From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
syzbot <syzkaller@googlegroups.com>,
Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 5.9 24/46] geneve: pull IP header before ECN decapsulation
Date: Sun, 6 Dec 2020 12:17:32 +0100 [thread overview]
Message-ID: <20201206111557.621339859@linuxfoundation.org> (raw)
In-Reply-To: <20201206111556.455533723@linuxfoundation.org>
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 4179b00c04d18ea7013f68d578d80f3c9d13150a ]
IP_ECN_decapsulate() and IP6_ECN_decapsulate() assume
IP header is already pulled.
geneve does not ensure this yet.
Fixing this generically in IP_ECN_decapsulate() and
IP6_ECN_decapsulate() is not possible, since callers
pass a pointer that might be freed by pskb_may_pull()
syzbot reported :
BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:238 [inline]
BUG: KMSAN: uninit-value in INET_ECN_decapsulate+0x345/0x1db0 include/net/inet_ecn.h:260
CPU: 1 PID: 8941 Comm: syz-executor.0 Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x21c/0x280 lib/dump_stack.c:118
kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
__msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
__INET_ECN_decapsulate include/net/inet_ecn.h:238 [inline]
INET_ECN_decapsulate+0x345/0x1db0 include/net/inet_ecn.h:260
geneve_rx+0x2103/0x2980 include/net/inet_ecn.h:306
geneve_udp_encap_recv+0x105c/0x1340 drivers/net/geneve.c:377
udp_queue_rcv_one_skb+0x193a/0x1af0 net/ipv4/udp.c:2093
udp_queue_rcv_skb+0x282/0x1050 net/ipv4/udp.c:2167
udp_unicast_rcv_skb net/ipv4/udp.c:2325 [inline]
__udp4_lib_rcv+0x399d/0x5880 net/ipv4/udp.c:2394
udp_rcv+0x5c/0x70 net/ipv4/udp.c:2564
ip_protocol_deliver_rcu+0x572/0xc50 net/ipv4/ip_input.c:204
ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip_local_deliver+0x583/0x8d0 net/ipv4/ip_input.c:252
dst_input include/net/dst.h:449 [inline]
ip_rcv_finish net/ipv4/ip_input.c:428 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip_rcv+0x5c3/0x840 net/ipv4/ip_input.c:539
__netif_receive_skb_one_core net/core/dev.c:5315 [inline]
__netif_receive_skb+0x1ec/0x640 net/core/dev.c:5429
process_backlog+0x523/0xc10 net/core/dev.c:6319
napi_poll+0x420/0x1010 net/core/dev.c:6763
net_rx_action+0x35c/0xd40 net/core/dev.c:6833
__do_softirq+0x1a9/0x6fa kernel/softirq.c:298
asm_call_irq_on_stack+0xf/0x20
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0x6e/0x90 arch/x86/kernel/irq_64.c:77
do_softirq kernel/softirq.c:343 [inline]
__local_bh_enable_ip+0x184/0x1d0 kernel/softirq.c:195
local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
rcu_read_unlock_bh include/linux/rcupdate.h:730 [inline]
__dev_queue_xmit+0x3a9b/0x4520 net/core/dev.c:4167
dev_queue_xmit+0x4b/0x60 net/core/dev.c:4173
packet_snd net/packet/af_packet.c:2992 [inline]
packet_sendmsg+0x86f9/0x99d0 net/packet/af_packet.c:3017
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg net/socket.c:671 [inline]
__sys_sendto+0x9dc/0xc80 net/socket.c:1992
__do_sys_sendto net/socket.c:2004 [inline]
__se_sys_sendto+0x107/0x130 net/socket.c:2000
__x64_sys_sendto+0x6e/0x90 net/socket.c:2000
do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes: 2d07dc79fe04 ("geneve: add initial netdev driver for GENEVE tunnels")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20201201090507.4137906-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/geneve.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -258,11 +258,21 @@ static void geneve_rx(struct geneve_dev
skb_dst_set(skb, &tun_dst->dst);
/* Ignore packet loops (and multicast echo) */
- if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr)) {
- geneve->dev->stats.rx_errors++;
- goto drop;
- }
+ if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr))
+ goto rx_error;
+ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
+ if (pskb_may_pull(skb, sizeof(struct iphdr)))
+ goto rx_error;
+ break;
+ case htons(ETH_P_IPV6):
+ if (pskb_may_pull(skb, sizeof(struct ipv6hdr)))
+ goto rx_error;
+ break;
+ default:
+ goto rx_error;
+ }
oiph = skb_network_header(skb);
skb_reset_network_header(skb);
@@ -303,6 +313,8 @@ static void geneve_rx(struct geneve_dev
u64_stats_update_end(&stats->syncp);
}
return;
+rx_error:
+ geneve->dev->stats.rx_errors++;
drop:
/* Consume bad packet */
kfree_skb(skb);
next prev parent reply other threads:[~2020-12-06 11:44 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-06 11:17 [PATCH 5.9 00/46] 5.9.13-rc1 review Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 01/46] devlink: Hold rtnl lock while reading netdev attributes Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 02/46] devlink: Make sure devlink instance and port are in same net namespace Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 03/46] ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 04/46] net/af_iucv: set correct sk_protocol for child sockets Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 05/46] net: openvswitch: fix TTL decrement action netlink message format Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 06/46] net/tls: missing received data after fast remote close Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 07/46] net/tls: Protect from calling tls_dev_del for TLS RX twice Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 08/46] rose: Fix Null pointer dereference in rose_send_frame() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 09/46] sock: set sk_err to ee_errno on dequeue from errq Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 10/46] tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 11/46] tun: honor IOCB_NOWAIT flag Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 12/46] usbnet: ipheth: fix connectivity with iOS 14 Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 13/46] vsock/virtio: discard packets only when socket is really closed Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 14/46] mptcp: fix NULL ptr dereference on bad MPJ Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 15/46] net/packet: fix packet receive on L3 devices without visible hard header Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 16/46] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 17/46] ipv4: Fix tos mask in inet_rtm_getroute() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 18/46] dt-bindings: net: correct interrupt flags in examples Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 19/46] chelsio/chtls: fix panic during unload reload chtls Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 20/46] ibmvnic: Ensure that SCRQ entry reads are correctly ordered Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 21/46] ibmvnic: Fix TX completion error handling Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 22/46] tipc: fix incompatible mtu of transmission Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 23/46] inet_ecn: Fix endianness of checksum update when setting ECT(1) Greg Kroah-Hartman
2020-12-06 11:17 ` Greg Kroah-Hartman [this message]
2020-12-06 11:17 ` [PATCH 5.9 25/46] net: ip6_gre: set dev->hard_header_len when using header_ops Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 26/46] dpaa_eth: copy timestamp fields to new skb in A-050385 workaround Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 27/46] net/x25: prevent a couple of overflows Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 28/46] cxgb3: fix error return code in t3_sge_alloc_qset() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 29/46] net: pasemi: fix error return code in pasemi_mac_open() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 30/46] vxlan: fix error return code in __vxlan_dev_create() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 31/46] chelsio/chtls: fix a double free in chtls_setkey() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 32/46] net: mvpp2: Fix error return code in mvpp2_open() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 33/46] net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 34/46] net: openvswitch: ensure LSE is pullable before reading it Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 35/46] net/sched: act_mpls: " Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 36/46] net/mlx5: DR, Proper handling of unsupported Connect-X6DX SW steering Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 37/46] net/mlx5: Fix wrong address reclaim when command interface is down Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 38/46] net: mlx5e: fix fs_tcp.c build when IPV6 is not enabled Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 39/46] ALSA: usb-audio: US16x08: fix value count for level meters Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 40/46] Input: xpad - support Ardwiino Controllers Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 41/46] Input: i8042 - add ByteSpeed touchpad to noloop table Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 42/46] Input: atmel_mxt_ts - fix lost interrupts Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 43/46] tracing: Fix alignment of static buffer Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 44/46] tracing: Remove WARN_ON in start_thread() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 45/46] uapi: fix statx attribute value overlap for DAX & MOUNT_ROOT Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 5.9 46/46] drm/i915/gt: Fixup tgl mocs for PTE tracking Greg Kroah-Hartman
2020-12-06 21:08 ` [PATCH 5.9 00/46] 5.9.13-rc1 review Jeffrin Jose T
2020-12-07 7:17 ` Naresh Kamboju
2020-12-08 9:42 ` Greg Kroah-Hartman
2020-12-07 15:04 ` Jon Hunter
2020-12-08 9:43 ` Greg Kroah-Hartman
2020-12-07 15:55 ` Guenter Roeck
2020-12-08 9:43 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201206111557.621339859@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.