From: Cong Wang <xiyou.wangcong@gmail.com>
To: netdev@vger.kernel.org
Cc: Cong Wang <xiyou.wangcong@gmail.com>,
syzbot+4a2c52677a8a1aa283cb@syzkaller.appspotmail.com,
William Tu <u9012063@gmail.com>,
Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Subject: [Patch net] ip_gre: set dev->hard_header_len properly
Date: Wed, 7 Oct 2020 18:21:54 -0700 [thread overview]
Message-ID: <20201008012154.11149-1-xiyou.wangcong@gmail.com> (raw)
GRE tunnel has its own header_ops, ipgre_header_ops, and sets it
conditionally. When it is set, it assumes the outer IP header is
already created before ipgre_xmit().
This is not true when we send packets through a raw packet socket,
where L2 headers are supposed to be constructed by user. Packet
socket calls dev_validate_header() to validate the header. But
GRE tunnel does not set dev->hard_header_len, so that check can
be simply bypassed, therefore uninit memory could be passed down
to ipgre_xmit().
Fix this by setting dev->hard_header_len whenever sets header_ops,
as dev->hard_header_len is supposed to be the length of the header
created by dev->header_ops->create() anyway.
Reported-and-tested-by: syzbot+4a2c52677a8a1aa283cb@syzkaller.appspotmail.com
Cc: William Tu <u9012063@gmail.com>
Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
net/ipv4/ip_gre.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 4e31f23e4117..43b62095559e 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -987,10 +987,12 @@ static int ipgre_tunnel_init(struct net_device *dev)
return -EINVAL;
dev->flags = IFF_BROADCAST;
dev->header_ops = &ipgre_header_ops;
+ dev->hard_header_len = tunnel->hlen + sizeof(*iph);
}
#endif
} else if (!tunnel->collect_md) {
dev->header_ops = &ipgre_header_ops;
+ dev->hard_header_len = tunnel->hlen + sizeof(*iph);
}
return ip_tunnel_init(dev);
--
2.28.0
next reply other threads:[~2020-10-08 1:24 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-08 1:21 Cong Wang [this message]
2020-10-08 11:48 ` [Patch net] ip_gre: set dev->hard_header_len properly Willem de Bruijn
2020-10-08 17:33 ` Cong Wang
2020-10-08 19:04 ` Willem de Bruijn
2020-10-08 19:16 ` Xie He
2020-10-08 19:19 ` Willem de Bruijn
2020-10-08 20:10 ` Xie He
2020-10-08 20:31 ` Willem de Bruijn
2020-10-08 21:35 ` Xie He
2020-10-08 21:47 ` Willem de Bruijn
2020-10-08 21:54 ` Xie He
2020-10-08 23:40 ` Xie He
2020-10-09 17:43 ` Cong Wang
2020-10-09 19:41 ` Xie He
2020-10-09 19:51 ` Xie He
2020-10-09 20:38 ` Cong Wang
2020-10-10 1:07 ` Cong Wang
2020-10-10 3:10 ` Xie He
2020-10-10 18:58 ` Cong Wang
2020-10-10 21:49 ` Xie He
2020-10-11 3:55 ` Xie He
2020-10-11 14:35 ` Xie He
2020-10-08 19:18 ` Willem de Bruijn
2020-10-08 19:50 ` Cong Wang
2020-10-08 20:19 ` Willem de Bruijn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201008012154.11149-1-xiyou.wangcong@gmail.com \
--to=xiyou.wangcong@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=syzbot+4a2c52677a8a1aa283cb@syzkaller.appspotmail.com \
--cc=u9012063@gmail.com \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).