From patchwork Wed Jan 17 22:21:13 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 862618 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="KwN5YxzF"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zMM4m0fd9z9t66 for ; Thu, 18 Jan 2018 09:21:28 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753505AbeAQWVS (ORCPT ); Wed, 17 Jan 2018 17:21:18 -0500 Received: from mail-pf0-f194.google.com ([209.85.192.194]:41152 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753302AbeAQWVQ (ORCPT ); Wed, 17 Jan 2018 17:21:16 -0500 Received: by mail-pf0-f194.google.com with SMTP id j3so12565486pfh.8 for ; Wed, 17 Jan 2018 14:21:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=QULWSpJBsdf1zr/MOIrWIf2+qZR3sNn7/vWvoJVVt0g=; b=KwN5YxzFUWw1rcw4j8u2ubGxaZW7Hz09ZG/MaWV6skPLaeP+2QAEFHBTJeE6bOaC8p tszTe5nkleIw/ETE64w18hdYeSDhZuglPYC/pU72N2PjaXbBxVk41AQTyjsa0B5jEb0O kgsSJHcJEoFkNnuHo1lBXui67AxvJG43/YE/K+Umgot/gtMKBtr9PHPndTiZrtjFTFf/ vdfFR/xg0tWr1dvskzQmy4OtB9cBTd8szSC/Hd4HXw0fuCaO06jQhqT6JlpC/hL3dpuH U+5RlnF7Z66FmSWdT9U9Tz5h3cyZh28PyPtG1fxfA0h58AiJbsLf69EgzTPHjdfCMX5f Jp+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=QULWSpJBsdf1zr/MOIrWIf2+qZR3sNn7/vWvoJVVt0g=; b=IzXAGZMib+9bB8NIr5rD7fGixMAXBxdwwSIWpfWWkd1LF1QOzOwICHUPKnJLgMwpn6 gGO36AjWlPivWHtZl7KqJjyKnNMx9ZpBQa7KO5A/Pc66OQanR3JIbHTsUGHICPwMxN/v Be+BeXCdkhOU+vGuaVT9rURap1QOt8C6FnKNRM2cW/9guKqzIaWXxR/z93JP5xqFdiIw z9UsiqHSreVIZwXShR51R6EJR4tUOFgN4YOz9NikQBhWbVEjJJUsaga37y6dxVPFazQz eqm7Gi2TCiRip2ENhwPEWusONwYWN1Nxpr0b50+NnlCZGoUjdxEhxqtuortgTc+vs0Sg 2MVw== X-Gm-Message-State: AKwxyteBAi4Rr/X+5YDI0OTq9YLchns5Ci+EoFE5NeH+grRgpvt3LVMO A/E84Z3fcQnGc5I3vi9ye+k= X-Google-Smtp-Source: ACJfBotpuit0kq1qH+9wI6Xv6ahXZtLp69nAPgbN9x7lvXFp/IvxvBkG/Q17SI3rcL1noKVXseqkFQ== X-Received: by 10.98.74.133 with SMTP id c5mr28168251pfj.188.1516227675999; Wed, 17 Jan 2018 14:21:15 -0800 (PST) Received: from ?IPv6:2620:15c:2c1:100:3fe9:f33:c853:df11? ([2620:15c:2c1:100:3fe9:f33:c853:df11]) by smtp.googlemail.com with ESMTPSA id j62sm9609493pfc.18.2018.01.17.14.21.14 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 17 Jan 2018 14:21:14 -0800 (PST) Message-ID: <1516227673.3606.16.camel@gmail.com> Subject: [PATCH net] flow_dissector: properly cap thoff field From: Eric Dumazet To: David Miller Cc: netdev , Willem de Bruijn Date: Wed, 17 Jan 2018 14:21:13 -0800 X-Mailer: Evolution 3.22.6-1+deb9u1 Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Eric Dumazet syzbot reported yet another crash [1] that is caused by insufficient validation of DODGY packets. Two bugs are happening here to trigger the crash. 1) Flow dissection leaves with incorrect thoff field. 2) skb_probe_transport_header() sets transport header to this invalid thoff, even if pointing after skb valid data. 3) qdisc_pkt_len_init() reads out-of-bound data because it trusts tcp_hdrlen(skb) Possible fixes : - Full flow dissector validation before injecting bad DODGY packets in the stack. This approach was attempted here : https://patchwork.ozlabs.org/patch/ 861874/ - Have more robust functions in the core. This might be needed anyway for stable versions. This patch fixes the flow dissection issue. [1] CPU: 1 PID: 3144 Comm: syzkaller271204 Not tainted 4.15.0-rc4-mm1+ #49 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:355 [inline] kasan_report+0x23b/0x360 mm/kasan/report.c:413 __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:432 __tcp_hdrlen include/linux/tcp.h:35 [inline] tcp_hdrlen include/linux/tcp.h:40 [inline] qdisc_pkt_len_init net/core/dev.c:3160 [inline] __dev_queue_xmit+0x20d3/0x2200 net/core/dev.c:3465 dev_queue_xmit+0x17/0x20 net/core/dev.c:3554 packet_snd net/packet/af_packet.c:2943 [inline] packet_sendmsg+0x3ad5/0x60a0 net/packet/af_packet.c:2968 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 sock_write_iter+0x31a/0x5d0 net/socket.c:907 call_write_iter include/linux/fs.h:1776 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x684/0x970 fs/read_write.c:482 vfs_write+0x189/0x510 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xef/0x220 fs/read_write.c:581 entry_SYSCALL_64_fastpath+0x1f/0x96 Fixes: 34fad54c2537 ("net: __skb_flow_dissect() must cap its return value") Fixes: a6e544b0a88b ("flow_dissector: Jump to exit code in __skb_flow_dissect") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Reported-by: syzbot Acked-by: Jason Wang ---  net/core/flow_dissector.c |    3 +--  1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c index 15ce300637650e17fcab7e378b20fe7972686d46..544bddf08e13c7f6e47aadc737244c9ba5af56b2 100644 --- a/net/core/flow_dissector.c +++ b/net/core/flow_dissector.c @@ -976,8 +976,8 @@ bool __skb_flow_dissect(const struct sk_buff *skb, out_good: ret = true; - key_control->thoff = (u16)nhoff; out: + key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); key_basic->n_proto = proto; key_basic->ip_proto = ip_proto; @@ -985,7 +985,6 @@ bool __skb_flow_dissect(const struct sk_buff *skb, out_bad: ret = false; - key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); goto out; } EXPORT_SYMBOL(__skb_flow_dissect);