From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, syzbot <syzkaller@googlegroups.com>,
Willem de Bruijn <willemb@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.19 07/25] net: check untrusted gso_size at kernel entry
Date: Tue, 9 Jun 2020 19:44:57 +0200 [thread overview]
Message-ID: <20200609174049.478235209@linuxfoundation.org> (raw)
In-Reply-To: <20200609174048.576094775@linuxfoundation.org>
From: Willem de Bruijn <willemb@google.com>
[ Upstream commit 6dd912f82680761d8fb6b1bb274a69d4c7010988 ]
Syzkaller again found a path to a kernel crash through bad gso input:
a packet with gso size exceeding len.
These packets are dropped in tcp_gso_segment and udp[46]_ufo_fragment.
But they may affect gso size calculations earlier in the path.
Now that we have thlen as of commit 9274124f023b ("net: stricter
validation of untrusted gso packets"), check gso_size at entry too.
Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/virtio_net.h | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -31,6 +31,7 @@ static inline int virtio_net_hdr_to_skb(
{
unsigned int gso_type = 0;
unsigned int thlen = 0;
+ unsigned int p_off = 0;
unsigned int ip_proto;
if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
@@ -68,7 +69,8 @@ static inline int virtio_net_hdr_to_skb(
if (!skb_partial_csum_set(skb, start, off))
return -EINVAL;
- if (skb_transport_offset(skb) + thlen > skb_headlen(skb))
+ p_off = skb_transport_offset(skb) + thlen;
+ if (p_off > skb_headlen(skb))
return -EINVAL;
} else {
/* gso packets without NEEDS_CSUM do not set transport_offset.
@@ -92,17 +94,25 @@ retry:
return -EINVAL;
}
- if (keys.control.thoff + thlen > skb_headlen(skb) ||
+ p_off = keys.control.thoff + thlen;
+ if (p_off > skb_headlen(skb) ||
keys.basic.ip_proto != ip_proto)
return -EINVAL;
skb_set_transport_header(skb, keys.control.thoff);
+ } else if (gso_type) {
+ p_off = thlen;
+ if (p_off > skb_headlen(skb))
+ return -EINVAL;
}
}
if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size);
+ if (skb->len - p_off <= gso_size)
+ return -EINVAL;
+
skb_shinfo(skb)->gso_size = gso_size;
skb_shinfo(skb)->gso_type = gso_type;
next prev parent reply other threads:[~2020-06-09 18:03 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-09 17:44 [PATCH 4.19 00/25] 4.19.128-rc1 review Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 01/25] devinet: fix memleak in inetdev_init() Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 02/25] l2tp: add sk_family checks to l2tp_validate_socket Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 03/25] l2tp: do not use inet_hash()/inet_unhash() Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 04/25] net: usb: qmi_wwan: add Telit LE910C1-EUX composition Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 05/25] NFC: st21nfca: add missed kfree_skb() in an error path Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 06/25] vsock: fix timeout in vsock_accept() Greg Kroah-Hartman
2020-06-09 17:44 ` Greg Kroah-Hartman [this message]
2020-06-09 17:44 ` [PATCH 4.19 08/25] USB: serial: qcserial: add DW5816e QDL support Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 09/25] USB: serial: usb_wwan: do not resubmit rx urb on fatal errors Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 10/25] USB: serial: option: add Telit LE910C1-EUX compositions Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 11/25] iio: vcnl4000: Fix i2c swapped word reading Greg Kroah-Hartman
2020-06-15 13:30 ` Pavel Machek
2020-06-16 8:18 ` Jonathan Cameron
2020-06-09 17:45 ` [PATCH 4.19 12/25] usb: musb: start session in resume for host port Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 13/25] usb: musb: Fix runtime PM imbalance on error Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 14/25] vt: keyboard: avoid signed integer overflow in k_ascii Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 15/25] tty: hvc_console, fix crashes on parallel open/close Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 16/25] staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 17/25] CDC-ACM: heed quirk also in error handling Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 18/25] nvmem: qfprom: remove incorrect write support Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 19/25] x86/cpu: Add a steppings field to struct x86_cpu_id Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 20/25] x86/cpu: Add table argument to cpu_matches() Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 21/25] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 22/25] x86/speculation: Add SRBDS vulnerability and mitigation documentation Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 23/25] x86/speculation: Add Ivy Bridge to affected list Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 24/25] uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned Greg Kroah-Hartman
2020-06-09 18:55 ` Naresh Kamboju
2020-06-09 19:03 ` Greg Kroah-Hartman
2020-06-10 14:53 ` Oleg Nesterov
2020-06-10 14:58 ` Greg Kroah-Hartman
2020-06-11 16:51 ` Oleg Nesterov
2020-06-12 5:46 ` Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 25/25] Revert "net/mlx5: Annotate mutex destroy for root ns" Greg Kroah-Hartman
2020-06-11 22:17 ` Saeed Mahameed
2020-06-12 1:07 ` Sasha Levin
2020-06-09 19:01 ` [PATCH 4.19 00/25] 4.19.128-rc1 review Naresh Kamboju
2020-06-09 19:20 ` Shuah Khan
2020-06-09 19:41 ` Greg Kroah-Hartman
2020-06-10 11:29 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200609174049.478235209@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).