Message ID | 20180429165459.164538-1-edumazet@google.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
Series | [net] ipv6: fix uninit-value in ip6_multipath_l3_keys() | expand |
On Sun, 29 Apr 2018 09:54:59 -0700 Eric Dumazet <edumazet@google.com> wrote: > syzbot/KMSAN reported an uninit-value in ip6_multipath_l3_keys(), > root caused to a bad assumption of ICMP header being already > pulled in skb->head > > ip_multipath_l3_keys() does the correct thing, so it is an IPv6 only bug. > > BUG: KMSAN: uninit-value in ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline] > BUG: KMSAN: uninit-value in rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858 > CPU: 0 PID: 4507 Comm: syz-executor661 Not tainted 4.16.0+ #87 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:17 [inline] > dump_stack+0x185/0x1d0 lib/dump_stack.c:53 > kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 > __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683 > ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline] > rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858 > ip6_route_input+0x65a/0x920 net/ipv6/route.c:1884 > ip6_rcv_finish+0x413/0x6e0 net/ipv6/ip6_input.c:69 > NF_HOOK include/linux/netfilter.h:288 [inline] > ipv6_rcv+0x1e16/0x2340 net/ipv6/ip6_input.c:208 > __netif_receive_skb_core+0x47df/0x4a90 net/core/dev.c:4562 > __netif_receive_skb net/core/dev.c:4627 [inline] > netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701 > netif_receive_skb+0x230/0x240 net/core/dev.c:4725 > tun_rx_batched drivers/net/tun.c:1555 [inline] > tun_get_user+0x740f/0x7c60 drivers/net/tun.c:1962 > tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990 > call_write_iter include/linux/fs.h:1782 [inline] > new_sync_write fs/read_write.c:469 [inline] > __vfs_write+0x7fb/0x9f0 fs/read_write.c:482 > vfs_write+0x463/0x8d0 fs/read_write.c:544 > SYSC_write+0x172/0x360 fs/read_write.c:589 > SyS_write+0x55/0x80 fs/read_write.c:581 > do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 > entry_SYSCALL_64_after_hwframe+0x3d/0xa2 > > Fixes: 23aebdacb05d ("ipv6: Compute multipath hash for ICMP errors from offending packet") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: syzbot <syzkaller@googlegroups.com> > Cc: Jakub Sitnicki <jkbs@redhat.com> > --- > net/ipv6/route.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > index cde7d8251377c1a115e02c46843d361d3c0b4313..f4d61736c41abe8cd7f439c4a37100e90c1eacca 100644 > --- a/net/ipv6/route.c > +++ b/net/ipv6/route.c > @@ -1835,11 +1835,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb, > const struct ipv6hdr *inner_iph; > const struct icmp6hdr *icmph; > struct ipv6hdr _inner_iph; > + struct icmp6hdr _icmph; > > if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6)) > goto out; > > - icmph = icmp6_hdr(skb); > + icmph = skb_header_pointer(skb, skb_transport_offset(skb), > + sizeof(_icmph), &_icmph); > + if (!icmph) > + goto out; > + > if (icmph->icmp6_type != ICMPV6_DEST_UNREACH && > icmph->icmp6_type != ICMPV6_PKT_TOOBIG && > icmph->icmp6_type != ICMPV6_TIME_EXCEED && Thank you for the fix. I was not being careful there. Acked-by: Jakub Sitnicki <jkbs@redhat.com>
From: Eric Dumazet <edumazet@google.com> Date: Sun, 29 Apr 2018 09:54:59 -0700 > syzbot/KMSAN reported an uninit-value in ip6_multipath_l3_keys(), > root caused to a bad assumption of ICMP header being already > pulled in skb->head > > ip_multipath_l3_keys() does the correct thing, so it is an IPv6 only bug. ... > Fixes: 23aebdacb05d ("ipv6: Compute multipath hash for ICMP errors from offending packet") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: syzbot <syzkaller@googlegroups.com> Series applied and queued up for -stable, thanks.
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index cde7d8251377c1a115e02c46843d361d3c0b4313..f4d61736c41abe8cd7f439c4a37100e90c1eacca 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1835,11 +1835,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb, const struct ipv6hdr *inner_iph; const struct icmp6hdr *icmph; struct ipv6hdr _inner_iph; + struct icmp6hdr _icmph; if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6)) goto out; - icmph = icmp6_hdr(skb); + icmph = skb_header_pointer(skb, skb_transport_offset(skb), + sizeof(_icmph), &_icmph); + if (!icmph) + goto out; + if (icmph->icmp6_type != ICMPV6_DEST_UNREACH && icmph->icmp6_type != ICMPV6_PKT_TOOBIG && icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
syzbot/KMSAN reported an uninit-value in ip6_multipath_l3_keys(), root caused to a bad assumption of ICMP header being already pulled in skb->head ip_multipath_l3_keys() does the correct thing, so it is an IPv6 only bug. BUG: KMSAN: uninit-value in ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline] BUG: KMSAN: uninit-value in rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858 CPU: 0 PID: 4507 Comm: syz-executor661 Not tainted 4.16.0+ #87 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:53 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683 ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline] rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858 ip6_route_input+0x65a/0x920 net/ipv6/route.c:1884 ip6_rcv_finish+0x413/0x6e0 net/ipv6/ip6_input.c:69 NF_HOOK include/linux/netfilter.h:288 [inline] ipv6_rcv+0x1e16/0x2340 net/ipv6/ip6_input.c:208 __netif_receive_skb_core+0x47df/0x4a90 net/core/dev.c:4562 __netif_receive_skb net/core/dev.c:4627 [inline] netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701 netif_receive_skb+0x230/0x240 net/core/dev.c:4725 tun_rx_batched drivers/net/tun.c:1555 [inline] tun_get_user+0x740f/0x7c60 drivers/net/tun.c:1962 tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990 call_write_iter include/linux/fs.h:1782 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x7fb/0x9f0 fs/read_write.c:482 vfs_write+0x463/0x8d0 fs/read_write.c:544 SYSC_write+0x172/0x360 fs/read_write.c:589 SyS_write+0x55/0x80 fs/read_write.c:581 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Fixes: 23aebdacb05d ("ipv6: Compute multipath hash for ICMP errors from offending packet") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Jakub Sitnicki <jkbs@redhat.com> --- net/ipv6/route.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)