Toshiaki Makita
3f74460e5b
vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi
[ Upstream commit 7ce2367254 ]
Syzkaller spotted an old bug which leads to reading skb beyond tail by 4
bytes on vlan tagged packets.
This is caused because skb_vlan_tagged_multi() did not check
skb_headlen.
BUG: KMSAN: uninit-value in eth_type_vlan include/linux/if_vlan.h:283 [inline]
BUG: KMSAN: uninit-value in skb_vlan_tagged_multi include/linux/if_vlan.h:656 [inline]
BUG: KMSAN: uninit-value in vlan_features_check include/linux/if_vlan.h:672 [inline]
BUG: KMSAN: uninit-value in dflt_features_check net/core/dev.c:2949 [inline]
BUG: KMSAN: uninit-value in netif_skb_features+0xd1b/0xdc0 net/core/dev.c:3009
CPU: 1 PID: 3582 Comm: syzkaller435149 Not tainted 4.16.0+ #82
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x185/0x1d0 lib/dump_stack.c:53
kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
__msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676
eth_type_vlan include/linux/if_vlan.h:283 [inline]
skb_vlan_tagged_multi include/linux/if_vlan.h:656 [inline]
vlan_features_check include/linux/if_vlan.h:672 [inline]
dflt_features_check net/core/dev.c:2949 [inline]
netif_skb_features+0xd1b/0xdc0 net/core/dev.c:3009
validate_xmit_skb+0x89/0x1320 net/core/dev.c:3084
__dev_queue_xmit+0x1cb2/0x2b60 net/core/dev.c:3549
dev_queue_xmit+0x4b/0x60 net/core/dev.c:3590
packet_snd net/packet/af_packet.c:2944 [inline]
packet_sendmsg+0x7c57/0x8a10 net/packet/af_packet.c:2969
sock_sendmsg_nosec net/socket.c:630 [inline]
sock_sendmsg net/socket.c:640 [inline]
sock_write_iter+0x3b9/0x470 net/socket.c:909
do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776
do_iter_write+0x30d/0xd40 fs/read_write.c:932
vfs_writev fs/read_write.c:977 [inline]
do_writev+0x3c9/0x830 fs/read_write.c:1012
SYSC_writev+0x9b/0xb0 fs/read_write.c:1085
SyS_writev+0x56/0x80 fs/read_write.c:1082
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x43ffa9
RSP: 002b:00007fff2cff3948 EFLAGS: 00000217 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ffa9
RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004018d0
R13: 0000000000401960 R14: 0000000000000000 R15: 0000000000000000
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321
slab_post_alloc_hook mm/slab.h:445 [inline]
slab_alloc_node mm/slub.c:2737 [inline]
__kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369
__kmalloc_reserve net/core/skbuff.c:138 [inline]
__alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206
alloc_skb include/linux/skbuff.h:984 [inline]
alloc_skb_with_frags+0x1d4/0xb20 net/core/skbuff.c:5234
sock_alloc_send_pskb+0xb56/0x1190 net/core/sock.c:2085
packet_alloc_skb net/packet/af_packet.c:2803 [inline]
packet_snd net/packet/af_packet.c:2894 [inline]
packet_sendmsg+0x6444/0x8a10 net/packet/af_packet.c:2969
sock_sendmsg_nosec net/socket.c:630 [inline]
sock_sendmsg net/socket.c:640 [inline]
sock_write_iter+0x3b9/0x470 net/socket.c:909
do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776
do_iter_write+0x30d/0xd40 fs/read_write.c:932
vfs_writev fs/read_write.c:977 [inline]
do_writev+0x3c9/0x830 fs/read_write.c:1012
SYSC_writev+0x9b/0xb0 fs/read_write.c:1085
SyS_writev+0x56/0x80 fs/read_write.c:1082
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
Fixes: 58e998c6d2 ("offloading: Force software GSO for multiple vlan tags.")
Reported-and-tested-by: syzbot+0bbe42c764feafa82c5a@syzkaller.appspotmail.com
Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-29 07:50:05 +02:00
..
2016-08-10 11:49:24 +02:00
2017-02-18 16:39:26 +01:00
2017-03-15 09:57:15 +08:00
2017-10-12 11:27:34 +02:00
2016-10-28 03:01:34 -04:00
2017-03-15 09:57:14 +08:00
2016-10-16 17:36:14 +02:00
2018-04-13 19:50:17 +02:00
2018-04-13 19:50:10 +02:00
2017-10-08 10:14:19 +02:00
2018-02-25 11:03:46 +01:00
2018-04-08 11:51:59 +02:00
2015-10-27 11:24:23 +01:00
2018-03-22 09:23:25 +01:00
2015-12-07 14:14:03 -05:00
2015-11-10 15:00:03 -08:00
2015-11-10 14:48:36 -08:00
2017-02-01 08:30:53 +01:00
2018-04-08 11:51:56 +02:00
2016-09-07 08:32:45 +02:00
2016-03-09 15:34:52 -08:00
2015-11-03 17:22:17 -08:00
2018-04-08 11:51:57 +02:00
2018-04-24 09:32:12 +02:00
2018-04-24 09:32:12 +02:00
2016-08-20 18:09:24 +02:00
2015-12-09 10:35:16 -08:00
2015-11-11 09:37:34 -07:00
2015-10-27 15:04:56 +09:00
2015-11-07 10:40:47 -07:00
2016-09-15 08:27:47 +02:00
2018-02-03 17:04:24 +01:00
2017-12-09 18:42:43 +01:00
2018-01-31 12:06:08 +01:00
2017-01-12 11:22:50 +01:00
2016-05-04 14:48:49 -07:00
2017-06-14 13:16:23 +02:00
2016-05-11 11:21:11 +02:00
2015-11-05 19:34:48 -08:00
2018-04-13 19:50:24 +02:00
2016-12-08 07:15:24 +01:00
2016-02-25 12:01:16 -08:00
2015-11-20 16:17:32 -08:00
2016-02-17 12:30:57 -08:00
2015-11-10 12:06:23 +01:00
2017-07-05 14:37:20 +02:00
2018-01-17 09:35:33 +01:00
2015-12-02 23:50:33 +01:00
2018-04-08 11:51:57 +02:00
2017-10-12 11:27:35 +02:00
2018-01-10 09:27:10 +01:00
2017-08-06 19:19:42 -07:00
2017-03-22 12:04:15 +01:00
2015-11-02 13:14:44 -08:00
2016-10-28 03:01:26 -04:00
2016-04-12 09:08:39 -07:00
2018-02-25 11:03:46 +01:00
2016-08-16 09:30:49 +02:00
2015-11-06 17:50:42 -08:00
2015-11-18 16:27:46 -05:00
2015-11-04 21:50:37 -08:00
2016-03-03 15:07:09 -08:00
2015-12-11 11:05:57 -08:00
2017-05-14 13:32:59 +02:00
2015-11-10 09:33:06 -08:00
2017-07-15 11:57:44 +02:00
2018-02-25 11:03:53 +01:00
2015-10-30 01:47:27 -04:00
2018-01-17 09:35:30 +01:00
2018-03-22 09:23:31 +01:00
2017-06-17 06:39:36 +02:00
2018-01-10 09:27:10 +01:00
2016-09-30 10:18:37 +02:00
2017-08-06 19:19:42 -07:00
2016-01-07 12:17:39 -05:00
2015-11-04 18:10:13 -08:00
2017-12-16 10:33:54 +01:00
2017-05-14 13:32:59 +02:00
2015-11-20 16:17:32 -08:00
2016-05-11 11:21:13 +02:00
2018-04-24 09:32:07 +02:00
2015-11-09 15:11:24 -08:00
2016-02-17 12:30:57 -08:00
2015-11-06 17:50:42 -08:00
2015-11-05 19:34:48 -08:00
2016-03-03 15:07:16 -08:00
2016-09-07 08:32:44 +02:00
2016-04-20 15:42:02 +09:00
2015-10-23 05:44:28 -07:00
2018-04-29 07:50:05 +02:00
2015-11-05 14:51:32 -08:00
2018-02-25 11:03:54 +01:00
2017-03-12 06:37:25 +01:00
2015-10-27 08:36:08 +09:00
2015-11-04 11:30:57 -08:00
2018-01-02 20:33:25 +01:00
2016-09-24 10:07:43 +02:00
2015-10-30 10:13:26 +01:00
2018-04-08 11:51:57 +02:00
2017-01-19 20:17:19 +01:00
2016-07-27 09:47:29 -07:00
2018-02-22 15:45:01 +01:00
2018-01-23 19:50:12 +01:00
2015-11-09 15:11:24 -08:00
2016-10-28 03:01:30 -04:00
2017-10-27 10:23:18 +02:00
2015-12-12 10:15:34 -08:00
2017-05-25 14:30:17 +02:00
2015-11-28 19:33:29 -08:00
2018-01-31 12:06:08 +01:00
2017-04-08 09:53:32 +02:00
2015-10-26 09:10:56 +01:00
2016-03-09 15:34:52 -08:00
2017-03-18 19:09:58 +08:00
2017-09-02 07:06:51 +02:00
2017-07-21 07:44:56 +02:00
2018-04-08 11:51:59 +02:00
2015-11-23 09:44:58 +01:00
2017-06-17 06:39:36 +02:00
2015-11-17 15:25:43 -05:00
2015-11-10 12:06:16 +01:00
2017-10-27 10:23:17 +02:00
2017-06-14 13:16:26 +02:00
2016-08-16 09:30:51 +02:00
2017-02-09 08:02:47 +01:00
2015-10-27 18:55:31 -07:00
2017-08-11 09:08:50 -07:00
2018-04-24 09:32:11 +02:00
2017-12-20 10:04:59 +01:00
2015-12-18 14:25:40 -08:00
2017-12-25 14:22:09 +01:00
2017-12-16 10:33:50 +01:00
2018-01-05 15:44:24 +01:00
2015-11-06 11:04:07 -08:00
2018-02-25 11:03:52 +01:00
2015-11-06 17:50:42 -08:00
2017-04-30 05:49:28 +02:00
2016-11-15 07:46:37 +01:00
2016-11-15 07:46:37 +01:00
2018-02-25 11:03:48 +01:00
2016-07-11 09:31:11 -07:00
2015-11-03 11:29:57 -05:00
2017-11-18 11:11:05 +01:00
2015-11-06 19:33:12 +01:00
2017-12-05 11:22:49 +01:00
2017-02-01 08:30:53 +01:00
2016-03-03 15:07:28 -08:00
2015-11-23 21:57:44 -05:00
2015-11-05 19:34:48 -08:00
2018-04-08 11:52:01 +02:00
2016-10-07 15:23:41 +02:00
2015-11-10 17:27:12 -06:00
2015-11-16 09:03:21 +05:30
2015-12-09 09:23:28 -06:00
2015-11-12 11:50:33 -08:00
2015-11-10 17:27:12 -06:00
2015-10-28 10:05:58 -07:00
2017-12-16 10:33:51 +01:00
2015-11-05 19:34:48 -08:00
2017-11-24 08:32:25 +01:00
2015-11-06 17:50:42 -08:00
2015-11-06 17:50:42 -08:00
2018-03-22 09:23:22 +01:00
2017-09-13 14:09:45 -07:00
2016-12-08 07:15:24 +01:00
2018-01-05 15:44:26 +01:00
2017-02-09 08:02:46 +01:00
2016-09-15 08:27:46 +02:00
2017-11-21 09:21:22 +01:00
2018-01-17 09:35:29 +01:00
2017-08-24 17:02:36 -07:00
2016-06-07 18:14:35 -07:00
2015-10-28 04:33:04 +01:00
2016-10-31 04:13:58 -06:00
2018-03-24 10:58:40 +01:00
2017-11-15 17:13:11 +01:00
2015-11-07 01:29:22 +01:00
2015-11-23 09:44:58 +01:00
2017-08-06 19:19:43 -07:00
2015-11-03 11:08:22 -05:00
2017-06-14 13:16:20 +02:00
2016-11-10 16:36:37 +01:00
2015-10-30 11:18:05 +09:00
2016-02-25 12:01:23 -08:00
2017-06-14 13:16:23 +02:00
2015-11-06 17:50:42 -08:00
2015-12-04 14:38:26 -05:00
2015-11-02 14:23:38 -05:00
2016-02-25 12:01:21 -08:00
2018-01-31 12:06:07 +01:00
2015-11-19 16:22:43 +01:00
2015-10-27 19:55:13 -07:00
2016-10-28 03:01:32 -04:00
2017-08-06 19:19:42 -07:00
2016-09-07 08:32:44 +02:00
2018-01-17 09:35:29 +01:00
2016-03-03 15:07:23 -08:00
2016-06-01 12:15:54 -07:00
2018-04-13 19:50:17 +02:00
2017-08-11 09:08:58 -07:00
2016-09-30 10:18:37 +02:00
2016-07-11 09:31:11 -07:00
2015-12-12 10:15:34 -08:00
2018-02-25 11:03:36 +01:00
2015-10-26 10:11:58 +09:00
2016-10-28 03:01:34 -04:00
2015-11-25 15:49:13 +00:00
2016-10-07 15:23:46 +02:00
2017-12-16 10:33:48 +01:00
2018-01-31 12:06:13 +01:00
2016-04-12 09:08:35 -07:00
2016-09-15 08:27:47 +02:00
2017-06-29 12:48:51 +02:00
2017-10-21 17:09:02 +02:00
2015-11-05 19:34:48 -08:00
2016-03-16 08:42:58 -07:00
2017-09-27 11:00:13 +02:00
2018-04-24 09:32:04 +02:00
2015-11-25 15:49:13 +00:00
2015-11-05 19:34:48 -08:00
2016-03-03 15:07:08 -08:00
2016-12-10 19:07:25 +01:00
2015-11-23 09:44:58 +01:00
2016-04-20 15:42:07 +09:00
2017-12-09 18:42:43 +01:00
2018-01-31 12:06:11 +01:00
2017-07-27 15:06:07 -07:00
2015-11-05 11:07:36 +10:00
2018-01-02 20:33:28 +01:00
2015-11-01 17:09:15 -08:00
2015-12-29 17:45:49 -08:00
2015-12-13 14:30:59 -08:00
2015-11-03 20:46:26 +01:00
2018-03-18 11:17:48 +01:00
2016-03-09 15:34:52 -08:00
2015-11-13 20:34:33 -05:00
2015-11-06 17:50:42 -08:00
2015-11-06 17:50:42 -08:00
2015-11-06 17:50:42 -08:00