[PATCH net] vxlan: do not feed vxlan_vnifilter_dump_dev with non vxlan devices

[PATCH net] vxlan: do not feed vxlan_vnifilter_dump_dev with non vxlan devices

[Eric Dumazet]

From: Eric Dumazet <edumazet@google.com>

vxlan_vnifilter_dump_dev() assumes it is called only
for vxlan devices. Make sure it is the case.

BUG: KASAN: slab-out-of-bounds in vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349
Read of size 4 at addr ffff888060d1ce70 by task syz-executor.3/17662

CPU: 0 PID: 17662 Comm: syz-executor.3 Tainted: G        W         5.17.0-syzkaller-12888-g77c9387c0c5b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349
 vxlan_vnifilter_dump+0x3ff/0x650 drivers/net/vxlan/vxlan_vnifilter.c:428
 netlink_dump+0x4b5/0xb70 net/netlink/af_netlink.c:2270
 __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2375
 netlink_dump_start include/linux/netlink.h:245 [inline]
 rtnetlink_rcv_msg+0x70c/0xb80 net/core/rtnetlink.c:5953
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:705 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:725
 ____sys_sendmsg+0x6e2/0x800 net/socket.c:2413
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f87b8e89049

Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Roopa Prabhu <roopa@nvidia.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
 drivers/net/vxlan/vxlan_vnifilter.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c
index 9f28d0b6a6b26690fec5379956d75b988ea07a36..3e04af4c5daa10f5bebf68f7b33876fe9b09fea9 100644
--- a/drivers/net/vxlan/vxlan_vnifilter.c
+++ b/drivers/net/vxlan/vxlan_vnifilter.c
@@ -425,6 +425,12 @@ static int vxlan_vnifilter_dump(struct sk_buff *skb, struct netlink_callback *cb
 			err = -ENODEV;
 			goto out_err;
 		}
+		if (!netif_is_vxlan(dev)) {
+			NL_SET_ERR_MSG(cb->extack,
+				       "The device is not a vxlan device");
+			err = -EINVAL;
+			goto out_err;
+		}
 		err = vxlan_vnifilter_dump_dev(dev, skb, cb);
 		/* if the dump completed without an error we return 0 here */
 		if (err != -EMSGSIZE)
-- 
2.35.1.1021.g381101b075-goog

Re: [PATCH net] vxlan: do not feed vxlan_vnifilter_dump_dev with non vxlan devices

[Roopa Prabhu]

On 3/30/22 12:46, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> vxlan_vnifilter_dump_dev() assumes it is called only
> for vxlan devices. Make sure it is the case.
>
> BUG: KASAN: slab-out-of-bounds in vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349
> Read of size 4 at addr ffff888060d1ce70 by task syz-executor.3/17662
>
> CPU: 0 PID: 17662 Comm: syz-executor.3 Tainted: G        W         5.17.0-syzkaller-12888-g77c9387c0c5b #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
>   <TASK>
>   __dump_stack lib/dump_stack.c:88 [inline]
>   dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
>   print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
>   print_report mm/kasan/report.c:429 [inline]
>   kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
>   vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349
>   vxlan_vnifilter_dump+0x3ff/0x650 drivers/net/vxlan/vxlan_vnifilter.c:428
>   netlink_dump+0x4b5/0xb70 net/netlink/af_netlink.c:2270
>   __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2375
>   netlink_dump_start include/linux/netlink.h:245 [inline]
>   rtnetlink_rcv_msg+0x70c/0xb80 net/core/rtnetlink.c:5953
>   netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496
>   netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
>   netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
>   netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1921
>   sock_sendmsg_nosec net/socket.c:705 [inline]
>   sock_sendmsg+0xcf/0x120 net/socket.c:725
>   ____sys_sendmsg+0x6e2/0x800 net/socket.c:2413
>   ___sys_sendmsg+0xf3/0x170 net/socket.c:2467
>   __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496
>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>   do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
>   entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7f87b8e89049
>
> Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Roopa Prabhu <roopa@nvidia.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>

Acked-by: Roopa Prabhu <roopa@nvidia.com>

I thought i had a check there. thanks for the patch eric!.

Re: [PATCH net] vxlan: do not feed vxlan_vnifilter_dump_dev with non vxlan devices

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 30 Mar 2022 12:46:43 -0700 you wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> vxlan_vnifilter_dump_dev() assumes it is called only
> for vxlan devices. Make sure it is the case.
> 
> BUG: KASAN: slab-out-of-bounds in vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349
> Read of size 4 at addr ffff888060d1ce70 by task syz-executor.3/17662
> 
> [...]

Here is the summary with links:
  - [net] vxlan: do not feed vxlan_vnifilter_dump_dev with non vxlan devices
    https://git.kernel.org/netdev/net/c/9d570741aec1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html