From: Andrey Konovalov <andreyknvl@google.com>
To: syzkaller <syzkaller@googlegroups.com>
Cc: Dmitry Vyukov <dvyukov@google.com>,
David Miller <davem@davemloft.net>,
Tom Herbert <tom@herbertland.com>,
Alexander Duyck <aduyck@mirantis.com>,
Hannes Frederic Sowa <hannes@stressinduktion.org>,
Jiri Benc <jbenc@redhat.com>,
Sabrina Dubroca <sd@queasysnail.net>,
netdev <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: net: GPF in eth_header
Date: Tue, 29 Nov 2016 11:26:53 +0100 [thread overview]
Message-ID: <CAAeHK+xr+GdLbLch7XatW5rifOz+=cjRCGf1ro8WxEZWziyU4Q@mail.gmail.com> (raw)
In-Reply-To: <CACPEyM-4dwvmEvq3uTN_8Y-YosP8qA3cYV+oxkufFOn8M+=hew@mail.gmail.com>
On Sat, Nov 26, 2016 at 9:05 PM, Eric Dumazet <erdlkml@gmail.com> wrote:
>> I actually see multiple places where skb_network_offset() is used as
>> an argument to skb_pull().
>> So I guess every place can potentially be buggy.
>
> Well, I think the intent is to accept a negative number.
I'm not sure that was the intent since it results in a signedness
issue which leads to an out-of-bounds.
A quick grep shows that the same issue can potentially happen in
multiple places across the kernel:
net/ipv6/ip6_output.c:1655: __skb_pull(skb, skb_network_offset(skb));
net/packet/af_packet.c:2043: skb_pull(skb, skb_network_offset(skb));
net/packet/af_packet.c:2165: skb_pull(skb, skb_network_offset(skb));
net/core/neighbour.c:1301: __skb_pull(skb, skb_network_offset(skb));
net/core/neighbour.c:1331: __skb_pull(skb, skb_network_offset(skb));
net/core/dev.c:3157: __skb_pull(skb, skb_network_offset(skb));
net/sched/sch_teql.c:337: __skb_pull(skb, skb_network_offset(skb));
net/sched/sch_atm.c:479: skb_pull(skb, skb_network_offset(skb));
net/ipv4/ip_output.c:1385: __skb_pull(skb, skb_network_offset(skb));
net/ipv4/ip_fragment.c:391: if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
drivers/net/vxlan.c:1440: __skb_pull(reply, skb_network_offset(reply));
drivers/net/vxlan.c:1902: __skb_pull(skb, skb_network_offset(skb));
drivers/net/vrf.c:220: __skb_pull(skb, skb_network_offset(skb));
drivers/net/vrf.c:314: __skb_pull(skb, skb_network_offset(skb));
A similar thing also happened to somebody else (on a receive path!):
https://forums.grsecurity.net/viewtopic.php?f=3&t=4550
Does it make sense to check skb_network_offset() before passing it to
skb_pull() everywhere?
>
> This definitely was assumed by commit e1f165032c8bade authors !
>
> I guess they were using a 32bit kernel for their tests.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
next prev parent reply other threads:[~2016-11-29 10:27 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-26 17:30 net: GPF in eth_header Dmitry Vyukov
2016-11-26 18:28 ` Eric Dumazet
2016-11-26 19:07 ` Andrey Konovalov
2016-11-26 20:05 ` Eric Dumazet
2016-11-26 20:34 ` Eric Dumazet
2016-11-29 10:26 ` Andrey Konovalov [this message]
2016-11-29 14:58 ` Eric Dumazet
2016-11-29 15:31 ` Andrey Konovalov
2016-11-29 16:15 ` Eric Dumazet
2016-11-28 18:50 ` Eric Dumazet
2016-11-28 19:04 ` Andrey Konovalov
2016-11-28 19:34 ` Dmitry Vyukov
2016-11-28 19:47 ` Eric Dumazet
2016-11-28 21:05 ` Eric Dumazet
2016-11-28 21:18 ` Eric Dumazet
2016-11-28 21:34 ` Florian Westphal
2016-11-28 22:14 ` Eric Dumazet
2016-11-28 22:19 ` Florian Westphal
2016-11-28 23:16 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAAeHK+xr+GdLbLch7XatW5rifOz+=cjRCGf1ro8WxEZWziyU4Q@mail.gmail.com' \
--to=andreyknvl@google.com \
--cc=aduyck@mirantis.com \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=hannes@stressinduktion.org \
--cc=jbenc@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=sd@queasysnail.net \
--cc=syzkaller@googlegroups.com \
--cc=tom@herbertland.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.