* [PATCH] net: core: sk_buff: zero-fill skb->data in __alloc_skb function
@ 2021-04-10 9:51 Phillip Potter
2021-04-10 10:12 ` Eric Dumazet
0 siblings, 1 reply; 4+ messages in thread
From: Phillip Potter @ 2021-04-10 9:51 UTC (permalink / raw)
To: davem
Cc: kuba, willemb, linmiaohe, edumazet, linyunsheng, alobakin, elver,
gnault, dseok.yi, viro, vladimir.oltean, netdev, linux-kernel
Zero-fill skb->data in __alloc_skb function of net/core/skbuff.c,
up to start of struct skb_shared_info bytes. Fixes a KMSAN-found
uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=abe95dc3e3e9667fc23b8d81f29ecad95c6f106f
Reported-by: syzbot+2e406a9ac75bb71d4b7a@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
---
net/core/skbuff.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 785daff48030..9ac26cdb5417 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -215,6 +215,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
* to allow max possible filling before reallocation.
*/
size = SKB_WITH_OVERHEAD(ksize(data));
+ memset(data, 0, size);
prefetchw(data + size);
/*
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] net: core: sk_buff: zero-fill skb->data in __alloc_skb function
2021-04-10 9:51 [PATCH] net: core: sk_buff: zero-fill skb->data in __alloc_skb function Phillip Potter
@ 2021-04-10 10:12 ` Eric Dumazet
2021-04-10 11:00 ` Eric Dumazet
0 siblings, 1 reply; 4+ messages in thread
From: Eric Dumazet @ 2021-04-10 10:12 UTC (permalink / raw)
To: Phillip Potter
Cc: davem, kuba, willemb, linmiaohe, linyunsheng, alobakin, elver,
gnault, dseok.yi, viro, vladimir.oltean, netdev, linux-kernel
On Sat, Apr 10, 2021 at 11:51 AM Phillip Potter <phil@philpotter.co.uk> wrote:
>
> Zero-fill skb->data in __alloc_skb function of net/core/skbuff.c,
> up to start of struct skb_shared_info bytes. Fixes a KMSAN-found
> uninit-value bug reported by syzbot at:
> https://syzkaller.appspot.com/bug?id=abe95dc3e3e9667fc23b8d81f29ecad95c6f106f
>
> Reported-by: syzbot+2e406a9ac75bb71d4b7a@syzkaller.appspotmail.com
> Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
> ---
> net/core/skbuff.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 785daff48030..9ac26cdb5417 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -215,6 +215,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
> * to allow max possible filling before reallocation.
> */
> size = SKB_WITH_OVERHEAD(ksize(data));
> + memset(data, 0, size);
> prefetchw(data + size);
Certainly not.
There is a difference between kmalloc() and kzalloc()
Here you are basically silencing KMSAN and make it useless.
Please fix the real issue, or stop using KMSAN if it bothers you.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] net: core: sk_buff: zero-fill skb->data in __alloc_skb function
2021-04-10 10:12 ` Eric Dumazet
@ 2021-04-10 11:00 ` Eric Dumazet
2021-04-10 23:33 ` Phillip Potter
0 siblings, 1 reply; 4+ messages in thread
From: Eric Dumazet @ 2021-04-10 11:00 UTC (permalink / raw)
To: Phillip Potter
Cc: David Miller, Jakub Kicinski, Willem de Bruijn, linmiaohe,
Yunsheng Lin, Alexander Lobakin, Marco Elver, Guillaume Nault,
Dongseok Yi, Al Viro, vladimir.oltean, netdev, LKML
On Sat, Apr 10, 2021 at 12:12 PM Eric Dumazet <edumazet@google.com> wrote:
>
> On Sat, Apr 10, 2021 at 11:51 AM Phillip Potter <phil@philpotter.co.uk> wrote:
> >
> > Zero-fill skb->data in __alloc_skb function of net/core/skbuff.c,
> > up to start of struct skb_shared_info bytes. Fixes a KMSAN-found
> > uninit-value bug reported by syzbot at:
> > https://syzkaller.appspot.com/bug?id=abe95dc3e3e9667fc23b8d81f29ecad95c6f106f
> >
> > Reported-by: syzbot+2e406a9ac75bb71d4b7a@syzkaller.appspotmail.com
> > Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
> > ---
> > net/core/skbuff.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> > index 785daff48030..9ac26cdb5417 100644
> > --- a/net/core/skbuff.c
> > +++ b/net/core/skbuff.c
> > @@ -215,6 +215,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
> > * to allow max possible filling before reallocation.
> > */
> > size = SKB_WITH_OVERHEAD(ksize(data));
> > + memset(data, 0, size);
> > prefetchw(data + size);
>
>
> Certainly not.
>
> There is a difference between kmalloc() and kzalloc()
>
> Here you are basically silencing KMSAN and make it useless.
>
> Please fix the real issue, or stop using KMSAN if it bothers you.
My understanding of the KMSAN bug (when I released it months ago) was
that it was triggered by some invalid assumptions in geneve_xmit()
The syzbot repro sends a packet with a very small size (Ethernet
header only) and no IP/IPv6 header
Fix for ipv4 part (sorry, not much time during week end to test all this)
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index e3b2375ac5eb55f544bbc1f309886cc9be189fd1..0a72779bc74bc50c20c34c05b2c525cca829f33c
100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -892,6 +892,9 @@ static int geneve_xmit_skb(struct sk_buff *skb,
struct net_device *dev,
__be16 sport;
int err;
+ if (!pskb_network_may_pull(skb, sizeof(struct iphdr))
+ return -EINVAL;
+
sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info,
geneve->cfg.info.key.tp_dst, sport);
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] net: core: sk_buff: zero-fill skb->data in __alloc_skb function
2021-04-10 11:00 ` Eric Dumazet
@ 2021-04-10 23:33 ` Phillip Potter
0 siblings, 0 replies; 4+ messages in thread
From: Phillip Potter @ 2021-04-10 23:33 UTC (permalink / raw)
To: Eric Dumazet
Cc: David Miller, Jakub Kicinski, Willem de Bruijn, linmiaohe,
Yunsheng Lin, Alexander Lobakin, Marco Elver, Guillaume Nault,
Dongseok Yi, Al Viro, vladimir.oltean, netdev, LKML
On Sat, Apr 10, 2021 at 01:00:34PM +0200, Eric Dumazet wrote:
> On Sat, Apr 10, 2021 at 12:12 PM Eric Dumazet <edumazet@google.com> wrote:
> >
> > On Sat, Apr 10, 2021 at 11:51 AM Phillip Potter <phil@philpotter.co.uk> wrote:
> > >
> > > Zero-fill skb->data in __alloc_skb function of net/core/skbuff.c,
> > > up to start of struct skb_shared_info bytes. Fixes a KMSAN-found
> > > uninit-value bug reported by syzbot at:
> > > https://syzkaller.appspot.com/bug?id=abe95dc3e3e9667fc23b8d81f29ecad95c6f106f
> > >
> > > Reported-by: syzbot+2e406a9ac75bb71d4b7a@syzkaller.appspotmail.com
> > > Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
> > > ---
> > > net/core/skbuff.c | 1 +
> > > 1 file changed, 1 insertion(+)
> > >
> > > diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> > > index 785daff48030..9ac26cdb5417 100644
> > > --- a/net/core/skbuff.c
> > > +++ b/net/core/skbuff.c
> > > @@ -215,6 +215,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
> > > * to allow max possible filling before reallocation.
> > > */
> > > size = SKB_WITH_OVERHEAD(ksize(data));
> > > + memset(data, 0, size);
> > > prefetchw(data + size);
> >
> >
> > Certainly not.
> >
> > There is a difference between kmalloc() and kzalloc()
> >
> > Here you are basically silencing KMSAN and make it useless.
> >
> > Please fix the real issue, or stop using KMSAN if it bothers you.
>
> My understanding of the KMSAN bug (when I released it months ago) was
> that it was triggered by some invalid assumptions in geneve_xmit()
>
> The syzbot repro sends a packet with a very small size (Ethernet
> header only) and no IP/IPv6 header
>
> Fix for ipv4 part (sorry, not much time during week end to test all this)
>
> diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
> index e3b2375ac5eb55f544bbc1f309886cc9be189fd1..0a72779bc74bc50c20c34c05b2c525cca829f33c
> 100644
> --- a/drivers/net/geneve.c
> +++ b/drivers/net/geneve.c
> @@ -892,6 +892,9 @@ static int geneve_xmit_skb(struct sk_buff *skb,
> struct net_device *dev,
> __be16 sport;
> int err;
>
> + if (!pskb_network_may_pull(skb, sizeof(struct iphdr))
> + return -EINVAL;
> +
> sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
> rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info,
> geneve->cfg.info.key.tp_dst, sport);
Dear Eric,
Thank you for your help/feedback. I have crafted a patch using your code
above and the equivalent check for geneve6_xmit_skb, and this works for
me on my local KMSAN build. I am also running it through syzbot to check
there as well. I will send out with appropriate attribution assuming all
is OK on the testing front.
Regards,
Phil
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-04-10 23:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-10 9:51 [PATCH] net: core: sk_buff: zero-fill skb->data in __alloc_skb function Phillip Potter
2021-04-10 10:12 ` Eric Dumazet
2021-04-10 11:00 ` Eric Dumazet
2021-04-10 23:33 ` Phillip Potter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).