From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
syzbot <syzkaller@googlegroups.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 27/90] slip: make slhc_compress() more robust against malicious packets
Date: Thu, 19 Mar 2020 13:59:49 +0100 [thread overview]
Message-ID: <20200319123936.889172637@linuxfoundation.org> (raw)
In-Reply-To: <20200319123928.635114118@linuxfoundation.org>
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 110a40dfb708fe940a3f3704d470e431c368d256 ]
Before accessing various fields in IPV4 network header
and TCP header, make sure the packet :
- Has IP version 4 (ip->version == 4)
- Has not a silly network length (ip->ihl >= 5)
- Is big enough to hold network and transport headers
- Has not a silly TCP header size (th->doff >= sizeof(struct tcphdr) / 4)
syzbot reported :
BUG: KMSAN: uninit-value in slhc_compress+0x5b9/0x2e60 drivers/net/slip/slhc.c:270
CPU: 0 PID: 11728 Comm: syz-executor231 Not tainted 5.6.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x220 lib/dump_stack.c:118
kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
__msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
slhc_compress+0x5b9/0x2e60 drivers/net/slip/slhc.c:270
ppp_send_frame drivers/net/ppp/ppp_generic.c:1637 [inline]
__ppp_xmit_process+0x1902/0x2970 drivers/net/ppp/ppp_generic.c:1495
ppp_xmit_process+0x147/0x2f0 drivers/net/ppp/ppp_generic.c:1516
ppp_write+0x6bb/0x790 drivers/net/ppp/ppp_generic.c:512
do_loop_readv_writev fs/read_write.c:717 [inline]
do_iter_write+0x812/0xdc0 fs/read_write.c:1000
compat_writev+0x2df/0x5a0 fs/read_write.c:1351
do_compat_pwritev64 fs/read_write.c:1400 [inline]
__do_compat_sys_pwritev fs/read_write.c:1420 [inline]
__se_compat_sys_pwritev fs/read_write.c:1414 [inline]
__ia32_compat_sys_pwritev+0x349/0x3f0 fs/read_write.c:1414
do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline]
do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410
entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f7cd99
Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000ffdb84ac EFLAGS: 00000217 ORIG_RAX: 000000000000014e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000040047459 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82
slab_alloc_node mm/slub.c:2793 [inline]
__kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401
__kmalloc_reserve net/core/skbuff.c:142 [inline]
__alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210
alloc_skb include/linux/skbuff.h:1051 [inline]
ppp_write+0x115/0x790 drivers/net/ppp/ppp_generic.c:500
do_loop_readv_writev fs/read_write.c:717 [inline]
do_iter_write+0x812/0xdc0 fs/read_write.c:1000
compat_writev+0x2df/0x5a0 fs/read_write.c:1351
do_compat_pwritev64 fs/read_write.c:1400 [inline]
__do_compat_sys_pwritev fs/read_write.c:1420 [inline]
__se_compat_sys_pwritev fs/read_write.c:1414 [inline]
__ia32_compat_sys_pwritev+0x349/0x3f0 fs/read_write.c:1414
do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline]
do_fast_syscall_32+0x3c7/0x6e0 arch/x86/entry/common.c:410
entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139
Fixes: b5451d783ade ("slip: Move the SLIP drivers")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/slip/slhc.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -232,7 +232,7 @@ slhc_compress(struct slcompress *comp, u
register struct cstate *cs = lcs->next;
register unsigned long deltaS, deltaA;
register short changes = 0;
- int hlen;
+ int nlen, hlen;
unsigned char new_seq[16];
register unsigned char *cp = new_seq;
struct iphdr *ip;
@@ -248,6 +248,8 @@ slhc_compress(struct slcompress *comp, u
return isize;
ip = (struct iphdr *) icp;
+ if (ip->version != 4 || ip->ihl < 5)
+ return isize;
/* Bail if this packet isn't TCP, or is an IP fragment */
if (ip->protocol != IPPROTO_TCP || (ntohs(ip->frag_off) & 0x3fff)) {
@@ -258,10 +260,14 @@ slhc_compress(struct slcompress *comp, u
comp->sls_o_tcp++;
return isize;
}
- /* Extract TCP header */
+ nlen = ip->ihl * 4;
+ if (isize < nlen + sizeof(*th))
+ return isize;
- th = (struct tcphdr *)(((unsigned char *)ip) + ip->ihl*4);
- hlen = ip->ihl*4 + th->doff*4;
+ th = (struct tcphdr *)(icp + nlen);
+ if (th->doff < sizeof(struct tcphdr) / 4)
+ return isize;
+ hlen = nlen + th->doff * 4;
/* Bail if the TCP packet isn't `compressible' (i.e., ACK isn't set or
* some other control bit is set). Also uncompressible if
next prev parent reply other threads:[~2020-03-19 13:10 UTC|newest]
Thread overview: 94+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-19 12:59 [PATCH 4.9 00/90] 4.9.217-rc1 review Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 01/90] NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 02/90] phy: Revert toggling reset changes Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 03/90] net: phy: Avoid multiple suspends Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 04/90] cgroup, netclassid: periodically release file_lock on classid updating Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 05/90] gre: fix uninit-value in __iptunnel_pull_header Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 06/90] ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 07/90] net: macsec: update SCI upon MAC address change Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 08/90] net: nfc: fix bounds checking bugs on "pipe" Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 09/90] r8152: check disconnect status after long sleep Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 10/90] bnxt_en: reinitialize IRQs when MTU is modified Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 11/90] fib: add missing attribute validation for tun_id Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 12/90] nl802154: add missing attribute validation Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 13/90] nl802154: add missing attribute validation for dev_type Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 14/90] macsec: add missing attribute validation for port Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 15/90] net: fq: add missing attribute validation for orphan mask Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 16/90] team: add missing attribute validation for port ifindex Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 17/90] team: add missing attribute validation for array index Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 18/90] nfc: add missing attribute validation for SE API Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 19/90] nfc: add missing attribute validation for vendor subcommand Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 20/90] ipvlan: add cond_resched_rcu() while processing muticast backlog Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 21/90] ipvlan: do not add hardware address of master to its unicast filter list Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 22/90] ipvlan: egress mcast packets are not exceptional Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 23/90] ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast() Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 24/90] ipvlan: dont deref eth hdr before checking its set Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 25/90] macvlan: add cond_resched() during multicast processing Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 26/90] net: fec: validate the new settings in fec_enet_set_coalesce() Greg Kroah-Hartman
2020-03-19 12:59 ` Greg Kroah-Hartman [this message]
2020-03-19 12:59 ` [PATCH 4.9 28/90] bonding/alb: make sure arp header is pulled before accessing it Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 29/90] cgroup: memcg: net: do not associate sock with unrelated cgroup Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 30/90] net: phy: fix MDIO bus PM PHY resuming Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 31/90] virtio-blk: fix hw_queue stopped on arbitrary error Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 32/90] iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 33/90] workqueue: dont use wq_select_unbound_cpu() for bound works Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 34/90] drm/amd/display: remove duplicated assignment to grph_obj_type Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 35/90] cifs_atomic_open(): fix double-put on late allocation failure Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 36/90] gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache Greg Kroah-Hartman
2020-03-19 12:59 ` [PATCH 4.9 37/90] KVM: x86: clear stale x86_emulate_ctxt->intercept value Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 38/90] ARC: define __ALIGN_STR and __ALIGN symbols for ARC Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 39/90] efi: Fix a race and a buffer overflow while reading efivars via sysfs Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 40/90] iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 41/90] iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 42/90] nl80211: add missing attribute validation for critical protocol indication Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 43/90] nl80211: add missing attribute validation for beacon report scanning Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 44/90] nl80211: add missing attribute validation for channel switch Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 45/90] netfilter: cthelper: add missing attribute validation for cthelper Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 46/90] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 47/90] iommu/vt-d: Fix the wrong printing in RHSA parsing Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 48/90] iommu/vt-d: Ignore devices with out-of-spec domain number Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 49/90] ipv6: restrict IPV6_ADDRFORM operation Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 50/90] efi: Add a sanity check to efivar_store_raw() Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 51/90] batman-adv: Fix double free during fragment merge error Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 52/90] batman-adv: Fix transmission of final, 16th fragment Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 53/90] batman-adv: Initialize gw sel_class via batadv_algo Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 54/90] batman-adv: Fix rx packet/bytes stats on local ARP reply Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 55/90] batman-adv: Use default throughput value on cfg80211 error Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 56/90] batman-adv: Accept only filled wifi station info Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 57/90] batman-adv: fix TT sync flag inconsistencies Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 58/90] batman-adv: Avoid spurious warnings from bat_v neigh_cmp implementation Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 59/90] batman-adv: Always initialize fragment header priority Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 60/90] batman-adv: Fix check of retrieved orig_gw in batadv_v_gw_is_eligible Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 61/90] batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 62/90] batman-adv: Fix internal interface indices types Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 63/90] batman-adv: Avoid race in TT TVLV allocator helper Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 64/90] batman-adv: Fix TT sync flags for intermediate TT responses Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 65/90] batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 66/90] batman-adv: Fix debugfs path for renamed hardif Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 67/90] batman-adv: Fix debugfs path for renamed softif Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 68/90] batman-adv: Avoid storing non-TT-sync flags on singular entries too Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 69/90] batman-adv: Fix multicast TT issues with bogus ROAM flags Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 70/90] batman-adv: Prevent duplicated gateway_node entry Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 71/90] batman-adv: Fix duplicated OGMs on NETDEV_UP Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 72/90] batman-adv: Avoid free/alloc race when handling OGM2 buffer Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 73/90] batman-adv: Avoid free/alloc race when handling OGM buffer Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 74/90] batman-adv: Dont schedule OGM for disabled interface Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 75/90] batman-adv: update data pointers after skb_cow() Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 76/90] batman-adv: Avoid probe ELP information leak Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 77/90] batman-adv: Use explicit tvlv padding for ELP packets Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 78/90] perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 79/90] ACPI: watchdog: Allow disabling WDAT at boot Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 80/90] HID: apple: Add support for recent firmware on Magic Keyboards Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 81/90] HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 82/90] cfg80211: check reg_rule for NULL in handle_channel_custom() Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 83/90] net: ks8851-ml: Fix IRQ handling and locking Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 84/90] mac80211: rx: avoid RCU list traversal under mutex Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 85/90] signal: avoid double atomic counter increments for user accounting Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 86/90] jbd2: fix data races at struct journal_head Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 87/90] ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional() Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 88/90] ARM: 8958/1: rename missed uaccess .fixup section Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 89/90] mm: slub: add missing TID bump in kmem_cache_alloc_bulk() Greg Kroah-Hartman
2020-03-19 13:00 ` [PATCH 4.9 90/90] ipv4: ensure rcu_read_lock() in cipso_v4_error() Greg Kroah-Hartman
2020-03-19 18:01 ` [PATCH 4.9 00/90] 4.9.217-rc1 review Naresh Kamboju
2020-03-19 23:35 ` Guenter Roeck
2020-03-21 0:48 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200319123936.889172637@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.