-23 08:54:45 +01:00
br_device.c net: bridge: xmit: make sure we have at least eth header len bytes 2024-11-14 13:13:40 +01:00
br_fdb.c net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN 2024-09-12 11:07:47 +02:00
br_forward.c net: bridge: fix corrupted ethernet header on multicast-to-unicast 2024-05-17 11:50:58 +02:00
br_if.c net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode 2023-07-23 13:47:29 +02:00
br_input.c netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:05:24 +02:00
br_ioctl.c net: bridge: fix ioctl old_deviceless bridge argument 2021-12-29 12:28:46 +01:00
br_mdb.c net: bridge: vlan: account for router port lists when notifying 2021-08-17 10:37:29 +01:00
br_mrp.c net: bridge: mrp: Update the Test frames for MRA 2021-06-28 15:46:10 -07:00
br_mrp_netlink.c bridge: mrp: Use hlist_head instead of list_head for mrp 2020-11-09 16:42:12 -08:00
br_mrp_switchdev.c bridge: mrp: Extend br_mrp_switchdev to detect better the errors 2021-02-16 14:47:46 -08:00
br_multicast.c net: bridge: mcast: wait for previous gc cycles when removing port 2024-08-19 05:45:35 +02:00
br_multicast_eht.c net: bridge: multicast: use multicast contexts instead of bridge or port 2021-07-20 05:41:19 -07:00
br_netfilter_hooks.c netfilter: br_netfilter: fix panic with metadata_dst skb 2024-10-17 15:11:54 +02:00
br_netfilter_ipv6.c netfilter: br_netfilter: Drop dst references before setting. 2022-09-15 11:30:04 +02:00
br_netlink.c bridge/br_netlink.c: no need to return void function 2024-05-02 16:24:45 +02:00
br_netlink_tunnel.c net: bridge: notify on vlan tunnel changes done via the old api 2020-07-12 15:18:24 -07:00
br_nf_core.c net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2019-12-24 22:28:54 -08:00
br_private.h netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:05:24 +02:00
br_private_cfm.h bridge: cfm: Kernel space implementation of CFM. CCM frame RX added. 2020-10-29 18:39:43 -07:00
br_private_mcast_eht.h net: bridge: multicast: use multicast contexts instead of bridge or port 2021-07-20 05:41:19 -07:00
br_private_mrp.h net: bridge: mrp: Update the Test frames for MRA 2021-06-28 15:46:10 -07:00
br_private_stp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
br_private_tunnel.h bridge: always declare tunnel functions 2023-05-24 17:36:52 +01:00
br_stp.c net: bridge: constify variables in the replay helpers 2021-06-28 14:09:03 -07:00
br_stp_bpdu.c net: bridge: add STP xstats 2019-12-14 20:02:36 -08:00
br_stp_if.c bridge: Add extack warning when enabling STP in netns. 2023-07-27 08:46:59 +02:00
br_stp_timer.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
br_switchdev.c net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
br_sysfs_br.c net: bridge: mcast: add and enforce startup query interval minimum 2022-01-05 12:42:37 +01:00
br_sysfs_if.c net: bridge: mcast: br_multicast_set_port_router takes multicast context as argument 2021-08-20 15:00:35 +01:00
br_vlan.c bridge: switchdev: Fix memory leaks when changing VLAN protocol 2022-11-26 09:24:40 +01:00
br_vlan_options.c net: bridge: mcast: add and enforce startup query interval minimum 2022-01-05 12:42:37 +01:00
br_vlan_tunnel.c net: bridge: change return type of br_handle_ingress_vlan_tunnel 2021-08-24 16:51:09 -07:00
Kconfig bridge: cfm: Add BRIDGE_CFM to Kconfig. 2020-10-29 18:39:43 -07:00
Makefile net: bridge: multicast: add EHT host handling functions 2021-01-22 19:39:56 -08:00