Florian Westphal 025f8ad20f
net: mpls: error out if inner headers are not set ...
mpls_gso_segment() assumes skb_inner_network_header() returns
a valid result:
mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
goto out;
if (unlikely(!pskb_may_pull(skb, mpls_hlen)))
With syzbot reproducer, skb_inner_network_header() yields 0,
skb_network_header() returns 108, so this will
"pskb_may_pull(skb, -108)))" which triggers a newly added
DEBUG_NET_WARN_ON_ONCE() check:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull_reason include/linux/skbuff.h:2723 [inline]
WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull include/linux/skbuff.h:2739 [inline]
WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 mpls_gso_segment+0x773/0xaa0 net/mpls/mpls_gso.c:34
[..]
skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53
nsh_gso_segment+0x40a/0xad0 net/nsh/nsh.c:108
skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53
__skb_gso_segment+0x324/0x4c0 net/core/gso.c:124
skb_gso_segment include/net/gso.h:83 [inline]
[..]
sch_direct_xmit+0x11a/0x5f0 net/sched/sch_generic.c:327
[..]
packet_sendmsg+0x46a9/0x6130 net/packet/af_packet.c:3113
[..]
First iteration of this patch made mpls_hlen signed and changed
test to error out to "mpls_hlen <= 0 || ..".
Eric Dumazet said:
> I was thinking about adding a debug check in skb_inner_network_header()
> if inner_network_header is zero (that would mean it is not 'set' yet),
> but this would trigger even after your patch.
So add new skb_inner_network_header_was_set() helper and use that.
The syzbot reproducer injects data via packet socket. The skb that gets
allocated and passed down the stack has ->protocol set to NSH (0x894f)
and gso_type set to SKB_GSO_UDP | SKB_GSO_DODGY.
This gets passed to skb_mac_gso_segment(), which sees NSH as ptype to
find a callback for. nsh_gso_segment() retrieves next type:
proto = tun_p_to_eth_p(nsh_hdr(skb)->np);
... which is MPLS (TUN_P_MPLS_UC). It updates skb->protocol and then
calls mpls_gso_segment(). Inner offsets are all 0, so mpls_gso_segment()
ends up with a negative header size.
In case more callers rely on silent handling of such large may_pull values
we could also 'legalize' this behaviour, either replacing the debug check
with (len > INT_MAX) test or removing it and instead adding a comment
before existing
if (unlikely(len > skb->len))
return SKB_DROP_REASON_PKT_TOO_SMALL;
test in pskb_may_pull_reason(), saying that this check also implicitly
takes care of callers that miscompute header sizes.
Cc: Simon Horman <horms@kernel.org >
Fixes: 219eee9c0dsyzbot+99d15fcdb0132a1e1a82@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/00000000000043b1310611e388aa@google.com/raw
Signed-off-by: Florian Westphal <fw@strlen.de >
Link: https://lore.kernel.org/r/20240222140321.14080-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org >
2024-02-23 16:22:56 -08:00
2024-01-18 11:37:24 -08:00
2023-12-18 11:15:43 -08:00
2024-01-04 17:01:13 +01:00
2024-02-07 14:43:29 +01:00
2024-01-18 15:16:57 -08:00
2024-01-04 17:02:49 +01:00
2024-02-21 12:41:24 +00:00
2024-02-13 11:02:53 +01:00
2023-12-19 11:09:43 +02:00
2024-01-14 23:00:50 +01:00
2024-02-04 15:01:14 +00:00
2023-12-13 21:26:13 -08:00
2024-01-11 14:19:23 -08:00
2024-01-29 13:00:23 +00:00
2024-02-22 15:29:26 -08:00
2024-01-02 17:54:05 +01:00
2023-12-22 12:45:52 +01:00
2023-11-30 13:39:20 -08:00
2024-01-31 23:13:57 +01:00
2023-12-17 12:00:00 +00:00
2023-12-04 15:32:42 +01:00
2024-02-21 12:46:17 +00:00
2023-11-15 23:13:26 +01:00
2023-12-19 16:15:14 +00:00
2024-01-10 16:43:55 -08:00
2023-12-22 11:12:55 +00:00
2023-11-24 12:24:37 +05:30
2024-01-24 15:11:38 +00:00
2024-01-10 16:13:57 -08:00
2024-01-17 16:47:17 -08:00
2024-02-09 10:26:08 +00:00
2023-12-11 11:33:44 +01:00
2024-01-18 16:22:43 -08:00
2024-01-02 16:51:39 -06:00
2024-01-04 15:19:17 +01:00
2023-11-29 17:40:16 +01:00
2023-11-14 08:00:57 -05:00
2023-12-23 15:52:36 +01:00
2023-11-13 11:51:26 +00:00
2024-01-03 11:31:12 +01:00
2023-12-20 19:26:32 -05:00
2024-02-06 09:44:03 -07:00
2023-12-23 16:35:09 +02:00
2024-01-16 15:02:25 -07:00
2024-02-01 13:06:40 +01:00
2024-01-11 13:58:04 -08:00
2024-01-17 14:16:34 -07:00
2023-11-20 10:22:40 -07:00
2024-01-11 13:58:04 -08:00
2024-01-03 21:08:25 -08:00
2023-12-15 16:34:12 -08:00
2024-01-23 16:37:44 -08:00
2024-01-24 16:21:01 -08:00
2024-01-23 17:12:46 -08:00
2023-12-29 11:58:36 -08:00
2023-12-02 22:24:36 +00:00
2023-12-15 16:25:55 -08:00
2023-12-07 12:54:59 -10:00
2023-11-09 13:25:47 -10:00
2023-11-15 10:15:33 +01:00
2023-12-19 15:23:39 -08:00
2023-11-24 00:29:58 -05:00
2024-02-15 11:14:33 -08:00
2024-02-15 11:14:33 -08:00
2023-12-19 15:31:40 +01:00
2023-11-03 15:44:25 -10:00
2023-12-21 13:56:10 +01:00
2023-11-16 11:35:20 +00:00
2024-02-03 18:31:17 +01:00
2023-12-06 12:41:48 +09:00
2023-12-23 15:52:34 +01:00
2024-01-09 11:18:47 -08:00
2024-02-01 13:06:40 +01:00
2023-12-06 09:37:28 -10:00
2023-12-29 12:22:31 -08:00
2023-12-29 12:22:26 -08:00
2023-12-15 14:19:48 -08:00
2024-01-09 15:41:23 -08:00
2023-12-20 14:48:13 -08:00
2023-11-25 02:51:56 -05:00
2023-11-27 11:24:55 +01:00
2024-01-18 15:16:57 -08:00
2023-11-30 14:24:54 +01:00
2023-12-15 12:32:42 +01:00
2023-12-20 19:26:31 -05:00
2024-01-18 15:16:57 -08:00
2023-11-06 08:35:09 +01:00
2024-01-30 22:11:13 +05:30
2024-02-01 15:39:44 +01:00
2024-01-18 09:48:40 -08:00
2023-12-11 11:19:18 +01:00
2023-12-23 15:52:35 +01:00
2023-12-21 23:12:18 +01:00
2024-01-31 12:30:47 +00:00
2023-11-28 14:08:46 +01:00
2023-12-20 07:39:52 -05:00
2023-12-29 01:25:58 +09:00
2023-12-10 15:32:48 +09:00
2023-11-07 12:11:26 -08:00
2023-11-17 09:30:54 -08:00
2023-11-29 12:20:53 +01:00
2023-12-12 14:24:13 +01:00
2023-12-12 14:24:14 +01:00
2024-01-24 16:21:01 -08:00
2024-01-08 09:36:55 +09:00
2023-11-24 18:09:19 -08:00
2024-01-19 11:59:11 -08:00
2024-02-06 17:07:21 +01:00
2024-01-05 15:42:25 +00:00
2023-12-24 15:08:49 +00:00
2023-12-01 10:55:21 +01:00
2024-01-12 15:34:50 +01:00
2023-12-22 14:23:13 -08:00
2023-12-20 14:48:14 -08:00
2023-11-30 12:06:55 -08:00
2024-01-31 10:27:08 +01:00
2023-12-19 08:08:20 +01:00
2024-01-02 11:25:28 +01:00
2023-12-10 16:51:36 -08:00
2023-12-08 11:59:45 +08:00
2023-12-20 19:26:31 -05:00
2024-02-06 10:56:35 +01:00
2023-12-29 11:58:42 -08:00
2024-01-08 15:27:15 -08:00
2024-01-18 21:10:43 +01:00
2023-11-03 09:12:00 +00:00
2024-02-21 15:19:04 +01:00
2024-02-04 15:41:18 +00:00
2023-12-13 16:16:41 -08:00
2023-11-16 12:26:57 +01:00
2024-01-23 15:13:54 +01:00
2023-12-10 17:21:31 -08:00
2023-12-10 15:32:48 +09:00
2023-12-11 11:06:41 +01:00
2023-12-06 11:33:45 +01:00
2024-01-11 14:19:23 -08:00
2023-12-19 12:33:50 -07:00
2023-11-27 11:10:12 +01:00
2024-01-18 15:28:15 -08:00
2023-12-10 17:21:44 -08:00
2024-01-08 12:27:46 -07:00
2023-11-14 09:09:18 -08:00
2023-12-20 19:26:31 -05:00
2024-02-15 15:34:40 +01:00
2023-11-23 11:32:29 +01:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-26 20:24:33 +00:00
2024-01-04 23:42:21 -05:00
2023-12-29 11:58:44 -08:00
2023-12-20 15:02:57 -08:00
2023-12-21 13:47:38 +00:00
2023-12-01 09:51:43 -08:00
2023-12-20 19:26:30 -05:00
2023-12-01 14:53:56 +09:00
2023-12-29 11:58:25 -08:00
2023-12-20 19:26:30 -05:00
2023-12-08 15:43:34 -05:00
2023-11-13 05:29:09 -05:00
2023-12-13 15:55:09 +00:00
2024-01-22 22:26:03 +01:00
2023-11-16 23:45:04 +00:00
2023-12-12 10:57:01 -08:00
2023-11-28 15:48:39 +01:00
2024-01-10 16:43:55 -08:00
2023-12-20 19:26:32 -05:00
2024-02-01 15:12:37 -08:00
2023-11-12 22:54:42 -05:00
2023-12-12 10:56:59 -08:00
2024-01-04 14:37:17 +01:00
2024-02-21 14:56:59 -08:00
2023-12-17 22:33:55 +01:00
2024-02-21 14:56:58 -08:00
2023-12-10 16:51:34 -08:00
2024-01-05 10:17:44 -08:00
2023-12-22 14:23:13 -08:00
2023-12-29 11:58:39 -08:00
2023-12-10 16:51:48 -08:00
2023-12-15 14:20:03 +05:30
2023-12-14 10:57:34 +05:30
2023-11-18 14:52:56 +00:00
2023-12-12 17:20:19 -08:00
2023-12-20 19:26:31 -05:00
2024-01-18 15:16:57 -08:00
2024-01-10 08:45:22 -08:00
2024-01-25 23:52:20 -08:00
2024-01-25 23:52:21 -08:00
2023-11-28 14:08:47 +01:00
2023-11-03 15:31:04 -10:00
2024-01-10 18:00:18 -08:00
2023-12-01 09:51:43 -08:00
2023-11-18 14:56:16 +01:00
2024-01-04 17:01:14 +01:00
2023-12-20 19:26:30 -05:00
2024-01-10 16:43:55 -08:00
2023-11-15 22:41:27 -05:00
2023-11-18 18:42:37 -08:00
2024-02-15 16:20:04 -08:00
2024-01-17 12:02:49 +01:00
2023-11-29 20:16:19 -08:00
2024-02-21 12:03:22 +01:00
2024-01-05 15:42:25 +00:00
2023-12-19 15:31:40 +01:00
2024-01-07 17:54:26 -05:00
2024-01-04 10:47:56 -05:00
2023-12-22 14:23:13 -08:00
2023-12-20 19:26:30 -05:00
2023-12-20 19:26:30 -05:00
2023-12-20 19:26:30 -05:00
2024-01-03 13:33:59 +01:00
2023-12-20 19:26:30 -05:00
2023-11-08 08:07:08 -08:00
2024-02-13 08:46:09 -08:00
2024-01-04 17:01:13 +01:00
2024-01-04 17:01:13 +01:00
2024-01-19 08:17:28 -06:00
2023-12-12 10:18:47 +01:00
2024-01-19 08:17:28 -06:00
2023-12-30 10:25:51 -08:00
2023-12-10 16:51:37 -08:00
2024-01-08 15:27:15 -08:00
2024-01-02 13:16:29 -05:00
2024-01-12 11:55:28 -08:00
2023-11-20 15:53:14 -06:00
2024-01-15 12:10:41 -06:00
2024-01-15 12:10:41 -06:00
2024-01-31 09:03:51 -06:00
2023-11-15 10:15:40 +01:00
2024-01-17 10:50:46 -08:00
2024-02-17 18:45:06 +00:00
2024-01-31 12:30:47 +00:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2024-01-04 14:35:57 +01:00
2023-12-13 11:27:48 +01:00
2024-01-03 16:21:42 +05:30
2024-01-10 20:59:20 +01:00
2024-01-09 15:00:09 +01:00
2023-11-28 15:48:39 +01:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:30 -05:00
2023-12-27 11:49:56 -05:00
2024-01-17 16:47:17 -08:00
2024-01-29 13:00:23 +00:00
2024-02-12 23:04:34 +01:00
2024-01-05 09:33:16 +01:00
2023-12-11 13:26:06 +01:00
2023-12-12 02:31:22 +05:30
2023-12-14 01:14:10 +05:30
2023-12-27 11:50:20 -05:00
2023-12-14 01:21:31 +05:30
2024-01-02 09:33:18 +01:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:32 -05:00
2023-12-27 11:49:56 -05:00
2023-12-01 14:53:56 +09:00
2023-12-20 19:26:31 -05:00
2023-12-20 07:54:56 -05:00
2024-01-05 10:17:43 -08:00
2023-12-27 11:49:56 -05:00
2023-12-20 19:26:31 -05:00
2024-02-14 11:20:13 +00:00
2023-12-15 17:27:04 +01:00
2023-11-15 10:15:33 +01:00
2024-01-24 11:48:52 -08:00
2023-12-20 19:26:32 -05:00
2023-12-20 19:26:32 -05:00
2024-01-24 16:21:01 -08:00
2023-12-20 19:26:32 -05:00
2023-12-20 19:26:32 -05:00
2024-02-15 12:17:28 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-08 12:02:38 +01:00
2024-02-06 14:42:02 +00:00
2024-01-04 16:05:47 -08:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-11-23 09:01:45 +01:00
2024-02-23 16:22:56 -08:00
2024-01-21 18:09:30 +00:00
2024-01-09 11:18:47 -08:00
2024-01-23 15:13:55 +01:00
2024-01-21 10:21:43 -08:00
2023-12-12 16:20:02 +01:00
2023-12-15 17:27:04 +01:00
2023-12-13 23:41:19 +05:30
2023-12-29 11:58:42 -08:00
2023-11-08 11:06:50 -08:00
2024-01-31 12:24:06 +00:00
2024-01-19 11:59:11 -08:00
2023-12-29 11:58:32 -08:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2024-01-24 11:49:19 +01:00
2023-12-28 05:02:42 -08:00
2024-02-12 09:51:26 +00:00
2023-11-17 15:48:03 +01:00
2024-01-17 14:47:33 -08:00
2023-12-20 08:21:57 +01:00
2023-12-20 19:26:30 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-11-15 12:03:41 -08:00
2023-12-20 19:26:30 -05:00
2023-11-03 07:41:18 -10:00
2023-12-18 23:14:16 -05:00
2023-12-18 23:14:16 -05:00
2023-11-02 00:16:49 -04:00
2023-12-08 12:02:37 +01:00
2023-12-08 12:02:37 +01:00
2024-01-18 11:37:24 -08:00
2023-12-20 19:26:30 -05:00
2024-02-21 17:05:01 -08:00
2023-12-20 19:26:32 -05:00
2024-01-10 16:43:55 -08:00
2023-12-05 11:57:37 +01:00
2024-02-21 15:19:03 +01:00
2024-01-04 16:06:32 +01:00
2023-12-29 11:58:24 -08:00
2023-12-19 11:51:33 -07:00
2023-12-04 14:29:08 -07:00
2023-12-19 11:51:31 -07:00
2024-01-13 18:06:23 +00:00
2023-12-19 11:51:33 -07:00
2023-12-19 11:51:31 -07:00
2023-12-15 10:37:35 +00:00
2023-12-19 11:51:31 -07:00
2023-12-12 10:57:02 -08:00
2024-01-05 10:17:47 -08:00
2023-12-20 19:26:31 -05:00
2024-01-02 13:31:48 +01:00
2023-12-20 19:26:31 -05:00
2024-01-10 16:43:55 -08:00
2024-01-19 09:10:23 -08:00
2024-02-09 12:07:48 +00:00
2023-12-29 20:22:11 -08:00
025f8ad20f