From patchwork Mon Nov 28 21:18:06 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 700157 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3tSKLs3vnLz9vFD for ; Tue, 29 Nov 2016 08:19:33 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="LBZVdvk4"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755098AbcK1VTP (ORCPT ); Mon, 28 Nov 2016 16:19:15 -0500 Received: from mail-pg0-f68.google.com ([74.125.83.68]:34800 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754172AbcK1VTJ (ORCPT ); Mon, 28 Nov 2016 16:19:09 -0500 Received: by mail-pg0-f68.google.com with SMTP id e9so14106780pgc.1; Mon, 28 Nov 2016 13:19:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:subject:from:to:cc:date:in-reply-to:references :mime-version:content-transfer-encoding; bh=IyqIpWbwgEK+30UC6cjzmITdGX0xov843wfWmwEkZwQ=; b=LBZVdvk4ko/yxmWk6+poIws/LNQ7eDkyD5ea3njE1AGciTUtLz6P4/FYKdAJdOOQjt tX1UzbamYUqyyE8fQ4uc8ecbNFFspULIo4dm1vLfJ4duA+aEZbybM1IAeFwDaPj7YWgx E8PLpDpEMxYWB3w64ZdTiXVDr8mgBxul0nF03X+FiV31zJe2dlisjOXRM1N1/la4EaXp nFfeL26SwPpganaf4X3gpLXtvpwGJvJcD5cgJSt5TaMX+sWhMBe8rUfD/OnDXsnSM+y4 Ap0GmIkINtuPEy6sHqmoSDKZL2JpuCaouGdJJtxqaR2VVnF9D3V5oQZiyMB3DoFHbqaI vunQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:subject:from:to:cc:date:in-reply-to :references:mime-version:content-transfer-encoding; bh=IyqIpWbwgEK+30UC6cjzmITdGX0xov843wfWmwEkZwQ=; b=jwI5t6cB6Ekv3rdZ+lEvldCzBB14ESjwHyMv2+1dWu25tcsJS9hl8uLYh2kUgGhzI8 8YAWJCmpwAVjI38crPr3Mr8oBfqkzLOaHQg2W0RUd0O51HdDSH+z/Rac50LycsjtsCi3 Jg28UPOOLlbmXtIAIPS4EzfydvB3F5qrFb9DSoI/LCg/3vM2N2A1A+P0dEvShTCRcssm mlrhQa/+lnX2yvV379qoIk7jqxfqrIo47cLjB6x7cUnSR/xoGLJxfo+xBc+4ccjUoQRB UhdpNB7TI4EDVfktSbUnQkE0Y7pz0Ou3Oh6W+QLpgpQkKVIGvrCf3NUcQ9c2F11/BiBi 0HBg== X-Gm-Message-State: AKaTC01AlBPVJ5kIh4bFy3jdbTYbAsCJZNfsdH2E3KBzy4yXPnFkgDFzSo1PlB/JKanhzw== X-Received: by 10.84.210.233 with SMTP id a96mr53752093pli.72.1480367948542; Mon, 28 Nov 2016 13:19:08 -0800 (PST) Received: from [172.19.22.200] ([172.19.22.200]) by smtp.googlemail.com with ESMTPSA id q9sm89409144pfg.47.2016.11.28.13.19.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Nov 2016 13:19:07 -0800 (PST) Message-ID: <1480367886.18162.88.camel@edumazet-glaptop3.roam.corp.google.com> Subject: Re: net: GPF in eth_header From: Eric Dumazet To: Dmitry Vyukov Cc: Florian Westphal , syzkaller , Hannes Frederic Sowa , David Miller , Tom Herbert , Alexander Duyck , Jiri Benc , Sabrina Dubroca , netdev , LKML Date: Mon, 28 Nov 2016 13:18:06 -0800 In-Reply-To: <1480367152.18162.86.camel@edumazet-glaptop3.roam.corp.google.com> References: <1480359019.18162.79.camel@edumazet-glaptop3.roam.corp.google.com> <1480362459.18162.83.camel@edumazet-glaptop3.roam.corp.google.com> <1480367152.18162.86.camel@edumazet-glaptop3.roam.corp.google.com> X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Mon, 2016-11-28 at 13:05 -0800, Eric Dumazet wrote: > On Mon, 2016-11-28 at 11:47 -0800, Eric Dumazet wrote: > > On Mon, 2016-11-28 at 20:34 +0100, Dmitry Vyukov wrote: > > > On Mon, Nov 28, 2016 at 8:04 PM, 'Andrey Konovalov' via syzkaller > > > > > > Hi Eric, > > > > > > > > As far as I can see, skb_network_offset() becomes negative after > > > > pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data) in nf_ct_frag6_queue(). > > > > At least I'm able to detect that with a BUG_ON(). > > > > > > > > Also it seems that the issue is only reproducible (at least with the > > > > poc I provided) for a short time after boot. > > > > > > > > > Eric, > > > > > > Is it enough to debug? Or maybe Andrey can trace some values for you. > > > > Well, now we are talking, if you tell me how many modules you load, it > > might help ;) > > > > nf_ct_frag6_queue is nowhere to be seen in my kernels, that might > > explain why I could not reproduce the bug. > > > > Let me try ;) > > > > Might be a bug added in commit daaa7d647f81f3 > ("netfilter: ipv6: avoid nf_iterate recursion") > > Florian, what do you think of dropping a packet that presumably was > mangled badly by nf_ct_frag6_queue() ? > > (Like about 48 byte pulled :(, and/or skb->csum changed ) > > diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c > index f7aab5ab93a5..31aa947332d8 100644 > --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c > +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c > @@ -65,8 +65,8 @@ static unsigned int ipv6_defrag(void *priv, > > err = nf_ct_frag6_gather(state->net, skb, > nf_ct6_defrag_user(state->hook, skb)); > - /* queued */ > - if (err == -EINPROGRESS) > + /* queued or mangled ... */ > + if (err) > return NF_STOLEN; Or more exactly , returning NF_DROP so that skb is really freed ;) diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index f7aab5ab93a5..508739a3ca2a 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c @@ -65,9 +65,9 @@ static unsigned int ipv6_defrag(void *priv, err = nf_ct_frag6_gather(state->net, skb, nf_ct6_defrag_user(state->hook, skb)); - /* queued */ - if (err == -EINPROGRESS) - return NF_STOLEN; + /* queued or mangled ... */ + if (err) + return (err == -EINPROGRESS) ? NF_STOLEN : NF_DROP; return NF_ACCEPT; }