From: Steffen Klassert <steffen.klassert@secunet.com>
To: Florian Westphal <fw@strlen.de>
Cc: <netdev@vger.kernel.org>, <syzkaller-bugs@googlegroups.com>,
<herbert@gondor.apana.org.au>
Subject: Re: [PATCH net] xfrm: defer daddr pointer assignment after spi parsing
Date: Fri, 3 Nov 2017 08:16:18 +0100 [thread overview]
Message-ID: <20171103071618.GN11292@secunet.com> (raw)
In-Reply-To: <20171101193049.12336-1-fw@strlen.de>
On Wed, Nov 01, 2017 at 08:30:49PM +0100, Florian Westphal wrote:
> syzbot reports:
> BUG: KASAN: use-after-free in __xfrm_state_lookup+0x695/0x6b0
> Read of size 4 at addr ffff8801d434e538 by task syzkaller647520/2991
> [..]
> __xfrm_state_lookup+0x695/0x6b0 net/xfrm/xfrm_state.c:833
> xfrm_state_lookup+0x8a/0x160 net/xfrm/xfrm_state.c:1592
> xfrm_input+0x8e5/0x22f0 net/xfrm/xfrm_input.c:302
>
> The use-after-free is the ipv4 destination address, which points
> to an skb head area that has been reallocated:
> pskb_expand_head+0x36b/0x1210 net/core/skbuff.c:1494
> __pskb_pull_tail+0x14a/0x17c0 net/core/skbuff.c:1877
> pskb_may_pull include/linux/skbuff.h:2102 [inline]
> xfrm_parse_spi+0x3d3/0x4d0 net/xfrm/xfrm_input.c:170
> xfrm_input+0xce2/0x22f0 net/xfrm/xfrm_input.c:291
>
> so the real bug is that xfrm_parse_spi() uses pskb_may_pull, but
> for now do smaller workaround that makes xfrm_input fetch daddr
> after spi parsing.
>
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Applied, thanks Florian!
next prev parent reply other threads:[~2017-11-03 7:16 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-01 17:55 KASAN: use-after-free Read in __xfrm_state_lookup syzbot
2017-11-01 19:30 ` [PATCH net] xfrm: defer daddr pointer assignment after spi parsing Florian Westphal
2017-11-03 7:16 ` Steffen Klassert [this message]
2018-01-31 2:05 ` KASAN: use-after-free Read in __xfrm_state_lookup Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171103071618.GN11292@secunet.com \
--to=steffen.klassert@secunet.com \
--cc=fw@strlen.de \
--cc=herbert@gondor.apana.org.au \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.