From: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
To: davem@davemloft.net, kuba@kernel.org, edumazet@google.com,
willemb@google.com, xie.he.0141@gmail.com, gustavoars@kernel.org,
wanghai38@huawei.com, tannerlove@google.com,
eyal.birger@gmail.com, rsanger@wand.net.nz,
jiapeng.chong@linux.alibaba.com
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Can a valid vnet header have both csum_start and csum_offset 0?
Date: Wed, 11 Aug 2021 00:36:30 +0530 [thread overview]
Message-ID: <YRLONiYsdqKLeja3@fedora> (raw)
Hi,
When parsing the vnet header in __packet_snd_vnet_parse[1], we do not
check for if the values of csum_start and csum_offset given in the
header are both 0.
Having both these values 0, however, causes a crash[2] further down the
gre xmit code path. In the function ipgre_xmit, we pull the ip header
and gre header from skb->data, this results in an invalid
skb->csum_start which was calculated from the vnet header. The
skb->csum_start offset in this case turns out to be lower than
skb->transport_header. This causes us to pass a negative number as an
argument to csum_partial[3] and eventually to do_csum[4], which then causes
a kernel oops in the while loop.
I do not understand what should the correct behavior be in this
scenario, should we consider this vnet header as invalid? (Which I think
is the most likely solution, however I do not have experience with
networking.) Or should we rather accomodate for both csum_start
and csum_offset values to be 0 in ipgre_xmit?
Regards,
Shreyansh Chouhan
--
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/packet/af_packet.c#n2480
[2] https://syzkaller.appspot.com/bug?id=c391f74aac26dd8311c45743ae618f9d5e38b674
[3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/skbuff.h#n4662
[4] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/lib/csum-partial_64.c#n35
next reply other threads:[~2021-08-10 19:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-10 19:06 Shreyansh Chouhan [this message]
2021-08-12 4:36 ` Can a valid vnet header have both csum_start and csum_offset 0? Shreyansh Chouhan
2021-08-16 15:17 ` Willem de Bruijn
2021-08-18 5:12 ` Shreyansh Chouhan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YRLONiYsdqKLeja3@fedora \
--to=chouhan.shreyansh630@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eyal.birger@gmail.com \
--cc=gustavoars@kernel.org \
--cc=jiapeng.chong@linux.alibaba.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=rsanger@wand.net.nz \
--cc=tannerlove@google.com \
--cc=wanghai38@huawei.com \
--cc=willemb@google.com \
--cc=xie.he.0141@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.