From patchwork Sun Apr 29 16:54:59 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 906382 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="hOSM7NKa"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40Yv1C5Xncz9rxx for ; Mon, 30 Apr 2018 02:55:11 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753682AbeD2QzG (ORCPT ); Sun, 29 Apr 2018 12:55:06 -0400 Received: from mail-wr0-f194.google.com ([209.85.128.194]:35418 "EHLO mail-wr0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753550AbeD2QzF (ORCPT ); Sun, 29 Apr 2018 12:55:05 -0400 Received: by mail-wr0-f194.google.com with SMTP id i14-v6so2819136wre.2 for ; Sun, 29 Apr 2018 09:55:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=FrR/np1BbowtwSmJkumlP318ozucvaab2USPsNKeOa4=; b=hOSM7NKaAFec2yfKEub8/ytrDp3Qo9dk/gcLHjM6+EmrdexhMKXzySW7y+x2vGGsVy Ox8uCKO/beITCeVki2w0vAihSR4no7khNT9XTu7yWevOA3ykBB7AwCeTzY+cKmlngTK5 JrY48H5rdQnhe0shCfZUWYNe3yN2Rh6WXX2Al19UNmP3zQAItc65L6mAJMsd95ssv6Sc dbULn0v3GnRDsVIZoIMmk1tIeit8D/SZjQ87KfBjGCi7bsjMMKx8dQVriY5ZAM9oMTai j04JI+e1JFyGt1vPWy8cNmmmvmtwi+F2kiwfaWLr3uIMSBaaYwjyO1GddJmQz09AHYTC 6X3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=FrR/np1BbowtwSmJkumlP318ozucvaab2USPsNKeOa4=; b=UwIJ/dD4jPM9pSF1d+UVw12rHZ15WUD+5mRUY57nmOCkkji3BWa/+ChA5mZGv5uwDG mO70XXzRsldbFZTATisDpsCxVw+Hwp6hf3moq/f9CjpjD2zLNoJWH7ExIL4nI1jsDzCy xfJEGjxGwO96H8sl3B8a4KtvR7kEIuLCn6+kGbqmWXpD7Os8zoyCaZtuO66jsYtVvGTo UK/dp3FUfu3Rjtgj1YGNDCaFl0YXQV2JjcMbDFg6r74ta/L47TgI7LOxYEVvV0gvzHvw CYuH4zOflqrJJH43DTOk/H99PMhCafA8XJcBskSsekUtjFnkxzG/LW9YlaZVnb61xvHs 5d3Q== X-Gm-Message-State: ALQs6tDMSyzdOUaRXoyHG0Yy9p6KDcbLrUrlupbCFV5hXzI0VY/5O1jL r58X+rkf8f2j8EHpcofmwrgWdQ== X-Google-Smtp-Source: AB8JxZrSVImtr2RkMWYvJZUrDABM/WOf5xeAjD8CO3lBClGAZLQSRHv0YzTNpy+NwHD1OVKo4J8scQ== X-Received: by 2002:adf:ad61:: with SMTP id p88-v6mr6375216wrc.24.1525020904021; Sun, 29 Apr 2018 09:55:04 -0700 (PDT) Received: from localhost ([2620:15c:2c4:201:f5a:7eca:440a:3ead]) by smtp.gmail.com with ESMTPSA id p7-v6sm5791375wrj.85.2018.04.29.09.55.02 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sun, 29 Apr 2018 09:55:03 -0700 (PDT) From: Eric Dumazet To: "David S . Miller" Cc: netdev , Eric Dumazet , Eric Dumazet , Jakub Sitnicki Subject: [PATCH net] ipv6: fix uninit-value in ip6_multipath_l3_keys() Date: Sun, 29 Apr 2018 09:54:59 -0700 Message-Id: <20180429165459.164538-1-edumazet@google.com> X-Mailer: git-send-email 2.17.0.441.gb46fe60e1d-goog Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org syzbot/KMSAN reported an uninit-value in ip6_multipath_l3_keys(), root caused to a bad assumption of ICMP header being already pulled in skb->head ip_multipath_l3_keys() does the correct thing, so it is an IPv6 only bug. BUG: KMSAN: uninit-value in ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline] BUG: KMSAN: uninit-value in rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858 CPU: 0 PID: 4507 Comm: syz-executor661 Not tainted 4.16.0+ #87 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:53 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683 ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline] rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858 ip6_route_input+0x65a/0x920 net/ipv6/route.c:1884 ip6_rcv_finish+0x413/0x6e0 net/ipv6/ip6_input.c:69 NF_HOOK include/linux/netfilter.h:288 [inline] ipv6_rcv+0x1e16/0x2340 net/ipv6/ip6_input.c:208 __netif_receive_skb_core+0x47df/0x4a90 net/core/dev.c:4562 __netif_receive_skb net/core/dev.c:4627 [inline] netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701 netif_receive_skb+0x230/0x240 net/core/dev.c:4725 tun_rx_batched drivers/net/tun.c:1555 [inline] tun_get_user+0x740f/0x7c60 drivers/net/tun.c:1962 tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990 call_write_iter include/linux/fs.h:1782 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x7fb/0x9f0 fs/read_write.c:482 vfs_write+0x463/0x8d0 fs/read_write.c:544 SYSC_write+0x172/0x360 fs/read_write.c:589 SyS_write+0x55/0x80 fs/read_write.c:581 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Fixes: 23aebdacb05d ("ipv6: Compute multipath hash for ICMP errors from offending packet") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Jakub Sitnicki Acked-by: Jakub Sitnicki --- net/ipv6/route.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index cde7d8251377c1a115e02c46843d361d3c0b4313..f4d61736c41abe8cd7f439c4a37100e90c1eacca 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1835,11 +1835,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb, const struct ipv6hdr *inner_iph; const struct icmp6hdr *icmph; struct ipv6hdr _inner_iph; + struct icmp6hdr _icmph; if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6)) goto out; - icmph = icmp6_hdr(skb); + icmph = skb_header_pointer(skb, skb_transport_offset(skb), + sizeof(_icmph), &_icmph); + if (!icmph) + goto out; + if (icmph->icmp6_type != ICMPV6_DEST_UNREACH && icmph->icmp6_type != ICMPV6_PKT_TOOBIG && icmph->icmp6_type != ICMPV6_TIME_EXCEED &&