
commit 61431a5907fc36d0738e9a547c7e1556349a03e9 upstream. Commit 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") added a call to dev_parse_header_protocol() but mac_header is not yet set. This means that eth_hdr() reads complete garbage, and syzbot complained about it [1] This patch resets mac_header earlier, to get more coverage about this change. Audit of virtio_net_hdr_to_skb() callers shows that this change should be safe. [1] BUG: KASAN: use-after-free in eth_header_parse_protocol+0xdc/0xe0 net/ethernet/eth.c:282 Read of size 2 at addr ffff888017a6200b by task syz-executor313/8409 CPU: 1 PID: 8409 Comm: syz-executor313 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 eth_header_parse_protocol+0xdc/0xe0 net/ethernet/eth.c:282 dev_parse_header_protocol include/linux/netdevice.h:3177 [inline] virtio_net_hdr_to_skb.constprop.0+0x99d/0xcd0 include/linux/virtio_net.h:83 packet_snd net/packet/af_packet.c:2994 [inline] packet_sendmsg+0x2325/0x52b0 net/packet/af_packet.c:3031 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 sock_no_sendpage+0xf3/0x130 net/core/sock.c:2860 kernel_sendpage.part.0+0x1ab/0x350 net/socket.c:3631 kernel_sendpage net/socket.c:3628 [inline] sock_sendpage+0xe5/0x140 net/socket.c:947 pipe_to_sendpage+0x2ad/0x380 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x43e/0x8a0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0xd4/0x140 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0xb7e/0x1940 fs/splice.c:1079 __do_splice+0x134/0x250 fs/splice.c:1144 __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice fs/splice.c:1332 [inline] __x64_sys_splice+0x198/0x250 fs/splice.c:1332 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Balazs Nemeth <bnemeth@redhat.com> Cc: Willem de Bruijn <willemb@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
177 lines
4.6 KiB
C
177 lines
4.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _LINUX_VIRTIO_NET_H
|
|
#define _LINUX_VIRTIO_NET_H
|
|
|
|
#include <linux/if_vlan.h>
|
|
#include <uapi/linux/tcp.h>
|
|
#include <uapi/linux/udp.h>
|
|
#include <uapi/linux/virtio_net.h>
|
|
|
|
static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
|
|
const struct virtio_net_hdr *hdr)
|
|
{
|
|
switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
|
|
case VIRTIO_NET_HDR_GSO_TCPV4:
|
|
case VIRTIO_NET_HDR_GSO_UDP:
|
|
skb->protocol = cpu_to_be16(ETH_P_IP);
|
|
break;
|
|
case VIRTIO_NET_HDR_GSO_TCPV6:
|
|
skb->protocol = cpu_to_be16(ETH_P_IPV6);
|
|
break;
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
|
|
const struct virtio_net_hdr *hdr,
|
|
bool little_endian)
|
|
{
|
|
unsigned int gso_type = 0;
|
|
unsigned int thlen = 0;
|
|
unsigned int p_off = 0;
|
|
unsigned int ip_proto;
|
|
|
|
if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
|
|
switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
|
|
case VIRTIO_NET_HDR_GSO_TCPV4:
|
|
gso_type = SKB_GSO_TCPV4;
|
|
ip_proto = IPPROTO_TCP;
|
|
thlen = sizeof(struct tcphdr);
|
|
break;
|
|
case VIRTIO_NET_HDR_GSO_TCPV6:
|
|
gso_type = SKB_GSO_TCPV6;
|
|
ip_proto = IPPROTO_TCP;
|
|
thlen = sizeof(struct tcphdr);
|
|
break;
|
|
case VIRTIO_NET_HDR_GSO_UDP:
|
|
gso_type = SKB_GSO_UDP;
|
|
ip_proto = IPPROTO_UDP;
|
|
thlen = sizeof(struct udphdr);
|
|
break;
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (hdr->gso_type & VIRTIO_NET_HDR_GSO_ECN)
|
|
gso_type |= SKB_GSO_TCP_ECN;
|
|
|
|
if (hdr->gso_size == 0)
|
|
return -EINVAL;
|
|
}
|
|
|
|
skb_reset_mac_header(skb);
|
|
|
|
if (hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
|
|
u16 start = __virtio16_to_cpu(little_endian, hdr->csum_start);
|
|
u16 off = __virtio16_to_cpu(little_endian, hdr->csum_offset);
|
|
|
|
if (!skb_partial_csum_set(skb, start, off))
|
|
return -EINVAL;
|
|
|
|
p_off = skb_transport_offset(skb) + thlen;
|
|
if (p_off > skb_headlen(skb))
|
|
return -EINVAL;
|
|
} else {
|
|
/* gso packets without NEEDS_CSUM do not set transport_offset.
|
|
* probe and drop if does not match one of the above types.
|
|
*/
|
|
if (gso_type && skb->network_header) {
|
|
struct flow_keys_basic keys;
|
|
|
|
if (!skb->protocol) {
|
|
__be16 protocol = dev_parse_header_protocol(skb);
|
|
|
|
virtio_net_hdr_set_proto(skb, hdr);
|
|
if (protocol && protocol != skb->protocol)
|
|
return -EINVAL;
|
|
}
|
|
retry:
|
|
if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
|
|
NULL, 0, 0, 0,
|
|
0)) {
|
|
/* UFO does not specify ipv4 or 6: try both */
|
|
if (gso_type & SKB_GSO_UDP &&
|
|
skb->protocol == htons(ETH_P_IP)) {
|
|
skb->protocol = htons(ETH_P_IPV6);
|
|
goto retry;
|
|
}
|
|
return -EINVAL;
|
|
}
|
|
|
|
p_off = keys.control.thoff + thlen;
|
|
if (p_off > skb_headlen(skb) ||
|
|
keys.basic.ip_proto != ip_proto)
|
|
return -EINVAL;
|
|
|
|
skb_set_transport_header(skb, keys.control.thoff);
|
|
} else if (gso_type) {
|
|
p_off = thlen;
|
|
if (p_off > skb_headlen(skb))
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
|
|
if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
|
|
u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size);
|
|
struct skb_shared_info *shinfo = skb_shinfo(skb);
|
|
|
|
/* Too small packets are not really GSO ones. */
|
|
if (skb->len - p_off > gso_size) {
|
|
shinfo->gso_size = gso_size;
|
|
shinfo->gso_type = gso_type;
|
|
|
|
/* Header must be checked, and gso_segs computed. */
|
|
shinfo->gso_type |= SKB_GSO_DODGY;
|
|
shinfo->gso_segs = 0;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
|
|
struct virtio_net_hdr *hdr,
|
|
bool little_endian,
|
|
bool has_data_valid,
|
|
int vlan_hlen)
|
|
{
|
|
memset(hdr, 0, sizeof(*hdr)); /* no info leak */
|
|
|
|
if (skb_is_gso(skb)) {
|
|
struct skb_shared_info *sinfo = skb_shinfo(skb);
|
|
|
|
/* This is a hint as to how much should be linear. */
|
|
hdr->hdr_len = __cpu_to_virtio16(little_endian,
|
|
skb_headlen(skb));
|
|
hdr->gso_size = __cpu_to_virtio16(little_endian,
|
|
sinfo->gso_size);
|
|
if (sinfo->gso_type & SKB_GSO_TCPV4)
|
|
hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
|
|
else if (sinfo->gso_type & SKB_GSO_TCPV6)
|
|
hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
|
|
else
|
|
return -EINVAL;
|
|
if (sinfo->gso_type & SKB_GSO_TCP_ECN)
|
|
hdr->gso_type |= VIRTIO_NET_HDR_GSO_ECN;
|
|
} else
|
|
hdr->gso_type = VIRTIO_NET_HDR_GSO_NONE;
|
|
|
|
if (skb->ip_summed == CHECKSUM_PARTIAL) {
|
|
hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
|
|
hdr->csum_start = __cpu_to_virtio16(little_endian,
|
|
skb_checksum_start_offset(skb) + vlan_hlen);
|
|
hdr->csum_offset = __cpu_to_virtio16(little_endian,
|
|
skb->csum_offset);
|
|
} else if (has_data_valid &&
|
|
skb->ip_summed == CHECKSUM_UNNECESSARY) {
|
|
hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
|
|
} /* else everything is zero */
|
|
|
|
return 0;
|
|
}
|
|
|
|
#endif /* _LINUX_VIRTIO_NET_H */
|