All of lore.kernel.org
 help / color / mirror / Atom feed
From: David Laight <David.Laight@ACULAB.COM>
To: 'Tadeusz Struk' <tadeusz.struk@linaro.org>,
	"davem@davemloft.net" <davem@davemloft.net>
Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
	Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
	David Ahern <dsahern@kernel.org>,
	Jakub Kicinski <kuba@kernel.org>,
	Alexei Starovoitov <ast@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Andrii Nakryiko <andrii@kernel.org>,
	Martin KaFai Lau <kafai@fb.com>, Song Liu <songliubraving@fb.com>,
	Yonghong Song <yhs@fb.com>,
	John Fastabend <john.fastabend@gmail.com>,
	KP Singh <kpsingh@kernel.org>,
	"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
	"bpf@vger.kernel.org" <bpf@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>,
	"syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com" 
	<syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com>
Subject: RE: [PATCH v2] net: ipv6: fix skb_over_panic in __ip6_append_data
Date: Thu, 10 Mar 2022 22:18:16 +0000	[thread overview]
Message-ID: <d83a4ea5fc794728bf5d2bf6f0d4fce9@AcuMS.aculab.com> (raw)
In-Reply-To: <20220310221328.877987-1-tadeusz.struk@linaro.org>

From: Tadeusz Struk
> Sent: 10 March 2022 22:13
> 
> Syzbot found a kernel bug in the ipv6 stack:
> LINK: https://syzkaller.appspot.com/bug?id=205d6f11d72329ab8d62a610c44c5e7e25415580
> The reproducer triggers it by sending a crafted message via sendmmsg()
> call, which triggers skb_over_panic, and crashes the kernel:
> 
> skbuff: skb_over_panic: text:ffffffff84647fb4 len:65575 put:65575
> head:ffff888109ff0000 data:ffff888109ff0088 tail:0x100af end:0xfec0
> dev:<NULL>
> 
> Add a check that prevents an invalid packet with MTU equall to the
> fregment header size to eat up all the space for payload.

There probably ought to be a check much earlier that stops
the option that makes the iphdr being to big being accepted
in the first place.

Much better to do the check in the option generation code.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)


  reply	other threads:[~2022-03-10 22:18 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-08  0:01 [PATCH] net: ipv6: fix invalid alloclen in __ip6_append_data Tadeusz Struk
2022-03-08  2:58 ` David Laight
2022-03-08 15:43   ` Tadeusz Struk
2022-03-08 18:18     ` David Ahern
2022-03-08 19:46       ` Tadeusz Struk
2022-03-09  5:01         ` David Ahern
2022-03-09 21:37           ` Tadeusz Struk
2022-03-10 14:39             ` Willem de Bruijn
2022-03-10 16:06               ` Tadeusz Struk
2022-03-10 17:32                 ` Willem de Bruijn
2022-03-10 21:14                   ` Tadeusz Struk
2022-03-10 22:13                   ` [PATCH v2] net: ipv6: fix skb_over_panic " Tadeusz Struk
2022-03-10 22:18                     ` David Laight [this message]
2022-03-10 22:30                     ` Jakub Kicinski
2022-03-10 22:42                       ` Tadeusz Struk
2022-03-10 22:43                       ` Willem de Bruijn
2022-03-10 23:04                         ` Tadeusz Struk
2022-03-10 23:05                         ` David Laight
2022-03-10 23:25                         ` [PATCH v3] " Tadeusz Struk
2022-03-11  1:49                           ` Willem de Bruijn
2022-03-11  3:43                             ` Tadeusz Struk
2022-03-12  1:40                           ` patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d83a4ea5fc794728bf5d2bf6f0d4fce9@AcuMS.aculab.com \
    --to=david.laight@aculab.com \
    --cc=andrii@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=davem@davemloft.net \
    --cc=dsahern@kernel.org \
    --cc=john.fastabend@gmail.com \
    --cc=kafai@fb.com \
    --cc=kpsingh@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=songliubraving@fb.com \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com \
    --cc=tadeusz.struk@linaro.org \
    --cc=willemdebruijn.kernel@gmail.com \
    --cc=yhs@fb.com \
    --cc=yoshfuji@linux-ipv6.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.