lkml.org 
[lkml]   [2018]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.17 19/66] net: skb_segment() should not return NULL
    Date
    4.17-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit ff907a11a0d68a749ce1a321f4505c03bf72190c ]

    syzbot caught a NULL deref [1], caused by skb_segment()

    skb_segment() has many "goto err;" that assume the @err variable
    contains -ENOMEM.

    A successful call to __skb_linearize() should not clear @err,
    otherwise a subsequent memory allocation error could return NULL.

    While we are at it, we might use -EINVAL instead of -ENOMEM when
    MAX_SKB_FRAGS limit is reached.

    [1]
    kasan: CONFIG_KASAN_INLINE enabled
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] SMP KASAN
    CPU: 0 PID: 13285 Comm: syz-executor3 Not tainted 4.18.0-rc4+ #146
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    RIP: 0010:tcp_gso_segment+0x3dc/0x1780 net/ipv4/tcp_offload.c:106
    Code: f0 ff ff 0f 87 1c fd ff ff e8 00 88 0b fb 48 8b 75 d0 48 b9 00 00 00 00 00 fc ff df 48 8d be 90 00 00 00 48 89 f8 48 c1 e8 03 <0f> b6 14 08 48 8d 86 94 00 00 00 48 89 c6 83 e0 07 48 c1 ee 03 0f
    RSP: 0018:ffff88019b7fd060 EFLAGS: 00010206
    RAX: 0000000000000012 RBX: 0000000000000020 RCX: dffffc0000000000
    RDX: 0000000000040000 RSI: 0000000000000000 RDI: 0000000000000090
    RBP: ffff88019b7fd0f0 R08: ffff88019510e0c0 R09: ffffed003b5c46d6
    R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: 0000000000000001
    R13: ffff8801d6c581f4 R14: 0000000000000000 R15: ffff8801d6c58128
    FS: 00007fcae64d6700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00000000004e8664 CR3: 00000001b669b000 CR4: 00000000001406f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
    tcp4_gso_segment+0x1c3/0x440 net/ipv4/tcp_offload.c:54
    inet_gso_segment+0x64e/0x12d0 net/ipv4/af_inet.c:1342
    inet_gso_segment+0x64e/0x12d0 net/ipv4/af_inet.c:1342
    skb_mac_gso_segment+0x3b5/0x740 net/core/dev.c:2792
    __skb_gso_segment+0x3c3/0x880 net/core/dev.c:2865
    skb_gso_segment include/linux/netdevice.h:4099 [inline]
    validate_xmit_skb+0x640/0xf30 net/core/dev.c:3104
    __dev_queue_xmit+0xc14/0x3910 net/core/dev.c:3561
    dev_queue_xmit+0x17/0x20 net/core/dev.c:3602
    neigh_hh_output include/net/neighbour.h:473 [inline]
    neigh_output include/net/neighbour.h:481 [inline]
    ip_finish_output2+0x1063/0x1860 net/ipv4/ip_output.c:229
    ip_finish_output+0x841/0xfa0 net/ipv4/ip_output.c:317
    NF_HOOK_COND include/linux/netfilter.h:276 [inline]
    ip_output+0x223/0x880 net/ipv4/ip_output.c:405
    dst_output include/net/dst.h:444 [inline]
    ip_local_out+0xc5/0x1b0 net/ipv4/ip_output.c:124
    iptunnel_xmit+0x567/0x850 net/ipv4/ip_tunnel_core.c:91
    ip_tunnel_xmit+0x1598/0x3af1 net/ipv4/ip_tunnel.c:778
    ipip_tunnel_xmit+0x264/0x2c0 net/ipv4/ipip.c:308
    __netdev_start_xmit include/linux/netdevice.h:4148 [inline]
    netdev_start_xmit include/linux/netdevice.h:4157 [inline]
    xmit_one net/core/dev.c:3034 [inline]
    dev_hard_start_xmit+0x26c/0xc30 net/core/dev.c:3050
    __dev_queue_xmit+0x29ef/0x3910 net/core/dev.c:3569
    dev_queue_xmit+0x17/0x20 net/core/dev.c:3602
    neigh_direct_output+0x15/0x20 net/core/neighbour.c:1403
    neigh_output include/net/neighbour.h:483 [inline]
    ip_finish_output2+0xa67/0x1860 net/ipv4/ip_output.c:229
    ip_finish_output+0x841/0xfa0 net/ipv4/ip_output.c:317
    NF_HOOK_COND include/linux/netfilter.h:276 [inline]
    ip_output+0x223/0x880 net/ipv4/ip_output.c:405
    dst_output include/net/dst.h:444 [inline]
    ip_local_out+0xc5/0x1b0 net/ipv4/ip_output.c:124
    ip_queue_xmit+0x9df/0x1f80 net/ipv4/ip_output.c:504
    tcp_transmit_skb+0x1bf9/0x3f10 net/ipv4/tcp_output.c:1168
    tcp_write_xmit+0x1641/0x5c20 net/ipv4/tcp_output.c:2363
    __tcp_push_pending_frames+0xb2/0x290 net/ipv4/tcp_output.c:2536
    tcp_push+0x638/0x8c0 net/ipv4/tcp.c:735
    tcp_sendmsg_locked+0x2ec5/0x3f00 net/ipv4/tcp.c:1410
    tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1447
    inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
    sock_sendmsg_nosec net/socket.c:641 [inline]
    sock_sendmsg+0xd5/0x120 net/socket.c:651
    __sys_sendto+0x3d7/0x670 net/socket.c:1797
    __do_sys_sendto net/socket.c:1809 [inline]
    __se_sys_sendto net/socket.c:1805 [inline]
    __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1805
    do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x455ab9
    Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007fcae64d5c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
    RAX: ffffffffffffffda RBX: 00007fcae64d66d4 RCX: 0000000000455ab9
    RDX: 0000000000000001 RSI: 0000000020000200 RDI: 0000000000000013
    RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014
    R13: 00000000004c1145 R14: 00000000004d1818 R15: 0000000000000006
    Modules linked in:
    Dumping ftrace buffer:
    (ftrace buffer empty)

    Fixes: ddff00d42043 ("net: Move skb_has_shared_frag check out of GRE code and into segmentation")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Alexander Duyck <alexander.h.duyck@intel.com>
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Acked-by: Alexander Duyck <alexander.h.duyck@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/core/skbuff.c | 10 +++++-----
    1 file changed, 5 insertions(+), 5 deletions(-)

    --- a/net/core/skbuff.c
    +++ b/net/core/skbuff.c
    @@ -3705,6 +3705,7 @@ normal:
    net_warn_ratelimited(
    "skb_segment: too many frags: %u %u\n",
    pos, mss);
    + err = -EINVAL;
    goto err;
    }

    @@ -3738,11 +3739,10 @@ skip_fraglist:

    perform_csum_check:
    if (!csum) {
    - if (skb_has_shared_frag(nskb)) {
    - err = __skb_linearize(nskb);
    - if (err)
    - goto err;
    - }
    + if (skb_has_shared_frag(nskb) &&
    + __skb_linearize(nskb))
    + goto err;
    +
    if (!nskb->remcsum_offload)
    nskb->ip_summed = CHECKSUM_NONE;
    SKB_GSO_CB(nskb)->csum =

    \
     
     \ /
      Last update: 2018-07-27 11:54    [W:4.475 / U:0.552 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site