Toshiaki Makita
3f74460e5b
vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi
[ Upstream commit 7ce2367254 ]
Syzkaller spotted an old bug which leads to reading skb beyond tail by 4
bytes on vlan tagged packets.
This is caused because skb_vlan_tagged_multi() did not check
skb_headlen.
BUG: KMSAN: uninit-value in eth_type_vlan include/linux/if_vlan.h:283 [inline]
BUG: KMSAN: uninit-value in skb_vlan_tagged_multi include/linux/if_vlan.h:656 [inline]
BUG: KMSAN: uninit-value in vlan_features_check include/linux/if_vlan.h:672 [inline]
BUG: KMSAN: uninit-value in dflt_features_check net/core/dev.c:2949 [inline]
BUG: KMSAN: uninit-value in netif_skb_features+0xd1b/0xdc0 net/core/dev.c:3009
CPU: 1 PID: 3582 Comm: syzkaller435149 Not tainted 4.16.0+ #82
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x185/0x1d0 lib/dump_stack.c:53
kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
__msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676
eth_type_vlan include/linux/if_vlan.h:283 [inline]
skb_vlan_tagged_multi include/linux/if_vlan.h:656 [inline]
vlan_features_check include/linux/if_vlan.h:672 [inline]
dflt_features_check net/core/dev.c:2949 [inline]
netif_skb_features+0xd1b/0xdc0 net/core/dev.c:3009
validate_xmit_skb+0x89/0x1320 net/core/dev.c:3084
__dev_queue_xmit+0x1cb2/0x2b60 net/core/dev.c:3549
dev_queue_xmit+0x4b/0x60 net/core/dev.c:3590
packet_snd net/packet/af_packet.c:2944 [inline]
packet_sendmsg+0x7c57/0x8a10 net/packet/af_packet.c:2969
sock_sendmsg_nosec net/socket.c:630 [inline]
sock_sendmsg net/socket.c:640 [inline]
sock_write_iter+0x3b9/0x470 net/socket.c:909
do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776
do_iter_write+0x30d/0xd40 fs/read_write.c:932
vfs_writev fs/read_write.c:977 [inline]
do_writev+0x3c9/0x830 fs/read_write.c:1012
SYSC_writev+0x9b/0xb0 fs/read_write.c:1085
SyS_writev+0x56/0x80 fs/read_write.c:1082
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x43ffa9
RSP: 002b:00007fff2cff3948 EFLAGS: 00000217 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ffa9
RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004018d0
R13: 0000000000401960 R14: 0000000000000000 R15: 0000000000000000
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321
slab_post_alloc_hook mm/slab.h:445 [inline]
slab_alloc_node mm/slub.c:2737 [inline]
__kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369
__kmalloc_reserve net/core/skbuff.c:138 [inline]
__alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206
alloc_skb include/linux/skbuff.h:984 [inline]
alloc_skb_with_frags+0x1d4/0xb20 net/core/skbuff.c:5234
sock_alloc_send_pskb+0xb56/0x1190 net/core/sock.c:2085
packet_alloc_skb net/packet/af_packet.c:2803 [inline]
packet_snd net/packet/af_packet.c:2894 [inline]
packet_sendmsg+0x6444/0x8a10 net/packet/af_packet.c:2969
sock_sendmsg_nosec net/socket.c:630 [inline]
sock_sendmsg net/socket.c:640 [inline]
sock_write_iter+0x3b9/0x470 net/socket.c:909
do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776
do_iter_write+0x30d/0xd40 fs/read_write.c:932
vfs_writev fs/read_write.c:977 [inline]
do_writev+0x3c9/0x830 fs/read_write.c:1012
SYSC_writev+0x9b/0xb0 fs/read_write.c:1085
SyS_writev+0x56/0x80 fs/read_write.c:1082
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
Fixes: 58e998c6d2 ("offloading: Force software GSO for multiple vlan tags.")
Reported-and-tested-by: syzbot+0bbe42c764feafa82c5a@syzkaller.appspotmail.com
Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-29 07:50:05 +02:00
..
2017-02-18 16:39:26 +01:00
2017-03-15 09:57:15 +08:00
2017-10-12 11:27:34 +02:00
2016-10-28 03:01:34 -04:00
2017-03-15 09:57:14 +08:00
2016-10-16 17:36:14 +02:00
2018-04-13 19:50:17 +02:00
2018-04-13 19:50:10 +02:00
2017-10-08 10:14:19 +02:00
2018-02-25 11:03:46 +01:00
2018-04-08 11:51:59 +02:00
2018-03-22 09:23:25 +01:00
2017-02-01 08:30:53 +01:00
2018-04-08 11:51:56 +02:00
2018-04-08 11:51:57 +02:00
2018-04-24 09:32:12 +02:00
2018-04-24 09:32:12 +02:00
2016-09-15 08:27:47 +02:00
2018-02-03 17:04:24 +01:00
2017-12-09 18:42:43 +01:00
2018-01-31 12:06:08 +01:00
2017-01-12 11:22:50 +01:00
2017-06-14 13:16:23 +02:00
2018-04-13 19:50:24 +02:00
2016-12-08 07:15:24 +01:00
2017-07-05 14:37:20 +02:00
2018-01-17 09:35:33 +01:00
2018-04-08 11:51:57 +02:00
2017-10-12 11:27:35 +02:00
2018-01-10 09:27:10 +01:00
2017-08-06 19:19:42 -07:00
2017-03-22 12:04:15 +01:00
2016-10-28 03:01:26 -04:00
2018-02-25 11:03:46 +01:00
2017-05-14 13:32:59 +02:00
2017-07-15 11:57:44 +02:00
2018-02-25 11:03:53 +01:00
2018-01-17 09:35:30 +01:00
2018-03-22 09:23:31 +01:00
2017-06-17 06:39:36 +02:00
2018-01-10 09:27:10 +01:00
2016-09-30 10:18:37 +02:00
2017-08-06 19:19:42 -07:00
2017-12-16 10:33:54 +01:00
2017-05-14 13:32:59 +02:00
2018-04-24 09:32:07 +02:00
2018-04-29 07:50:05 +02:00
2018-02-25 11:03:54 +01:00
2017-03-12 06:37:25 +01:00
2018-01-02 20:33:25 +01:00
2016-09-24 10:07:43 +02:00
2018-04-08 11:51:57 +02:00
2017-01-19 20:17:19 +01:00
2018-02-22 15:45:01 +01:00
2018-01-23 19:50:12 +01:00
2016-10-28 03:01:30 -04:00
2017-10-27 10:23:18 +02:00
2017-05-25 14:30:17 +02:00
2018-01-31 12:06:08 +01:00
2017-04-08 09:53:32 +02:00
2017-03-18 19:09:58 +08:00
2017-09-02 07:06:51 +02:00
2017-07-21 07:44:56 +02:00
2018-04-08 11:51:59 +02:00
2017-06-17 06:39:36 +02:00
2017-10-27 10:23:17 +02:00
2017-06-14 13:16:26 +02:00
2017-02-09 08:02:47 +01:00
2017-08-11 09:08:50 -07:00
2018-04-24 09:32:11 +02:00
2017-12-20 10:04:59 +01:00
2017-12-25 14:22:09 +01:00
2017-12-16 10:33:50 +01:00
2018-01-05 15:44:24 +01:00
2018-02-25 11:03:52 +01:00
2017-04-30 05:49:28 +02:00
2016-11-15 07:46:37 +01:00
2016-11-15 07:46:37 +01:00
2018-02-25 11:03:48 +01:00
2017-11-18 11:11:05 +01:00
2017-12-05 11:22:49 +01:00
2017-02-01 08:30:53 +01:00
2018-04-08 11:52:01 +02:00
2016-10-07 15:23:41 +02:00
2017-12-16 10:33:51 +01:00
2017-11-24 08:32:25 +01:00
2018-03-22 09:23:22 +01:00
2017-09-13 14:09:45 -07:00
2016-12-08 07:15:24 +01:00
2018-01-05 15:44:26 +01:00
2017-02-09 08:02:46 +01:00
2016-09-15 08:27:46 +02:00
2017-11-21 09:21:22 +01:00
2018-01-17 09:35:29 +01:00
2017-08-24 17:02:36 -07:00
2016-10-31 04:13:58 -06:00
2018-03-24 10:58:40 +01:00
2017-11-15 17:13:11 +01:00
2017-08-06 19:19:43 -07:00
2017-06-14 13:16:20 +02:00
2016-11-10 16:36:37 +01:00
2017-06-14 13:16:23 +02:00
2018-01-31 12:06:07 +01:00
2016-10-28 03:01:32 -04:00
2017-08-06 19:19:42 -07:00
2018-01-17 09:35:29 +01:00
2018-04-13 19:50:17 +02:00
2017-08-11 09:08:58 -07:00
2016-09-30 10:18:37 +02:00
2018-02-25 11:03:36 +01:00
2016-10-28 03:01:34 -04:00
2016-10-07 15:23:46 +02:00
2017-12-16 10:33:48 +01:00
2018-01-31 12:06:13 +01:00
2016-09-15 08:27:47 +02:00
2017-06-29 12:48:51 +02:00
2017-10-21 17:09:02 +02:00
2017-09-27 11:00:13 +02:00
2018-04-24 09:32:04 +02:00
2016-12-10 19:07:25 +01:00
2017-12-09 18:42:43 +01:00
2018-01-31 12:06:11 +01:00
2017-07-27 15:06:07 -07:00
2018-01-02 20:33:28 +01:00
2018-03-18 11:17:48 +01:00