* [PATCH net 0/2] fix possible use-after-free in erspan_v{4,6}
@ 2019-04-06 15:16 Lorenzo Bianconi
2019-04-06 15:16 ` [PATCH net 1/2] net: ip_gre: fix possible use-after-free in erspan_rcv Lorenzo Bianconi
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Lorenzo Bianconi @ 2019-04-06 15:16 UTC (permalink / raw)
To: davem; +Cc: netdev, u9012063
Similar to what I did in commit bb9bd814ebf0, fix possible use-after-free
in erspan_rcv and ip6erspan_rcv extracting tunnel metadata since the
packet can be 'uncloned' running __iptunnel_pull_header
Lorenzo Bianconi (2):
net: ip_gre: fix possible use-after-free in erspan_rcv
net: ip6_gre: fix possible use-after-free in ip6erspan_rcv
net/ipv4/ip_gre.c | 15 ++++++++++-----
net/ipv6/ip6_gre.c | 20 +++++++++++++-------
2 files changed, 23 insertions(+), 12 deletions(-)
--
2.20.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH net 1/2] net: ip_gre: fix possible use-after-free in erspan_rcv
2019-04-06 15:16 [PATCH net 0/2] fix possible use-after-free in erspan_v{4,6} Lorenzo Bianconi
@ 2019-04-06 15:16 ` Lorenzo Bianconi
2019-04-06 15:16 ` [PATCH net 2/2] net: ip6_gre: fix possible use-after-free in ip6erspan_rcv Lorenzo Bianconi
2019-04-08 23:17 ` [PATCH net 0/2] fix possible use-after-free in erspan_v{4,6} David Miller
2 siblings, 0 replies; 4+ messages in thread
From: Lorenzo Bianconi @ 2019-04-06 15:16 UTC (permalink / raw)
To: davem; +Cc: netdev, u9012063
erspan tunnels run __iptunnel_pull_header on received skbs to remove
gre and erspan headers. This can determine a possible use-after-free
accessing pkt_md pointer in erspan_rcv since the packet will be 'uncloned'
running pskb_expand_head if it is a cloned gso skb (e.g if the packet has
been sent though a veth device). Fix it resetting pkt_md pointer after
__iptunnel_pull_header
Fixes: 1d7e2ed22f8d ("net: erspan: refactor existing erspan code")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
---
net/ipv4/ip_gre.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index fd219f7bd3ea..4b0526441476 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -259,7 +259,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
struct net *net = dev_net(skb->dev);
struct metadata_dst *tun_dst = NULL;
struct erspan_base_hdr *ershdr;
- struct erspan_metadata *pkt_md;
struct ip_tunnel_net *itn;
struct ip_tunnel *tunnel;
const struct iphdr *iph;
@@ -282,9 +281,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
if (unlikely(!pskb_may_pull(skb, len)))
return PACKET_REJECT;
- ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
- pkt_md = (struct erspan_metadata *)(ershdr + 1);
-
if (__iptunnel_pull_header(skb,
len,
htons(ETH_P_TEB),
@@ -292,8 +288,9 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
goto drop;
if (tunnel->collect_md) {
+ struct erspan_metadata *pkt_md, *md;
struct ip_tunnel_info *info;
- struct erspan_metadata *md;
+ unsigned char *gh;
__be64 tun_id;
__be16 flags;
@@ -306,6 +303,14 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
if (!tun_dst)
return PACKET_REJECT;
+ /* skb can be uncloned in __iptunnel_pull_header, so
+ * old pkt_md is no longer valid and we need to reset
+ * it
+ */
+ gh = skb_network_header(skb) +
+ skb_network_header_len(skb);
+ pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
+ sizeof(*ershdr));
md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
md->version = ver;
md2 = &md->u.md2;
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net 2/2] net: ip6_gre: fix possible use-after-free in ip6erspan_rcv
2019-04-06 15:16 [PATCH net 0/2] fix possible use-after-free in erspan_v{4,6} Lorenzo Bianconi
2019-04-06 15:16 ` [PATCH net 1/2] net: ip_gre: fix possible use-after-free in erspan_rcv Lorenzo Bianconi
@ 2019-04-06 15:16 ` Lorenzo Bianconi
2019-04-08 23:17 ` [PATCH net 0/2] fix possible use-after-free in erspan_v{4,6} David Miller
2 siblings, 0 replies; 4+ messages in thread
From: Lorenzo Bianconi @ 2019-04-06 15:16 UTC (permalink / raw)
To: davem; +Cc: netdev, u9012063
erspan_v6 tunnels run __iptunnel_pull_header on received skbs to remove
erspan header. This can determine a possible use-after-free accessing
pkt_md pointer in ip6erspan_rcv since the packet will be 'uncloned'
running pskb_expand_head if it is a cloned gso skb (e.g if the packet has
been sent though a veth device). Fix it resetting pkt_md pointer after
__iptunnel_pull_header
Fixes: 1d7e2ed22f8d ("net: erspan: refactor existing erspan code")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
---
net/ipv6/ip6_gre.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index b32c95f02128..655e46b227f9 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -525,10 +525,10 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
}
static int ip6erspan_rcv(struct sk_buff *skb,
- struct tnl_ptk_info *tpi)
+ struct tnl_ptk_info *tpi,
+ int gre_hdr_len)
{
struct erspan_base_hdr *ershdr;
- struct erspan_metadata *pkt_md;
const struct ipv6hdr *ipv6h;
struct erspan_md2 *md2;
struct ip6_tnl *tunnel;
@@ -547,18 +547,16 @@ static int ip6erspan_rcv(struct sk_buff *skb,
if (unlikely(!pskb_may_pull(skb, len)))
return PACKET_REJECT;
- ershdr = (struct erspan_base_hdr *)skb->data;
- pkt_md = (struct erspan_metadata *)(ershdr + 1);
-
if (__iptunnel_pull_header(skb, len,
htons(ETH_P_TEB),
false, false) < 0)
return PACKET_REJECT;
if (tunnel->parms.collect_md) {
+ struct erspan_metadata *pkt_md, *md;
struct metadata_dst *tun_dst;
struct ip_tunnel_info *info;
- struct erspan_metadata *md;
+ unsigned char *gh;
__be64 tun_id;
__be16 flags;
@@ -571,6 +569,14 @@ static int ip6erspan_rcv(struct sk_buff *skb,
if (!tun_dst)
return PACKET_REJECT;
+ /* skb can be uncloned in __iptunnel_pull_header, so
+ * old pkt_md is no longer valid and we need to reset
+ * it
+ */
+ gh = skb_network_header(skb) +
+ skb_network_header_len(skb);
+ pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
+ sizeof(*ershdr));
info = &tun_dst->u.tun_info;
md = ip_tunnel_info_opts(info);
md->version = ver;
@@ -607,7 +613,7 @@ static int gre_rcv(struct sk_buff *skb)
if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) ||
tpi.proto == htons(ETH_P_ERSPAN2))) {
- if (ip6erspan_rcv(skb, &tpi) == PACKET_RCVD)
+ if (ip6erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
return 0;
goto out;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net 0/2] fix possible use-after-free in erspan_v{4,6}
2019-04-06 15:16 [PATCH net 0/2] fix possible use-after-free in erspan_v{4,6} Lorenzo Bianconi
2019-04-06 15:16 ` [PATCH net 1/2] net: ip_gre: fix possible use-after-free in erspan_rcv Lorenzo Bianconi
2019-04-06 15:16 ` [PATCH net 2/2] net: ip6_gre: fix possible use-after-free in ip6erspan_rcv Lorenzo Bianconi
@ 2019-04-08 23:17 ` David Miller
2 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2019-04-08 23:17 UTC (permalink / raw)
To: lorenzo.bianconi; +Cc: netdev, u9012063
From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Date: Sat, 6 Apr 2019 17:16:51 +0200
> Similar to what I did in commit bb9bd814ebf0, fix possible use-after-free
> in erspan_rcv and ip6erspan_rcv extracting tunnel metadata since the
> packet can be 'uncloned' running __iptunnel_pull_header
Series applied and queued up for -stable.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-04-08 23:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-06 15:16 [PATCH net 0/2] fix possible use-after-free in erspan_v{4,6} Lorenzo Bianconi
2019-04-06 15:16 ` [PATCH net 1/2] net: ip_gre: fix possible use-after-free in erspan_rcv Lorenzo Bianconi
2019-04-06 15:16 ` [PATCH net 2/2] net: ip6_gre: fix possible use-after-free in ip6erspan_rcv Lorenzo Bianconi
2019-04-08 23:17 ` [PATCH net 0/2] fix possible use-after-free in erspan_v{4,6} David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.