Eric Dumazet
d9dfd41e32
net: test for not too small csum_start in virtio_net_hdr_to_skb()
[ Upstream commit 49d14b54a5 ]
syzbot was able to trigger this warning [1], after injecting a
malicious packet through af_packet, setting skb->csum_start and thus
the transport header to an incorrect value.
We can at least make sure the transport header is after
the end of the network header (with a estimated minimal size).
[1]
[ 67.873027] skb len=4096 headroom=16 headlen=14 tailroom=0
mac=(-1,-1) mac_len=0 net=(16,-6) trans=10
shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0))
csum(0xa start=10 offset=0 ip_summed=3 complete_sw=0 valid=0 level=0)
hash(0x0 sw=0 l4=0) proto=0x0800 pkttype=0 iif=0
priority=0x0 mark=0x0 alloc_cpu=10 vlan_all=0x0
encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
[ 67.877172] dev name=veth0_vlan feat=0x000061164fdd09e9
[ 67.877764] sk family=17 type=3 proto=0
[ 67.878279] skb linear: 00000000: 00 00 10 00 00 00 00 00 0f 00 00 00 08 00
[ 67.879128] skb frag: 00000000: 0e 00 07 00 00 00 28 00 08 80 1c 00 04 00 00 02
[ 67.879877] skb frag: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.880647] skb frag: 00000020: 00 00 02 00 00 00 08 00 1b 00 00 00 00 00 00 00
[ 67.881156] skb frag: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.881753] skb frag: 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.882173] skb frag: 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.882790] skb frag: 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.883171] skb frag: 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.883733] skb frag: 00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.884206] skb frag: 00000090: 00 00 00 00 00 00 00 00 00 00 69 70 76 6c 61 6e
[ 67.884704] skb frag: 000000a0: 31 00 00 00 00 00 00 00 00 00 2b 00 00 00 00 00
[ 67.885139] skb frag: 000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.885677] skb frag: 000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.886042] skb frag: 000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.886408] skb frag: 000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.887020] skb frag: 000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 67.887384] skb frag: 00000100: 00 00
[ 67.887878] ------------[ cut here ]------------
[ 67.887908] offset (-6) >= skb_headlen() (14)
[ 67.888445] WARNING: CPU: 10 PID: 2088 at net/core/dev.c:3332 skb_checksum_help (net/core/dev.c:3332 (discriminator 2))
[ 67.889353] Modules linked in: macsec macvtap macvlan hsr wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 libchacha poly1305_x86_64 dummy bridge sr_mod cdrom evdev pcspkr i2c_piix4 9pnet_virtio 9p 9pnet netfs
[ 67.890111] CPU: 10 UID: 0 PID: 2088 Comm: b363492833 Not tainted 6.11.0-virtme #1011
[ 67.890183] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 67.890309] RIP: 0010:skb_checksum_help (net/core/dev.c:3332 (discriminator 2))
[ 67.891043] Call Trace:
[ 67.891173] <TASK>
[ 67.891274] ? __warn (kernel/panic.c:741)
[ 67.891320] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2))
[ 67.891333] ? report_bug (lib/bug.c:180 lib/bug.c:219)
[ 67.891348] ? handle_bug (arch/x86/kernel/traps.c:239)
[ 67.891363] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1))
[ 67.891372] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)
[ 67.891388] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2))
[ 67.891399] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2))
[ 67.891416] ip_do_fragment (net/ipv4/ip_output.c:777 (discriminator 1))
[ 67.891448] ? __ip_local_out (./include/linux/skbuff.h:1146 ./include/net/l3mdev.h:196 ./include/net/l3mdev.h:213 net/ipv4/ip_output.c:113)
[ 67.891459] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:200)
[ 67.891470] ? ip_route_output_flow (./arch/x86/include/asm/preempt.h:84 (discriminator 13) ./include/linux/rcupdate.h:96 (discriminator 13) ./include/linux/rcupdate.h:871 (discriminator 13) net/ipv4/route.c:2625 (discriminator 13) ./include/net/route.h:141 (discriminator 13) net/ipv4/route.c:2852 (discriminator 13))
[ 67.891484] ipvlan_process_v4_outbound (drivers/net/ipvlan/ipvlan_core.c:445 (discriminator 1))
[ 67.891581] ipvlan_queue_xmit (drivers/net/ipvlan/ipvlan_core.c:542 drivers/net/ipvlan/ipvlan_core.c:604 drivers/net/ipvlan/ipvlan_core.c:670)
[ 67.891596] ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:227)
[ 67.891607] dev_hard_start_xmit (./include/linux/netdevice.h:4916 ./include/linux/netdevice.h:4925 net/core/dev.c:3588 net/core/dev.c:3604)
[ 67.891620] __dev_queue_xmit (net/core/dev.h:168 (discriminator 25) net/core/dev.c:4425 (discriminator 25))
[ 67.891630] ? skb_copy_bits (./include/linux/uaccess.h:233 (discriminator 1) ./include/linux/uaccess.h:260 (discriminator 1) ./include/linux/highmem-internal.h:230 (discriminator 1) net/core/skbuff.c:3018 (discriminator 1))
[ 67.891645] ? __pskb_pull_tail (net/core/skbuff.c:2848 (discriminator 4))
[ 67.891655] ? skb_partial_csum_set (net/core/skbuff.c:5657)
[ 67.891666] ? virtio_net_hdr_to_skb.constprop.0 (./include/linux/skbuff.h:2791 (discriminator 3) ./include/linux/skbuff.h:2799 (discriminator 3) ./include/linux/virtio_net.h:109 (discriminator 3))
[ 67.891684] packet_sendmsg (net/packet/af_packet.c:3145 (discriminator 1) net/packet/af_packet.c:3177 (discriminator 1))
[ 67.891700] ? _raw_spin_lock_bh (./arch/x86/include/asm/atomic.h:107 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) ./include/asm-generic/qspinlock.h:111 (discriminator 4) ./include/linux/spinlock.h:187 (discriminator 4) ./include/linux/spinlock_api_smp.h:127 (discriminator 4) kernel/locking/spinlock.c:178 (discriminator 4))
[ 67.891716] __sys_sendto (net/socket.c:730 (discriminator 1) net/socket.c:745 (discriminator 1) net/socket.c:2210 (discriminator 1))
[ 67.891734] ? do_sock_setsockopt (net/socket.c:2335)
[ 67.891747] ? __sys_setsockopt (./include/linux/file.h:34 net/socket.c:2355)
[ 67.891761] __x64_sys_sendto (net/socket.c:2222 (discriminator 1) net/socket.c:2218 (discriminator 1) net/socket.c:2218 (discriminator 1))
[ 67.891772] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))
[ 67.891785] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Fixes: 9181d6f8a2 ("net: add more sanity check in virtio_net_hdr_to_skb()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20240926165836.3797406-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-10-10 11:57:17 +02:00
..
2024-06-27 13:49:11 +02:00
2024-04-10 16:35:56 +02:00
2023-07-28 09:45:25 +02:00
2024-04-27 17:11:29 +02:00
2023-08-22 14:13:11 -07:00
2023-08-07 20:55:27 +02:00
2024-08-29 17:33:45 +02:00
2023-09-01 09:53:54 -07:00
2024-06-12 11:12:23 +02:00
2024-04-27 17:11:33 +02:00
2023-08-22 16:32:35 +02:00
2024-06-12 11:12:49 +02:00
2024-06-12 11:12:21 +02:00
2023-08-29 17:45:22 -04:00
2023-11-20 11:59:23 +01:00
2023-08-23 08:25:28 +01:00
2024-09-18 19:24:08 +02:00
2024-06-16 13:47:36 +02:00
2024-04-03 15:28:58 +02:00
2024-02-23 09:25:18 +01:00
2023-08-25 07:42:58 +01:00
2023-08-16 10:54:46 -06:00
2023-09-01 08:09:48 -07:00
2024-04-03 15:28:28 +02:00
2023-09-07 16:07:35 -07:00
2024-06-21 14:38:34 +02:00
2023-08-23 08:21:37 +01:00
2023-09-06 22:53:55 +08:00
2024-09-12 11:11:32 +02:00
2024-10-04 16:29:22 +02:00
2024-09-08 07:54:43 +02:00
2024-01-31 16:18:47 -08:00
2024-07-25 09:50:47 +02:00
2024-08-19 06:04:23 +02:00
2024-10-04 16:29:50 +02:00
2023-08-15 12:50:53 +01:00
2024-06-12 11:11:37 +02:00
2023-09-11 15:24:16 -07:00
2023-08-07 14:55:33 +02:00
2024-09-12 11:11:40 +02:00
2023-08-18 10:18:56 -07:00
2023-08-04 17:35:33 +01:00
2023-09-12 13:07:37 +01:00
2024-01-31 16:18:49 -08:00
2023-08-31 01:29:28 +02:00
2024-02-23 09:25:16 +01:00
2023-08-21 13:38:01 -07:00
2024-01-25 15:35:46 -08:00
2024-10-04 16:29:59 +02:00
2024-06-12 11:11:38 +02:00
2024-01-20 11:51:38 +01:00
2024-08-14 13:59:02 +02:00
2023-08-30 17:35:54 +08:00
2024-05-25 16:22:55 +02:00
2024-04-27 17:11:43 +02:00
2024-01-25 15:35:28 -08:00
2023-07-31 14:44:02 -07:00
2024-05-25 16:22:53 +02:00
2024-08-29 17:33:17 +02:00
2024-09-12 11:11:34 +02:00
2024-10-04 16:29:23 +02:00
2023-09-15 12:08:27 -07:00
2023-09-02 11:10:50 -07:00
2023-09-17 10:33:53 -07:00
2024-03-06 14:48:44 +00:00
2023-08-24 16:20:25 -07:00
2024-07-25 09:50:40 +02:00
2023-08-02 16:27:07 +02:00
2024-08-19 06:04:31 +02:00
2024-01-25 15:35:38 -08:00
2023-08-04 18:18:19 -07:00
2024-08-14 13:58:56 +02:00
2024-07-05 09:34:04 +02:00
2024-07-18 13:21:09 +02:00
2024-05-17 12:02:31 +02:00
2024-02-23 09:24:47 +01:00
2024-06-12 11:12:14 +02:00
2023-07-28 09:53:37 +02:00
2024-06-12 11:11:24 +02:00
2024-04-03 15:28:22 +02:00
2023-12-13 18:44:56 +01:00
2024-08-29 17:33:14 +02:00
2023-08-24 16:25:13 -07:00
2023-12-20 17:01:51 +01:00
2024-01-01 12:42:23 +00:00
2024-01-10 17:16:53 +01:00
2024-06-12 11:11:57 +02:00
2024-04-10 16:36:03 +02:00
2024-03-26 18:20:13 -04:00
2023-08-25 16:07:30 -07:00
2024-05-17 12:02:27 +02:00
2024-09-04 13:28:24 +02:00
2023-08-01 18:02:20 +02:00
2024-02-16 19:10:42 +01:00
2023-08-09 17:46:19 +02:00
2023-08-04 15:28:41 +02:00
2023-08-30 13:34:34 -07:00
2023-08-23 14:17:42 -07:00
2024-05-02 16:32:46 +02:00
2023-11-28 17:20:11 +00:00
2024-08-29 17:33:31 +02:00
2024-01-05 15:19:41 +01:00
2024-10-04 16:29:37 +02:00
2024-06-12 11:11:56 +02:00
2024-07-09 11:44:29 +02:00
2024-06-12 11:12:51 +02:00
2023-10-12 18:53:36 +03:00
2024-10-04 16:29:48 +02:00
2024-07-25 09:50:57 +02:00
2024-09-08 07:54:44 +02:00
2024-07-11 12:49:16 +02:00
2023-08-22 05:20:34 -04:00
2023-11-28 17:19:35 +00:00
2023-08-18 10:18:57 -07:00
2023-08-18 10:18:57 -07:00
2024-05-17 12:02:15 +02:00
2024-04-03 15:28:44 +02:00
2023-08-14 11:23:35 +02:00
2023-12-03 07:33:04 +01:00
2023-12-13 18:45:21 +01:00
2024-01-25 15:35:17 -08:00
2024-02-16 19:10:55 +01:00
2023-08-21 14:28:43 -07:00
2024-08-03 08:54:11 +02:00
2023-08-16 23:54:50 +10:00
2023-11-20 11:59:18 +01:00
2024-09-08 07:54:43 +02:00
2024-05-17 12:02:17 +02:00
2024-09-08 07:54:49 +02:00
2023-11-20 11:59:35 +01:00
2024-07-05 09:33:51 +02:00
2023-08-25 08:08:27 +01:00
2023-09-19 16:28:37 +02:00
2023-08-04 11:02:46 +01:00
2024-02-23 09:25:03 +01:00
2023-09-12 17:50:53 +02:00
2024-04-03 15:28:19 +02:00
2024-04-03 15:28:18 +02:00
2023-08-22 01:11:32 +03:00
2023-09-27 16:54:03 +02:00
2024-04-10 16:36:02 +02:00
2024-03-26 18:19:09 -04:00
2023-08-29 20:21:42 -07:00
2024-06-21 14:38:30 +02:00
2023-07-28 13:31:24 -03:00
2023-08-18 10:12:35 -07:00
2023-09-01 08:11:51 +01:00
2024-02-05 20:14:17 +00:00
2023-11-28 17:19:56 +00:00
2024-04-17 11:19:36 +02:00
2024-08-03 08:54:19 +02:00
2023-10-18 12:12:41 -07:00
2024-06-27 13:49:13 +02:00
2023-08-21 13:46:24 -07:00
2024-04-13 13:07:38 +02:00
2023-08-24 16:25:14 -07:00
2024-01-01 12:42:33 +00:00
2023-08-18 10:12:39 -07:00
2023-08-05 08:31:41 +02:00
2024-06-27 13:49:03 +02:00
2024-06-16 13:47:41 +02:00
2024-06-12 11:12:52 +02:00
2023-08-31 13:48:50 -04:00
2024-08-11 12:47:14 +02:00
2024-07-05 09:33:57 +02:00
2023-08-18 10:19:00 -07:00
2023-08-15 14:57:25 -07:00
2023-08-07 13:05:53 -07:00
2024-07-11 12:49:18 +02:00
2023-09-29 17:20:46 -07:00
2023-08-18 10:18:59 -07:00
2024-01-31 16:18:56 -08:00
2023-10-05 09:50:14 +02:00
2024-03-01 13:35:06 +01:00
2023-09-19 13:21:34 -07:00
2023-08-21 13:37:48 -07:00
2023-08-18 10:12:11 -07:00
2023-08-21 13:37:49 -07:00
2024-01-25 15:35:53 -08:00
2023-08-04 12:09:56 +05:30
2023-09-06 20:49:04 -07:00
2024-02-05 20:14:21 +00:00
2023-12-20 17:02:02 +01:00
2023-08-18 10:12:36 -07:00
2024-10-04 16:29:22 +02:00
2024-10-04 16:29:21 +02:00
2024-04-03 15:28:54 +02:00
2023-08-18 10:12:46 -07:00
2023-08-18 10:12:41 -07:00
2024-07-18 13:21:10 +02:00
2024-06-27 13:49:14 +02:00
2024-03-26 18:19:55 -04:00
2023-11-28 17:19:56 +00:00
2024-07-11 12:49:02 +02:00
2023-08-02 19:11:06 -07:00
2023-08-09 15:32:43 -07:00
2024-10-10 11:57:16 +02:00
2024-01-25 15:35:59 -08:00
2024-03-06 14:48:36 +00:00
2023-09-13 11:51:11 -04:00
2024-04-03 15:28:29 +02:00
2023-09-13 11:51:11 -04:00
2023-08-18 10:19:00 -07:00
2023-08-16 14:27:01 -07:00
2023-08-21 11:29:12 -07:00
2024-06-12 11:11:50 +02:00
2023-09-05 05:34:14 -04:00
2024-06-12 11:12:53 +02:00
2024-07-05 09:33:53 +02:00
2024-09-18 19:24:04 +02:00
2024-05-17 12:01:55 +02:00
2024-08-03 08:53:38 +02:00
2023-12-20 17:02:06 +01:00
2023-08-04 11:36:33 -06:00
2024-09-04 13:28:22 +02:00
2023-09-09 08:18:16 -05:00
2024-04-13 13:07:32 +02:00
2023-08-21 13:37:31 -07:00
2023-08-18 10:12:25 -07:00
2024-07-25 09:50:56 +02:00
2023-08-24 16:20:18 -07:00
2024-05-02 16:32:47 +02:00
2024-07-18 13:21:20 +02:00
2023-08-21 13:07:20 -07:00
2024-08-14 13:58:43 +02:00
2024-08-11 12:47:15 +02:00
2023-08-04 16:21:30 +02:00
2023-08-25 08:06:53 -07:00
2024-08-03 08:54:27 +02:00
2024-09-12 11:11:40 +02:00
2024-07-11 12:49:11 +02:00
2023-08-02 19:11:06 -07:00
2023-09-06 07:46:49 +01:00
2023-08-21 13:37:59 -07:00
2024-01-31 16:19:09 -08:00
2023-08-22 21:31:57 +02:00
2023-08-22 22:03:43 +02:00
2023-11-20 11:58:57 +01:00
2024-03-26 18:19:17 -04:00
2023-11-08 11:56:20 +01:00
2023-11-28 17:19:48 +00:00
2023-08-12 09:18:47 -07:00
2024-06-12 11:11:56 +02:00
2023-08-02 15:01:51 -07:00
2024-08-14 13:58:47 +02:00
2024-09-18 19:24:03 +02:00
2023-08-09 15:59:21 -07:00
2024-02-23 09:24:53 +01:00
2024-06-12 11:12:24 +02:00
2023-10-06 11:01:23 +02:00
2023-10-06 11:01:23 +02:00
2023-08-24 21:34:28 -04:00
2024-04-13 13:07:40 +02:00
2023-08-18 10:19:00 -07:00
2023-08-16 14:27:41 -07:00
2024-04-13 13:07:34 +02:00
2024-05-17 12:01:59 +02:00
2023-09-19 13:21:34 -07:00
2023-12-13 18:45:19 +01:00
2024-04-03 15:28:32 +02:00
2024-01-31 16:18:56 -08:00
2023-08-27 23:50:22 +02:00
2024-10-04 16:29:38 +02:00
2023-08-30 10:08:38 +02:00
2023-12-13 18:45:15 +01:00
2024-08-11 12:47:16 +02:00
2024-04-10 16:36:04 +02:00
2024-07-11 12:49:18 +02:00
2023-08-22 11:10:26 -06:00
2023-07-27 08:48:12 -07:00
2023-09-21 08:37:44 +02:00
2024-07-05 09:34:00 +02:00
2024-04-27 17:11:42 +02:00
2024-05-17 12:02:20 +02:00
2024-05-17 12:01:59 +02:00
2024-08-29 17:33:23 +02:00
2024-06-16 13:47:49 +02:00
2023-07-26 21:24:40 -07:00
2023-11-28 17:19:38 +00:00
2024-08-19 06:04:28 +02:00
2023-08-21 13:46:24 -07:00
2024-01-25 15:35:49 -08:00
2023-08-16 14:27:01 -07:00
2024-01-31 16:18:47 -08:00
2023-07-28 17:05:47 +02:00
2023-08-04 18:21:50 -07:00
2023-11-28 17:19:40 +00:00
2024-03-01 13:35:00 +01:00
2023-08-21 13:37:26 -07:00
2024-04-27 17:11:42 +02:00
2023-09-27 11:19:15 +02:00
2023-08-09 14:16:44 -05:00
2024-07-05 09:34:04 +02:00
2024-08-11 12:47:13 +02:00
2024-08-03 08:54:16 +02:00
2023-07-28 18:04:14 -07:00
2023-08-06 08:24:55 +01:00
2024-02-05 20:14:15 +00:00
2023-08-11 21:12:45 +02:00
2023-11-20 11:58:51 +01:00
2023-11-28 17:20:08 +00:00
2023-08-07 17:55:54 +00:00
2024-08-14 13:58:51 +02:00
2024-06-12 11:12:35 +02:00
2023-08-22 14:58:15 +02:00
2024-06-27 13:49:05 +02:00
2023-08-22 14:58:15 +02:00
2023-08-11 21:12:47 +02:00
2023-08-11 21:12:44 +02:00
2023-08-27 11:47:44 +02:00
2024-04-17 11:19:28 +02:00
2024-04-27 17:11:32 +02:00
2023-08-09 14:17:06 +02:00
2023-08-18 10:12:16 -07:00
2023-09-03 18:10:22 -04:00
2023-11-20 11:59:18 +01:00
2024-04-03 15:28:49 +02:00
2023-08-24 13:27:47 -05:00
2024-10-10 11:57:17 +02:00
2024-01-25 15:35:26 -08:00
2023-09-04 13:44:11 -07:00
2024-07-05 09:33:45 +02:00
2023-08-21 14:52:16 +02:00
2024-10-04 16:30:02 +02:00
2023-08-10 12:06:04 +02:00
2023-08-21 13:37:27 -07:00