leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
dbb4ca8aca
linux/net/ipv6
History
Willem de Bruijn 2efd4fca70 ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull 
Syzbot reported a read beyond the end of the skb head when returning
IPV6_ORIGDSTADDR:

  BUG: KMSAN: kernel-infoleak in put_cmsg+0x5ef/0x860 net/core/scm.c:242
  CPU: 0 PID: 4501 Comm: syz-executor128 Not tainted 4.17.0+ #9
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
  Google 01/01/2011
  Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x185/0x1d0 lib/dump_stack.c:113
    kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1125
    kmsan_internal_check_memory+0x138/0x1f0 mm/kmsan/kmsan.c:1219
    kmsan_copy_to_user+0x7a/0x160 mm/kmsan/kmsan.c:1261
    copy_to_user include/linux/uaccess.h:184 [inline]
    put_cmsg+0x5ef/0x860 net/core/scm.c:242
    ip6_datagram_recv_specific_ctl+0x1cf3/0x1eb0 net/ipv6/datagram.c:719
    ip6_datagram_recv_ctl+0x41c/0x450 net/ipv6/datagram.c:733
    rawv6_recvmsg+0x10fb/0x1460 net/ipv6/raw.c:521
    [..]

This logic and its ipv4 counterpart read the destination port from
the packet at skb_transport_offset(skb) + 4.

With MSG_MORE and a local SOCK_RAW sender, syzbot was able to cook a
packet that stores headers exactly up to skb_transport_offset(skb) in
the head and the remainder in a frag.

Call pskb_may_pull before accessing the pointer to ensure that it lies
in skb head.

Link: http://lkml.kernel.org/r/CAF=yD-LEJwZj5a1-bAAj2Oy_hKmGygV6rsJ_WOrAYnv-fnayiQ@mail.gmail.com
Reported-by: syzbot+9adb4b567003cac781f0@syzkaller.appspotmail.com
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-07-24 16:35:58 -07:00
..
ila treewide: kvmalloc() -> kvmalloc_array() 2018-06-12 16:19:22 -07:00
netfilter netfilter: ipv6: nf_defrag: drop skb dst before queueing 2018-07-09 18:04:12 +02:00
addrconf_core.c net/ipv6: Add helper to return path MTU based on fib result 2018-05-22 10:51:09 +02:00
addrconf.c ipv6: use fib6_info_hold_safe() when necessary 2018-07-23 11:19:02 -07:00
addrlabel.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
af_inet6.c Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
ah6.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2017-11-15 11:56:19 -08:00
anycast.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-06-06 18:39:49 -07:00
calipso.c ipv6: make ipv6_renew_options() interrupt/kernel safe 2018-07-05 20:15:26 +09:00
datagram.c ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull 2018-07-24 16:35:58 -07:00
esp6_offload.c esp: check the NETIF_F_HW_ESP_TX_CSUM bit before segmenting 2018-02-27 10:46:01 +01:00
esp6.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-01-17 00:10:42 -05:00
exthdrs_core.c net: ipv6: Fix typo in ipv6_find_hdr() documentation 2018-05-07 23:50:27 -04:00
exthdrs_offload.c
exthdrs.c ipv6: make ipv6_renew_options() interrupt/kernel safe 2018-07-05 20:15:26 +09:00
fib6_notifier.c net: Add module reference to FIB notifiers 2017-09-01 20:33:42 -07:00
fib6_rules.c net/ipv6: Add fib6_lookup 2018-05-11 00:10:56 +02:00
fou6.c
icmp.c net/ipv6: Fix linklocal to global address with VRF 2018-07-21 19:31:46 -07:00
inet6_connection_sock.c
inet6_hashtables.c net/tcp: Fix socket lookups with SO_BINDTODEVICE 2018-06-20 08:03:06 +09:00
ip6_checksum.c udplite: fix partial checksum initialization 2018-02-16 15:57:42 -05:00
ip6_fib.c net/ipv6: Revert attempt to simplify route replace and append 2018-07-04 15:22:13 +09:00
ip6_flowlabel.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
ip6_gre.c net: ip6_gre: get ipv6hdr after skb_cow_head() 2018-07-16 13:39:47 -07:00
ip6_icmp.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ip6_input.c ipv6: Count interface receive statistics on the ingress netdev 2018-04-17 13:39:51 -04:00
ip6_offload.c udp: add udp gso 2018-04-26 15:07:42 -04:00
ip6_offload.h
ip6_output.c ip: hash fragments consistently 2018-07-23 11:39:30 -07:00
ip6_tunnel.c ip6_tunnel: remove magic mtu value 0xFFF8 2018-06-01 13:56:30 -04:00
ip6_udp_tunnel.c
ip6_vti.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-05-11 20:53:22 -04:00
ip6mr.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-06-06 18:39:49 -07:00
ipcomp6.c
ipv6_sockglue.c ipv6/mcast: init as INCLUDE when join SSM INCLUDE group 2018-07-16 11:20:06 -07:00
Kconfig ipv6: ila: select CONFIG_DST_CACHE 2018-07-18 10:22:37 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mcast_snoop.c
mcast.c multicast: do not restore deleted record source filter mode to new one 2018-07-21 22:58:17 -07:00
mip6.c
ndisc.c ipv6: make DAD fail with enhanced DAD when nonce length differs 2018-07-16 13:45:16 -07:00
netfilter.c netfilter: use skb_to_full_sk in ip6_route_me_harder 2018-02-25 20:51:13 +01:00
output_core.c net: accept UFO datagrams from tuntap and packet 2017-11-24 01:37:35 +09:00
ping.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
proc.c proc: introduce proc_create_net_single 2018-05-16 07:24:30 +02:00
protocol.c
raw.c Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
reassembly.c ipv6: frags: fix a lockdep false positive 2018-04-18 23:19:39 -04:00
route.c ipv6: use fib6_info_hold_safe() when necessary 2018-07-23 11:19:02 -07:00
seg6_hmac.c ipv6: sr: fix passing wrong flags to crypto_alloc_shash() 2018-07-02 20:36:37 +09:00
seg6_iptunnel.c ipv6: sr: fix useless rol32 call on hash 2018-07-18 15:10:47 -07:00
seg6_local.c ipv6: sr: Add seg6local action End.BPF 2018-05-24 11:57:36 +02:00
seg6.c net: remove unnecessary genlmsg_cancel() calls 2018-05-29 09:53:38 -04:00
sit.c ip6_tunnel: remove magic mtu value 0xFFF8 2018-06-01 13:56:30 -04:00
syncookies.c net/ipv4: disable SMC TCP option with SYN Cookies 2018-03-25 20:53:54 -04:00
sysctl_net_ipv6.c ipv6: sr: Compute flowlabel for outer IPv6 header of seg6 encap mode 2018-04-25 13:02:15 -04:00
tcp_ipv6.c net/ipv6: Fix linklocal to global address with VRF 2018-07-21 19:31:46 -07:00
tcpv6_offload.c gso: validate gso_type in GSO handlers 2018-01-22 16:01:30 -05:00
tunnel6.c
udp_impl.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
udp_offload.c udp: Add support for software checksum and GSO_PARTIAL with GSO offload 2018-05-08 22:30:06 -04:00
udp.c udp: fix rx queue len reported by diag and proc interface 2018-06-08 19:55:15 -04:00
udplite.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
xfrm6_input.c xfrm: Reinject transport-mode packets through tasklet 2017-12-19 08:23:21 +01:00
xfrm6_mode_beet.c networking: make skb_pull & friends return void pointers 2017-06-16 11:48:39 -04:00
xfrm6_mode_ro.c ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() 2017-06-02 13:57:27 -04:00
xfrm6_mode_transport.c ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() 2017-06-02 13:57:27 -04:00
xfrm6_mode_tunnel.c xfrm: Verify MAC header exists before overwriting eth_hdr(skb)->h_proto 2018-03-07 10:54:29 +01:00
xfrm6_output.c net: xfrm: use skb_gso_validate_network_len() to check gso sizes 2018-03-04 17:49:17 -05:00
xfrm6_policy.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-06-03 09:31:58 -04:00
xfrm6_protocol.c
xfrm6_state.c xfrm: remove VLA usage in __xfrm6_sort() 2018-04-26 07:51:48 +02:00
xfrm6_tunnel.c xfrm: Fix warning in xfrm6_tunnel_net_exit. 2018-04-16 07:50:09 +02:00