* [PATCH net] ppp_async: limit MRU to 64K
@ 2024-02-05 17:10 Eric Dumazet
2024-02-05 18:59 ` Willem de Bruijn
0 siblings, 1 reply; 5+ messages in thread
From: Eric Dumazet @ 2024-02-05 17:10 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: netdev, eric.dumazet, Eric Dumazet, syzbot+c5da1f087c9e4ec6c933,
Willem de Bruijn
syzbot triggered a warning [1] in __alloc_pages():
WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)
Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K")
Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)
[1]:
WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
Modules linked in:
CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: events_unbound flush_to_ldisc
pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537
sp : ffff800093967580
x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000
x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0
x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8
x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120
x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005
x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000
x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001
x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0
Call trace:
__alloc_pages+0x308/0x698 mm/page_alloc.c:4543
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
__kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926
__do_kmalloc_node mm/slub.c:3969 [inline]
__kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001
kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590
__alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651
__netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715
netdev_alloc_skb include/linux/skbuff.h:3235 [inline]
dev_alloc_skb include/linux/skbuff.h:3248 [inline]
ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]
ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341
tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390
tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37
receive_buf drivers/tty/tty_buffer.c:444 [inline]
flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494
process_one_work+0x694/0x1204 kernel/workqueue.c:2633
process_scheduled_works kernel/workqueue.c:2706 [inline]
worker_thread+0x938/0xef4 kernel/workqueue.c:2787
kthread+0x288/0x310 kernel/kthread.c:388
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+c5da1f087c9e4ec6c933@syzkaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
---
drivers/net/ppp/ppp_async.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c
index 840da924708b393b16a82ab4e07746538214c0f9..125793d8aefa77fd961a708f9f7c689d5644e5c0 100644
--- a/drivers/net/ppp/ppp_async.c
+++ b/drivers/net/ppp/ppp_async.c
@@ -460,6 +460,10 @@ ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
case PPPIOCSMRU:
if (get_user(val, p))
break;
+ if (val > U16_MAX) {
+ err = -EINVAL;
+ break;
+ }
if (val < PPP_MRU)
val = PPP_MRU;
ap->mru = val;
--
2.43.0.594.gd9cf4e227d-goog
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net] ppp_async: limit MRU to 64K
2024-02-05 17:10 [PATCH net] ppp_async: limit MRU to 64K Eric Dumazet
@ 2024-02-05 18:59 ` Willem de Bruijn
0 siblings, 0 replies; 5+ messages in thread
From: Willem de Bruijn @ 2024-02-05 18:59 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: netdev, eric.dumazet, Eric Dumazet, syzbot+c5da1f087c9e4ec6c933,
Willem de Bruijn
Eric Dumazet wrote:
> syzbot triggered a warning [1] in __alloc_pages():
>
> WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)
>
> Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K")
>
> Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)
>
> [1]:
>
> WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
> Modules linked in:
> CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
> Workqueue: events_unbound flush_to_ldisc
> pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
> lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537
> sp : ffff800093967580
> x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000
> x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0
> x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8
> x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120
> x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005
> x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000
> x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001
> x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f
> x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020
> x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0
> Call trace:
> __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
> __alloc_pages_node include/linux/gfp.h:238 [inline]
> alloc_pages_node include/linux/gfp.h:261 [inline]
> __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926
> __do_kmalloc_node mm/slub.c:3969 [inline]
> __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001
> kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590
> __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651
> __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715
> netdev_alloc_skb include/linux/skbuff.h:3235 [inline]
> dev_alloc_skb include/linux/skbuff.h:3248 [inline]
> ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]
> ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341
> tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390
> tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37
> receive_buf drivers/tty/tty_buffer.c:444 [inline]
> flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494
> process_one_work+0x694/0x1204 kernel/workqueue.c:2633
> process_scheduled_works kernel/workqueue.c:2706 [inline]
> worker_thread+0x938/0xef4 kernel/workqueue.c:2787
> kthread+0x288/0x310 kernel/kthread.c:388
> ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-and-tested-by: syzbot+c5da1f087c9e4ec6c933@syzkaller.appspotmail.com
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Willem de Bruijn <willemb@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net] ppp_async: limit MRU to 64K
2024-02-06 14:42 ` [PATCH net] ppp_async: limit MRU to 64K Eric Dumazet
2024-02-06 16:50 ` Eric Dumazet
@ 2024-02-07 3:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2024-02-07 3:00 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, atenart, netdev, eric.dumazet,
syzbot+c5da1f087c9e4ec6c933, willemb
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 6 Feb 2024 14:42:58 +0000 you wrote:
> syzbot triggered a warning [1] in __alloc_pages():
>
> WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)
>
> Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K")
>
> Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)
>
> [...]
Here is the summary with links:
- [net] ppp_async: limit MRU to 64K
https://git.kernel.org/netdev/net/c/cb88cb53badb
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net] ppp_async: limit MRU to 64K
2024-02-06 14:42 ` [PATCH net] ppp_async: limit MRU to 64K Eric Dumazet
@ 2024-02-06 16:50 ` Eric Dumazet
2024-02-07 3:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 5+ messages in thread
From: Eric Dumazet @ 2024-02-06 16:50 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Antoine Tenart, netdev, eric.dumazet,
syzbot+c5da1f087c9e4ec6c933, Willem de Bruijn
On Tue, Feb 6, 2024 at 3:43 PM Eric Dumazet <edumazet@google.com> wrote:
>
> syzbot triggered a warning [1] in __alloc_pages():
>
> WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)
>
> Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K")
>
> Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)
>
Oops, sorry for the duplicate.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH net] ppp_async: limit MRU to 64K
2024-02-06 14:42 [PATCH v4 net-next 00/15] net: more factorization in cleanup_net() paths Eric Dumazet
@ 2024-02-06 14:42 ` Eric Dumazet
2024-02-06 16:50 ` Eric Dumazet
2024-02-07 3:00 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 5+ messages in thread
From: Eric Dumazet @ 2024-02-06 14:42 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Antoine Tenart, netdev, eric.dumazet, Eric Dumazet,
syzbot+c5da1f087c9e4ec6c933, Willem de Bruijn
syzbot triggered a warning [1] in __alloc_pages():
WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)
Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K")
Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)
[1]:
WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
Modules linked in:
CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: events_unbound flush_to_ldisc
pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537
sp : ffff800093967580
x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000
x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0
x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8
x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120
x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005
x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000
x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001
x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0
Call trace:
__alloc_pages+0x308/0x698 mm/page_alloc.c:4543
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
__kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926
__do_kmalloc_node mm/slub.c:3969 [inline]
__kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001
kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590
__alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651
__netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715
netdev_alloc_skb include/linux/skbuff.h:3235 [inline]
dev_alloc_skb include/linux/skbuff.h:3248 [inline]
ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]
ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341
tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390
tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37
receive_buf drivers/tty/tty_buffer.c:444 [inline]
flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494
process_one_work+0x694/0x1204 kernel/workqueue.c:2633
process_scheduled_works kernel/workqueue.c:2706 [inline]
worker_thread+0x938/0xef4 kernel/workqueue.c:2787
kthread+0x288/0x310 kernel/kthread.c:388
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+c5da1f087c9e4ec6c933@syzkaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
---
drivers/net/ppp/ppp_async.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c
index 840da924708b393b16a82ab4e07746538214c0f9..125793d8aefa77fd961a708f9f7c689d5644e5c0 100644
--- a/drivers/net/ppp/ppp_async.c
+++ b/drivers/net/ppp/ppp_async.c
@@ -460,6 +460,10 @@ ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
case PPPIOCSMRU:
if (get_user(val, p))
break;
+ if (val > U16_MAX) {
+ err = -EINVAL;
+ break;
+ }
if (val < PPP_MRU)
val = PPP_MRU;
ap->mru = val;
--
2.43.0.594.gd9cf4e227d-goog
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-02-07 3:00 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-02-05 17:10 [PATCH net] ppp_async: limit MRU to 64K Eric Dumazet
2024-02-05 18:59 ` Willem de Bruijn
2024-02-06 14:42 [PATCH v4 net-next 00/15] net: more factorization in cleanup_net() paths Eric Dumazet
2024-02-06 14:42 ` [PATCH net] ppp_async: limit MRU to 64K Eric Dumazet
2024-02-06 16:50 ` Eric Dumazet
2024-02-07 3:00 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.