netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [Patch net v3] ip_gre: set dev->hard_header_len and dev->needed_headroom properly
@ 2020-10-12 23:17 Cong Wang
  2020-10-13  1:46 ` Xie He
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Cong Wang @ 2020-10-12 23:17 UTC (permalink / raw)
  To: netdev
  Cc: Cong Wang, syzbot+4a2c52677a8a1aa283cb, Xie He, William Tu,
	Willem de Bruijn

GRE tunnel has its own header_ops, ipgre_header_ops, and sets it
conditionally. When it is set, it assumes the outer IP header is
already created before ipgre_xmit().

This is not true when we send packets through a raw packet socket,
where L2 headers are supposed to be constructed by user. Packet
socket calls dev_validate_header() to validate the header. But
GRE tunnel does not set dev->hard_header_len, so that check can
be simply bypassed, therefore uninit memory could be passed down
to ipgre_xmit(). Similar for dev->needed_headroom.

dev->hard_header_len is supposed to be the length of the header
created by dev->header_ops->create(), so it should be used whenever
header_ops is set, and dev->needed_headroom should be used when it
is not set.

Reported-and-tested-by: syzbot+4a2c52677a8a1aa283cb@syzkaller.appspotmail.com
Cc: Xie He <xie.he.0141@gmail.com>
Cc: William Tu <u9012063@gmail.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
Note, there are some other suspicious use of dev->hard_header_len in
the same file, but let's leave them to a separate patch if really
needed.

v2: pass 0 to skb_cow_head()
v1: fix dev->needed_headroom and update ipgre_link_update()

 net/ipv4/ip_gre.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 4e31f23e4117..e70291748889 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -625,9 +625,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
 	}
 
 	if (dev->header_ops) {
-		/* Need space for new headers */
-		if (skb_cow_head(skb, dev->needed_headroom -
-				      (tunnel->hlen + sizeof(struct iphdr))))
+		if (skb_cow_head(skb, 0))
 			goto free_skb;
 
 		tnl_params = (const struct iphdr *)skb->data;
@@ -748,7 +746,11 @@ static void ipgre_link_update(struct net_device *dev, bool set_mtu)
 	len = tunnel->tun_hlen - len;
 	tunnel->hlen = tunnel->hlen + len;
 
-	dev->needed_headroom = dev->needed_headroom + len;
+	if (dev->header_ops)
+		dev->hard_header_len += len;
+	else
+		dev->needed_headroom += len;
+
 	if (set_mtu)
 		dev->mtu = max_t(int, dev->mtu - len, 68);
 
@@ -944,6 +946,7 @@ static void __gre_tunnel_init(struct net_device *dev)
 	tunnel->parms.iph.protocol = IPPROTO_GRE;
 
 	tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
+	dev->needed_headroom = tunnel->hlen + sizeof(tunnel->parms.iph);
 
 	dev->features		|= GRE_FEATURES;
 	dev->hw_features	|= GRE_FEATURES;
@@ -987,10 +990,14 @@ static int ipgre_tunnel_init(struct net_device *dev)
 				return -EINVAL;
 			dev->flags = IFF_BROADCAST;
 			dev->header_ops = &ipgre_header_ops;
+			dev->hard_header_len = tunnel->hlen + sizeof(*iph);
+			dev->needed_headroom = 0;
 		}
 #endif
 	} else if (!tunnel->collect_md) {
 		dev->header_ops = &ipgre_header_ops;
+		dev->hard_header_len = tunnel->hlen + sizeof(*iph);
+		dev->needed_headroom = 0;
 	}
 
 	return ip_tunnel_init(dev);
-- 
2.28.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [Patch net v3] ip_gre: set dev->hard_header_len and dev->needed_headroom properly
  2020-10-12 23:17 [Patch net v3] ip_gre: set dev->hard_header_len and dev->needed_headroom properly Cong Wang
@ 2020-10-13  1:46 ` Xie He
  2020-10-13  1:56 ` Xie He
  2020-10-14  1:38 ` Jakub Kicinski
  2 siblings, 0 replies; 4+ messages in thread
From: Xie He @ 2020-10-13  1:46 UTC (permalink / raw)
  To: Cong Wang
  Cc: Linux Kernel Network Developers, syzbot, William Tu, Willem de Bruijn

On Mon, Oct 12, 2020 at 4:17 PM Cong Wang <xiyou.wangcong@gmail.com> wrote:
>
> Note, there are some other suspicious use of dev->hard_header_len in
> the same file, but let's leave them to a separate patch if really
> needed.

I looked at the file (before this patch). There are 4 occurrences of
hard_header_len, but they are all for ERSPAN devices (TAP devices
which tunnel Ethernet frames). So I think they are used for the
Ethernet header length and we don't need to worry about them.

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [Patch net v3] ip_gre: set dev->hard_header_len and dev->needed_headroom properly
  2020-10-12 23:17 [Patch net v3] ip_gre: set dev->hard_header_len and dev->needed_headroom properly Cong Wang
  2020-10-13  1:46 ` Xie He
@ 2020-10-13  1:56 ` Xie He
  2020-10-14  1:38 ` Jakub Kicinski
  2 siblings, 0 replies; 4+ messages in thread
From: Xie He @ 2020-10-13  1:56 UTC (permalink / raw)
  To: Cong Wang
  Cc: Linux Kernel Network Developers, syzbot, William Tu, Willem de Bruijn

On Mon, Oct 12, 2020 at 4:17 PM Cong Wang <xiyou.wangcong@gmail.com> wrote:
>
> GRE tunnel has its own header_ops, ipgre_header_ops, and sets it
> conditionally. When it is set, it assumes the outer IP header is
> already created before ipgre_xmit().
>
> This is not true when we send packets through a raw packet socket,
> where L2 headers are supposed to be constructed by user. Packet
> socket calls dev_validate_header() to validate the header. But
> GRE tunnel does not set dev->hard_header_len, so that check can
> be simply bypassed, therefore uninit memory could be passed down
> to ipgre_xmit(). Similar for dev->needed_headroom.
>
> dev->hard_header_len is supposed to be the length of the header
> created by dev->header_ops->create(), so it should be used whenever
> header_ops is set, and dev->needed_headroom should be used when it
> is not set.

Acked-by: Xie He <xie.he.0141@gmail.com>

Thank you for your work, Cong!

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [Patch net v3] ip_gre: set dev->hard_header_len and dev->needed_headroom properly
  2020-10-12 23:17 [Patch net v3] ip_gre: set dev->hard_header_len and dev->needed_headroom properly Cong Wang
  2020-10-13  1:46 ` Xie He
  2020-10-13  1:56 ` Xie He
@ 2020-10-14  1:38 ` Jakub Kicinski
  2 siblings, 0 replies; 4+ messages in thread
From: Jakub Kicinski @ 2020-10-14  1:38 UTC (permalink / raw)
  To: Cong Wang
  Cc: netdev, syzbot+4a2c52677a8a1aa283cb, Xie He, William Tu,
	Willem de Bruijn

On Mon, 12 Oct 2020 16:17:21 -0700 Cong Wang wrote:
> GRE tunnel has its own header_ops, ipgre_header_ops, and sets it
> conditionally. When it is set, it assumes the outer IP header is
> already created before ipgre_xmit().
> 
> This is not true when we send packets through a raw packet socket,
> where L2 headers are supposed to be constructed by user. Packet
> socket calls dev_validate_header() to validate the header. But
> GRE tunnel does not set dev->hard_header_len, so that check can
> be simply bypassed, therefore uninit memory could be passed down
> to ipgre_xmit(). Similar for dev->needed_headroom.
> 
> dev->hard_header_len is supposed to be the length of the header
> created by dev->header_ops->create(), so it should be used whenever
> header_ops is set, and dev->needed_headroom should be used when it
> is not set.
> 
> Reported-and-tested-by: syzbot+4a2c52677a8a1aa283cb@syzkaller.appspotmail.com
> Cc: Xie He <xie.he.0141@gmail.com>
> Cc: William Tu <u9012063@gmail.com>
> Acked-by: Willem de Bruijn <willemb@google.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

Applied, thank you!

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2020-10-14  1:38 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-12 23:17 [Patch net v3] ip_gre: set dev->hard_header_len and dev->needed_headroom properly Cong Wang
2020-10-13  1:46 ` Xie He
2020-10-13  1:56 ` Xie He
2020-10-14  1:38 ` Jakub Kicinski

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).