[PATCH net 0/2] Fix two further potential unbounded recursions in GUE error handlers

[PATCH net 0/2] Fix two further potential unbounded recursions in GUE error handlers

[Stefano Brivio]

Patch 1/2 takes care of preventing the issue fixed by commit 11789039da53
("fou: Prevent unbounded recursion in GUE error handler") also with
UDP-Lite payloads -- I just realised this might happen from a syzbot
report.

Patch 2/2 fixes the issue for both UDP and UDP-Lite on IPv6, which I also
forgot to deal with in that same commit.

Stefano Brivio (2):
  fou: Prevent unbounded recursion in GUE error handler also with
    UDP-Lite
  fou6: Prevent unbounded recursion in GUE error handler

 net/ipv4/fou.c  | 3 ++-
 net/ipv6/fou6.c | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

-- 
2.20.1

[PATCH net 1/2] fou: Prevent unbounded recursion in GUE error handler also with UDP-Lite

[Stefano Brivio]

In commit 11789039da53 ("fou: Prevent unbounded recursion in GUE error
handler"), I didn't take care of the case where UDP-Lite is encapsulated
into UDP or UDP-Lite with GUE. From a syzbot report about a possibly
similar issue with GUE on IPv6, I just realised the same thing might
happen with a UDP-Lite inner payload.

Also skip exception handling for inner UDP-Lite protocol.

Fixes: 11789039da53 ("fou: Prevent unbounded recursion in GUE error handler")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 net/ipv4/fou.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 0c9f171fb085..632863541082 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -1065,7 +1065,8 @@ static int gue_err(struct sk_buff *skb, u32 info)
 	 * recursion. Besides, this kind of encapsulation can't even be
 	 * configured currently. Discard this.
 	 */
-	if (guehdr->proto_ctype == IPPROTO_UDP)
+	if (guehdr->proto_ctype == IPPROTO_UDP ||
+	    guehdr->proto_ctype == IPPROTO_UDPLITE)
 		return -EOPNOTSUPP;
 
 	skb_set_transport_header(skb, -(int)sizeof(struct icmphdr));
-- 
2.20.1

[PATCH net 2/2] fou6: Prevent unbounded recursion in GUE error handler

[Stefano Brivio]

I forgot to deal with IPv6 in commit 11789039da53 ("fou: Prevent unbounded
recursion in GUE error handler").

Now syzbot reported what might be the same type of issue, caused by
gue6_err(), that is, handling exceptions for direct UDP encapsulation in
GUE (UDP-in-UDP) leads to unbounded recursion in the GUE exception
handler.

As it probably doesn't make sense to set up GUE this way, and it's
currently not even possible to configure this, skip exception handling for
UDP (or UDP-Lite) packets encapsulated in UDP (or UDP-Lite) packets with
GUE on IPv6.

Reported-by: syzbot+4ad25edc7a33e4ab91e0@syzkaller.appspotmail.com
Reported-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: b8a51b38e4d4 ("fou, fou6: ICMP error handlers for FoU and GUE")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 net/ipv6/fou6.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c
index bd675c61deb1..7da7bf3b7fe3 100644
--- a/net/ipv6/fou6.c
+++ b/net/ipv6/fou6.c
@@ -131,6 +131,14 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	if (validate_gue_flags(guehdr, optlen))
 		return -EINVAL;
 
+	/* Handling exceptions for direct UDP encapsulation in GUE would lead to
+	 * recursion. Besides, this kind of encapsulation can't even be
+	 * configured currently. Discard this.
+	 */
+	if (guehdr->proto_ctype == IPPROTO_UDP ||
+	    guehdr->proto_ctype == IPPROTO_UDPLITE)
+		return -EOPNOTSUPP;
+
 	skb_set_transport_header(skb, -(int)sizeof(struct icmp6hdr));
 	ret = gue6_err_proto_handler(guehdr->proto_ctype, skb,
 				     opt, type, code, offset, info);
-- 
2.20.1

Re: [PATCH net 0/2] Fix two further potential unbounded recursions in GUE error handlers

[David Miller]

From: Stefano Brivio <sbrivio@redhat.com>
Date: Thu,  3 Jan 2019 21:43:33 +0100

> Patch 1/2 takes care of preventing the issue fixed by commit 11789039da53
> ("fou: Prevent unbounded recursion in GUE error handler") also with
> UDP-Lite payloads -- I just realised this might happen from a syzbot
> report.
> 
> Patch 2/2 fixes the issue for both UDP and UDP-Lite on IPv6, which I also
> forgot to deal with in that same commit.

Series applied, thanks.