* [PATCH net] tunnels: fix out of bounds access when building IPv6 PMTU error
@ 2024-02-01 8:38 Antoine Tenart
2024-02-01 12:45 ` Jiri Pirko
2024-02-03 12:50 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Antoine Tenart @ 2024-02-01 8:38 UTC (permalink / raw)
To: davem, kuba, pabeni, edumazet; +Cc: Antoine Tenart, netdev
If the ICMPv6 error is built from a non-linear skb we get the following
splat,
BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240
Read of size 4 at addr ffff88811d402c80 by task netperf/820
CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543
...
kasan_report+0xd8/0x110
do_csum+0x220/0x240
csum_partial+0xc/0x20
skb_tunnel_check_pmtu+0xeb9/0x3280
vxlan_xmit_one+0x14c2/0x4080
vxlan_xmit+0xf61/0x5c00
dev_hard_start_xmit+0xfb/0x510
__dev_queue_xmit+0x7cd/0x32a0
br_dev_queue_push_xmit+0x39d/0x6a0
Use skb_checksum instead of csum_partial who cannot deal with non-linear
SKBs.
Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
Signed-off-by: Antoine Tenart <atenart@kernel.org>
---
net/ipv4/ip_tunnel_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 586b1b3e35b8..80ccd6661aa3 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -332,7 +332,7 @@ static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu)
};
skb_reset_network_header(skb);
- csum = csum_partial(icmp6h, len, 0);
+ csum = skb_checksum(skb, skb_transport_offset(skb), len, 0);
icmp6h->icmp6_cksum = csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr, len,
IPPROTO_ICMPV6, csum);
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] tunnels: fix out of bounds access when building IPv6 PMTU error
2024-02-01 8:38 [PATCH net] tunnels: fix out of bounds access when building IPv6 PMTU error Antoine Tenart
@ 2024-02-01 12:45 ` Jiri Pirko
2024-02-03 12:50 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Jiri Pirko @ 2024-02-01 12:45 UTC (permalink / raw)
To: Antoine Tenart; +Cc: davem, kuba, pabeni, edumazet, netdev
Thu, Feb 01, 2024 at 09:38:15AM CET, atenart@kernel.org wrote:
>If the ICMPv6 error is built from a non-linear skb we get the following
>splat,
>
> BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240
> Read of size 4 at addr ffff88811d402c80 by task netperf/820
> CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543
> ...
> kasan_report+0xd8/0x110
> do_csum+0x220/0x240
> csum_partial+0xc/0x20
> skb_tunnel_check_pmtu+0xeb9/0x3280
> vxlan_xmit_one+0x14c2/0x4080
> vxlan_xmit+0xf61/0x5c00
> dev_hard_start_xmit+0xfb/0x510
> __dev_queue_xmit+0x7cd/0x32a0
> br_dev_queue_push_xmit+0x39d/0x6a0
>
>Use skb_checksum instead of csum_partial who cannot deal with non-linear
>SKBs.
>
>Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
>Signed-off-by: Antoine Tenart <atenart@kernel.org>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] tunnels: fix out of bounds access when building IPv6 PMTU error
2024-02-01 8:38 [PATCH net] tunnels: fix out of bounds access when building IPv6 PMTU error Antoine Tenart
2024-02-01 12:45 ` Jiri Pirko
@ 2024-02-03 12:50 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2024-02-03 12:50 UTC (permalink / raw)
To: Antoine Tenart; +Cc: davem, kuba, pabeni, edumazet, netdev
Hello:
This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:
On Thu, 1 Feb 2024 09:38:15 +0100 you wrote:
> If the ICMPv6 error is built from a non-linear skb we get the following
> splat,
>
> BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240
> Read of size 4 at addr ffff88811d402c80 by task netperf/820
> CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543
> ...
> kasan_report+0xd8/0x110
> do_csum+0x220/0x240
> csum_partial+0xc/0x20
> skb_tunnel_check_pmtu+0xeb9/0x3280
> vxlan_xmit_one+0x14c2/0x4080
> vxlan_xmit+0xf61/0x5c00
> dev_hard_start_xmit+0xfb/0x510
> __dev_queue_xmit+0x7cd/0x32a0
> br_dev_queue_push_xmit+0x39d/0x6a0
>
> [...]
Here is the summary with links:
- [net] tunnels: fix out of bounds access when building IPv6 PMTU error
https://git.kernel.org/netdev/net/c/d75abeec401f
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-02-03 12:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-02-01 8:38 [PATCH net] tunnels: fix out of bounds access when building IPv6 PMTU error Antoine Tenart
2024-02-01 12:45 ` Jiri Pirko
2024-02-03 12:50 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).