From: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
To: davem@davemloft.net, yoshfuji@linux-ipv6.org, dsahern@kernel.org,
kuba@kernel.org, pshelar@nicira.com,
willemdebruijn.kernel@gmail.com
Cc: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com
Subject: [PATCH 2/2 net] ip6_gre: add validation for csum_start
Date: Sat, 21 Aug 2021 12:44:25 +0530 [thread overview]
Message-ID: <20210821071425.512834-2-chouhan.shreyansh630@gmail.com> (raw)
In-Reply-To: <20210819100447.00201b26@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Validate csum_start in gre_handle_offloads before we call _gre_xmit so
that we do not crash later when the csum_start value is used in the
lco_csum function call.
This patch deals with ipv6 code.
Fixes: Fixes: b05229f44228 ("gre6: Cleanup GREv6 transmit path, call common
GRE functions")
Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com
Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
---
net/ipv6/ip6_gre.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index bc224f917bbd..7a5e90e09363 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -629,6 +629,8 @@ static int gre_rcv(struct sk_buff *skb)
static int gre_handle_offloads(struct sk_buff *skb, bool csum)
{
+ if (csum && skb_checksum_start(skb) < skb->data)
+ return -EINVAL;
return iptunnel_handle_offloads(skb,
csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
}
--
2.31.1
next prev parent reply other threads:[~2021-08-21 7:15 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-19 14:34 [PATCH] ip_gre/ip6_gre: add check for invalid csum_start Shreyansh Chouhan
2021-08-19 16:56 ` Willem de Bruijn
2021-08-19 17:04 ` Jakub Kicinski
2021-08-21 7:14 ` [PATCH 1/2 net] ip_gre: add validation for csum_start Shreyansh Chouhan
2021-08-21 13:41 ` Willem de Bruijn
2021-09-01 11:53 ` Ido Schimmel
2021-09-01 13:46 ` Willem de Bruijn
2021-09-01 15:53 ` Ido Schimmel
2021-09-01 21:39 ` Willem de Bruijn
2021-08-22 20:30 ` patchwork-bot+netdevbpf
2021-08-21 7:14 ` Shreyansh Chouhan [this message]
2021-08-21 13:42 ` [PATCH 2/2 net] ip6_gre: " Willem de Bruijn
2021-08-21 7:18 ` [PATCH] ip_gre/ip6_gre: add check for invalid csum_start Shreyansh Chouhan
2021-08-21 13:44 ` Willem de Bruijn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210821071425.512834-2-chouhan.shreyansh630@gmail.com \
--to=chouhan.shreyansh630@gmail.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pshelar@nicira.com \
--cc=syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).