* [PATCH net-next] ip6_tunnel: fix possible NULL deref in ip6_tnl_xmit
@ 2022-02-08 21:41 Eric Dumazet
2022-02-09 12:00 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: Eric Dumazet @ 2022-02-08 21:41 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski
Cc: netdev, David Ahern, Eric Dumazet, Eric Dumazet, Qing Deng,
syzbot
From: Eric Dumazet <edumazet@google.com>
Make sure to test that skb has a dst attached to it.
general protection fault, probably for non-canonical address 0xdffffc0000000011: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]
CPU: 0 PID: 32650 Comm: syz-executor.4 Not tainted 5.17.0-rc2-next-20220204-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ip6_tnl_xmit+0x2140/0x35f0 net/ipv6/ip6_tunnel.c:1127
Code: 4d 85 f6 0f 85 c5 04 00 00 e8 9c b0 66 f9 48 83 e3 fe 48 b8 00 00 00 00 00 fc ff df 48 8d bb 88 00 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 07 7f 05 e8 11 25 b2 f9 44 0f b6 b3 88 00 00
RSP: 0018:ffffc900141b7310 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000c77a000
RDX: 0000000000000011 RSI: ffffffff8811f854 RDI: 0000000000000088
RBP: ffffc900141b7480 R08: 0000000000000000 R09: 0000000000000008
R10: ffffffff8811f846 R11: 0000000000000008 R12: ffffc900141b7548
R13: ffff8880297c6000 R14: 0000000000000000 R15: ffff8880351c8dc0
FS: 00007f9827ba2700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31322000 CR3: 0000000033a70000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1386 [inline]
ip6_tnl_start_xmit+0x71e/0x1830 net/ipv6/ip6_tunnel.c:1435
__netdev_start_xmit include/linux/netdevice.h:4683 [inline]
netdev_start_xmit include/linux/netdevice.h:4697 [inline]
xmit_one net/core/dev.c:3473 [inline]
dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3489
__dev_queue_xmit+0x2a24/0x3760 net/core/dev.c:4116
packet_snd net/packet/af_packet.c:3057 [inline]
packet_sendmsg+0x2265/0x5460 net/packet/af_packet.c:3084
sock_sendmsg_nosec net/socket.c:705 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:725
sock_write_iter+0x289/0x3c0 net/socket.c:1061
call_write_iter include/linux/fs.h:2075 [inline]
do_iter_readv_writev+0x47a/0x750 fs/read_write.c:726
do_iter_write+0x188/0x710 fs/read_write.c:852
vfs_writev+0x1aa/0x630 fs/read_write.c:925
do_writev+0x27f/0x300 fs/read_write.c:968
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f9828c2d059
Fixes: c1f55c5e0482 ("ip6_tunnel: allow routing IPv4 traffic in NBMA mode")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Qing Deng <i@moy.cat>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
net/ipv6/ip6_tunnel.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index b47ffc81f9e51f152608c22c1c02d9ababf99137..53f632a560ec2019a73b35a61ea24a219a4a49c7 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1122,7 +1122,10 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
neigh_release(neigh);
} else if (skb->protocol == htons(ETH_P_IP)) {
- struct rtable *rt = skb_rtable(skb);
+ const struct rtable *rt = skb_rtable(skb);
+
+ if (!rt)
+ goto tx_err_link_failure;
if (rt->rt_gw_family == AF_INET6)
memcpy(&fl6->daddr, &rt->rt_gw6, sizeof(fl6->daddr));
--
2.35.0.263.gb82422642f-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next] ip6_tunnel: fix possible NULL deref in ip6_tnl_xmit
2022-02-08 21:41 [PATCH net-next] ip6_tunnel: fix possible NULL deref in ip6_tnl_xmit Eric Dumazet
@ 2022-02-09 12:00 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-02-09 12:00 UTC (permalink / raw)
To: Eric Dumazet; +Cc: davem, kuba, netdev, dsahern, edumazet, i, syzkaller
Hello:
This patch was applied to netdev/net-next.git (master)
by David S. Miller <davem@davemloft.net>:
On Tue, 8 Feb 2022 13:41:48 -0800 you wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> Make sure to test that skb has a dst attached to it.
>
> general protection fault, probably for non-canonical address 0xdffffc0000000011: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]
> CPU: 0 PID: 32650 Comm: syz-executor.4 Not tainted 5.17.0-rc2-next-20220204-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:ip6_tnl_xmit+0x2140/0x35f0 net/ipv6/ip6_tunnel.c:1127
> Code: 4d 85 f6 0f 85 c5 04 00 00 e8 9c b0 66 f9 48 83 e3 fe 48 b8 00 00 00 00 00 fc ff df 48 8d bb 88 00 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 07 7f 05 e8 11 25 b2 f9 44 0f b6 b3 88 00 00
> RSP: 0018:ffffc900141b7310 EFLAGS: 00010206
> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000c77a000
> RDX: 0000000000000011 RSI: ffffffff8811f854 RDI: 0000000000000088
> RBP: ffffc900141b7480 R08: 0000000000000000 R09: 0000000000000008
> R10: ffffffff8811f846 R11: 0000000000000008 R12: ffffc900141b7548
> R13: ffff8880297c6000 R14: 0000000000000000 R15: ffff8880351c8dc0
> FS: 00007f9827ba2700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000001b31322000 CR3: 0000000033a70000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1386 [inline]
> ip6_tnl_start_xmit+0x71e/0x1830 net/ipv6/ip6_tunnel.c:1435
> __netdev_start_xmit include/linux/netdevice.h:4683 [inline]
> netdev_start_xmit include/linux/netdevice.h:4697 [inline]
> xmit_one net/core/dev.c:3473 [inline]
> dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3489
> __dev_queue_xmit+0x2a24/0x3760 net/core/dev.c:4116
> packet_snd net/packet/af_packet.c:3057 [inline]
> packet_sendmsg+0x2265/0x5460 net/packet/af_packet.c:3084
> sock_sendmsg_nosec net/socket.c:705 [inline]
> sock_sendmsg+0xcf/0x120 net/socket.c:725
> sock_write_iter+0x289/0x3c0 net/socket.c:1061
> call_write_iter include/linux/fs.h:2075 [inline]
> do_iter_readv_writev+0x47a/0x750 fs/read_write.c:726
> do_iter_write+0x188/0x710 fs/read_write.c:852
> vfs_writev+0x1aa/0x630 fs/read_write.c:925
> do_writev+0x27f/0x300 fs/read_write.c:968
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7f9828c2d059
>
> [...]
Here is the summary with links:
- [net-next] ip6_tunnel: fix possible NULL deref in ip6_tnl_xmit
https://git.kernel.org/netdev/net-next/c/3a5f238f2b36
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-02-09 12:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-02-08 21:41 [PATCH net-next] ip6_tunnel: fix possible NULL deref in ip6_tnl_xmit Eric Dumazet
2022-02-09 12:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).