33f0d95c10
[ Upstream commit 17c25cafd4d3e74c83dce56b158843b19c40b414 ] syzbot found an interesting case of the kernel reading an uninit-value [1] Problem is in the handling of ETH_P_WCCP in gre_parse_header() We look at the byte following GRE options to eventually decide if the options are four bytes longer. Use skb_header_pointer() to not pull bytes if we found that no more bytes were needed. All callers of gre_parse_header() are properly using pskb_may_pull() anyway before proceeding to next header. [1] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2303 [inline] BUG: KMSAN: uninit-value in __iptunnel_pull_header+0x30c/0xbd0 net/ipv4/ip_tunnel_core.c:94 CPU: 1 PID: 11784 Comm: syz-executor940 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 pskb_may_pull include/linux/skbuff.h:2303 [inline] __iptunnel_pull_header+0x30c/0xbd0 net/ipv4/ip_tunnel_core.c:94 iptunnel_pull_header include/net/ip_tunnels.h:411 [inline] gre_rcv+0x15e/0x19c0 net/ipv6/ip6_gre.c:606 ip6_protocol_deliver_rcu+0x181b/0x22c0 net/ipv6/ip6_input.c:432 ip6_input_finish net/ipv6/ip6_input.c:473 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ip6_input net/ipv6/ip6_input.c:482 [inline] ip6_mc_input+0xdf2/0x1460 net/ipv6/ip6_input.c:576 dst_input include/net/dst.h:442 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ipv6_rcv+0x683/0x710 net/ipv6/ip6_input.c:306 __netif_receive_skb_one_core net/core/dev.c:5198 [inline] __netif_receive_skb net/core/dev.c:5312 [inline] netif_receive_skb_internal net/core/dev.c:5402 [inline] netif_receive_skb+0x66b/0xf20 net/core/dev.c:5461 tun_rx_batched include/linux/skbuff.h:4321 [inline] tun_get_user+0x6aef/0x6f60 drivers/net/tun.c:1997 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026 call_write_iter include/linux/fs.h:1901 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0xa5a/0xca0 fs/read_write.c:496 vfs_write+0x44a/0x8f0 fs/read_write.c:558 ksys_write+0x267/0x450 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:620 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f62d99 Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000fffedb2c EFLAGS: 00000217 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020002580 RDX: 0000000000000fca RSI: 0000000000000036 RDI: 0000000000000004 RBP: 0000000000008914 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82 slab_alloc_node mm/slub.c:2793 [inline] __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1051 [inline] alloc_skb_with_frags+0x18c/0xa70 net/core/skbuff.c:5766 sock_alloc_send_pskb+0xada/0xc60 net/core/sock.c:2242 tun_alloc_skb drivers/net/tun.c:1529 [inline] tun_get_user+0x10ae/0x6f60 drivers/net/tun.c:1843 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026 call_write_iter include/linux/fs.h:1901 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0xa5a/0xca0 fs/read_write.c:496 vfs_write+0x44a/0x8f0 fs/read_write.c:558 ksys_write+0x267/0x450 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:620 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 Fixes:95f5c64c3c
("gre: Move utility functions to common headers") Fixes:c544193214
("GRE: Refactor GRE tunneling code.") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
222 lines
5 KiB
C
222 lines
5 KiB
C
/*
|
|
* GRE over IPv4 demultiplexer driver
|
|
*
|
|
* Authors: Dmitry Kozlov (xeb@mail.ru)
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation; either version
|
|
* 2 of the License, or (at your option) any later version.
|
|
*
|
|
*/
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/if.h>
|
|
#include <linux/icmp.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/kmod.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/in.h>
|
|
#include <linux/ip.h>
|
|
#include <linux/netdevice.h>
|
|
#include <linux/if_tunnel.h>
|
|
#include <linux/spinlock.h>
|
|
#include <net/protocol.h>
|
|
#include <net/gre.h>
|
|
#include <net/erspan.h>
|
|
|
|
#include <net/icmp.h>
|
|
#include <net/route.h>
|
|
#include <net/xfrm.h>
|
|
|
|
static const struct gre_protocol __rcu *gre_proto[GREPROTO_MAX] __read_mostly;
|
|
|
|
int gre_add_protocol(const struct gre_protocol *proto, u8 version)
|
|
{
|
|
if (version >= GREPROTO_MAX)
|
|
return -EINVAL;
|
|
|
|
return (cmpxchg((const struct gre_protocol **)&gre_proto[version], NULL, proto) == NULL) ?
|
|
0 : -EBUSY;
|
|
}
|
|
EXPORT_SYMBOL_GPL(gre_add_protocol);
|
|
|
|
int gre_del_protocol(const struct gre_protocol *proto, u8 version)
|
|
{
|
|
int ret;
|
|
|
|
if (version >= GREPROTO_MAX)
|
|
return -EINVAL;
|
|
|
|
ret = (cmpxchg((const struct gre_protocol **)&gre_proto[version], proto, NULL) == proto) ?
|
|
0 : -EBUSY;
|
|
|
|
if (ret)
|
|
return ret;
|
|
|
|
synchronize_rcu();
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL_GPL(gre_del_protocol);
|
|
|
|
/* Fills in tpi and returns header length to be pulled.
|
|
* Note that caller must use pskb_may_pull() before pulling GRE header.
|
|
*/
|
|
int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
|
|
bool *csum_err, __be16 proto, int nhs)
|
|
{
|
|
const struct gre_base_hdr *greh;
|
|
__be32 *options;
|
|
int hdr_len;
|
|
|
|
if (unlikely(!pskb_may_pull(skb, nhs + sizeof(struct gre_base_hdr))))
|
|
return -EINVAL;
|
|
|
|
greh = (struct gre_base_hdr *)(skb->data + nhs);
|
|
if (unlikely(greh->flags & (GRE_VERSION | GRE_ROUTING)))
|
|
return -EINVAL;
|
|
|
|
tpi->flags = gre_flags_to_tnl_flags(greh->flags);
|
|
hdr_len = gre_calc_hlen(tpi->flags);
|
|
|
|
if (!pskb_may_pull(skb, nhs + hdr_len))
|
|
return -EINVAL;
|
|
|
|
greh = (struct gre_base_hdr *)(skb->data + nhs);
|
|
tpi->proto = greh->protocol;
|
|
|
|
options = (__be32 *)(greh + 1);
|
|
if (greh->flags & GRE_CSUM) {
|
|
if (!skb_checksum_simple_validate(skb)) {
|
|
skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
|
|
null_compute_pseudo);
|
|
} else if (csum_err) {
|
|
*csum_err = true;
|
|
return -EINVAL;
|
|
}
|
|
|
|
options++;
|
|
}
|
|
|
|
if (greh->flags & GRE_KEY) {
|
|
tpi->key = *options;
|
|
options++;
|
|
} else {
|
|
tpi->key = 0;
|
|
}
|
|
if (unlikely(greh->flags & GRE_SEQ)) {
|
|
tpi->seq = *options;
|
|
options++;
|
|
} else {
|
|
tpi->seq = 0;
|
|
}
|
|
/* WCCP version 1 and 2 protocol decoding.
|
|
* - Change protocol to IPv4/IPv6
|
|
* - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
|
|
*/
|
|
if (greh->flags == 0 && tpi->proto == htons(ETH_P_WCCP)) {
|
|
u8 _val, *val;
|
|
|
|
val = skb_header_pointer(skb, nhs + hdr_len,
|
|
sizeof(_val), &_val);
|
|
if (!val)
|
|
return -EINVAL;
|
|
tpi->proto = proto;
|
|
if ((*val & 0xF0) != 0x40)
|
|
hdr_len += 4;
|
|
}
|
|
tpi->hdr_len = hdr_len;
|
|
|
|
/* ERSPAN ver 1 and 2 protocol sets GRE key field
|
|
* to 0 and sets the configured key in the
|
|
* inner erspan header field
|
|
*/
|
|
if (greh->protocol == htons(ETH_P_ERSPAN) ||
|
|
greh->protocol == htons(ETH_P_ERSPAN2)) {
|
|
struct erspan_base_hdr *ershdr;
|
|
|
|
if (!pskb_may_pull(skb, nhs + hdr_len + sizeof(*ershdr)))
|
|
return -EINVAL;
|
|
|
|
ershdr = (struct erspan_base_hdr *)(skb->data + nhs + hdr_len);
|
|
tpi->key = cpu_to_be32(get_session_id(ershdr));
|
|
}
|
|
|
|
return hdr_len;
|
|
}
|
|
EXPORT_SYMBOL(gre_parse_header);
|
|
|
|
static int gre_rcv(struct sk_buff *skb)
|
|
{
|
|
const struct gre_protocol *proto;
|
|
u8 ver;
|
|
int ret;
|
|
|
|
if (!pskb_may_pull(skb, 12))
|
|
goto drop;
|
|
|
|
ver = skb->data[1]&0x7f;
|
|
if (ver >= GREPROTO_MAX)
|
|
goto drop;
|
|
|
|
rcu_read_lock();
|
|
proto = rcu_dereference(gre_proto[ver]);
|
|
if (!proto || !proto->handler)
|
|
goto drop_unlock;
|
|
ret = proto->handler(skb);
|
|
rcu_read_unlock();
|
|
return ret;
|
|
|
|
drop_unlock:
|
|
rcu_read_unlock();
|
|
drop:
|
|
kfree_skb(skb);
|
|
return NET_RX_DROP;
|
|
}
|
|
|
|
static void gre_err(struct sk_buff *skb, u32 info)
|
|
{
|
|
const struct gre_protocol *proto;
|
|
const struct iphdr *iph = (const struct iphdr *)skb->data;
|
|
u8 ver = skb->data[(iph->ihl<<2) + 1]&0x7f;
|
|
|
|
if (ver >= GREPROTO_MAX)
|
|
return;
|
|
|
|
rcu_read_lock();
|
|
proto = rcu_dereference(gre_proto[ver]);
|
|
if (proto && proto->err_handler)
|
|
proto->err_handler(skb, info);
|
|
rcu_read_unlock();
|
|
}
|
|
|
|
static const struct net_protocol net_gre_protocol = {
|
|
.handler = gre_rcv,
|
|
.err_handler = gre_err,
|
|
.netns_ok = 1,
|
|
};
|
|
|
|
static int __init gre_init(void)
|
|
{
|
|
pr_info("GRE over IPv4 demultiplexor driver\n");
|
|
|
|
if (inet_add_protocol(&net_gre_protocol, IPPROTO_GRE) < 0) {
|
|
pr_err("can't add protocol\n");
|
|
return -EAGAIN;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static void __exit gre_exit(void)
|
|
{
|
|
inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
|
|
}
|
|
|
|
module_init(gre_init);
|
|
module_exit(gre_exit);
|
|
|
|
MODULE_DESCRIPTION("GRE over IPv4 demultiplexer driver");
|
|
MODULE_AUTHOR("D. Kozlov (xeb@mail.ru)");
|
|
MODULE_LICENSE("GPL");
|