All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH net-next] fou: Prevent unbounded recursion in GUE error handler
@ 2018-12-17 23:13 Stefano Brivio
  2018-12-18  5:38 ` David Miller
  0 siblings, 1 reply; 2+ messages in thread
From: Stefano Brivio @ 2018-12-17 23:13 UTC (permalink / raw)
  To: David S. Miller
  Cc: syzbot, Dmitry Vyukov, Paul E. McKenney, Eric Dumazet,
	Arjan van de Ven, Andrew Morton, Josh Triplett, Ingo Molnar,
	syzkaller-bugs, linux-kernel, netdev

Handling exceptions for direct UDP encapsulation in GUE (that is,
UDP-in-UDP) leads to unbounded recursion in the GUE exception handler,
syzbot reported.

While draft-ietf-intarea-gue-06 doesn't explicitly forbid direct
encapsulation of UDP in GUE, it probably doesn't make sense to set up GUE
this way, and it's currently not even possible to configure this.

Skip exception handling if the GUE proto/ctype field is set to the UDP
protocol number. Should we need to handle exceptions for UDP-in-GUE one
day, we might need to either explicitly set a bound for recursion, or
implement a special iterative handling for these cases.

Reported-and-tested-by: syzbot+43f6755d1c2e62743468@syzkaller.appspotmail.com
Fixes: b8a51b38e4d4 ("fou, fou6: ICMP error handlers for FoU and GUE")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 net/ipv4/fou.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 0d0ad19ecb87..0c9f171fb085 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -1061,6 +1061,13 @@ static int gue_err(struct sk_buff *skb, u32 info)
 	if (validate_gue_flags(guehdr, optlen))
 		return -EINVAL;
 
+	/* Handling exceptions for direct UDP encapsulation in GUE would lead to
+	 * recursion. Besides, this kind of encapsulation can't even be
+	 * configured currently. Discard this.
+	 */
+	if (guehdr->proto_ctype == IPPROTO_UDP)
+		return -EOPNOTSUPP;
+
 	skb_set_transport_header(skb, -(int)sizeof(struct icmphdr));
 	ret = gue_err_proto_handler(guehdr->proto_ctype, skb, info);
 
-- 
2.19.2


^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [PATCH net-next] fou: Prevent unbounded recursion in GUE error handler
  2018-12-17 23:13 [PATCH net-next] fou: Prevent unbounded recursion in GUE error handler Stefano Brivio
@ 2018-12-18  5:38 ` David Miller
  0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2018-12-18  5:38 UTC (permalink / raw)
  To: sbrivio
  Cc: syzbot+43f6755d1c2e62743468, dvyukov, paulmck, eric.dumazet,
	arjan, akpm, josh, mingo, syzkaller-bugs, linux-kernel, netdev

From: Stefano Brivio <sbrivio@redhat.com>
Date: Tue, 18 Dec 2018 00:13:17 +0100

> Handling exceptions for direct UDP encapsulation in GUE (that is,
> UDP-in-UDP) leads to unbounded recursion in the GUE exception handler,
> syzbot reported.
> 
> While draft-ietf-intarea-gue-06 doesn't explicitly forbid direct
> encapsulation of UDP in GUE, it probably doesn't make sense to set up GUE
> this way, and it's currently not even possible to configure this.
> 
> Skip exception handling if the GUE proto/ctype field is set to the UDP
> protocol number. Should we need to handle exceptions for UDP-in-GUE one
> day, we might need to either explicitly set a bound for recursion, or
> implement a special iterative handling for these cases.
> 
> Reported-and-tested-by: syzbot+43f6755d1c2e62743468@syzkaller.appspotmail.com
> Fixes: b8a51b38e4d4 ("fou, fou6: ICMP error handlers for FoU and GUE")
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Applied, thanks.

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2018-12-18  5:38 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-17 23:13 [PATCH net-next] fou: Prevent unbounded recursion in GUE error handler Stefano Brivio
2018-12-18  5:38 ` David Miller

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.