* re: gre: Support GRE over IPv6
@ 2012-09-13 16:01 Dan Carpenter
2012-09-26 11:02 ` Dan Carpenter
0 siblings, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2012-09-13 16:01 UTC (permalink / raw)
To: xeb; +Cc: netdev
Hello Dmitry Kozlov,
The patch c12b395a4664: "gre: Support GRE over IPv6" from Aug 10,
2012, leads to the following warning:
net/ipv6/ip6_gre.c:1299 ip6gre_header_parse()
error: memcpy() 'haddr' too small (8 vs 16)
net/ipv6/ip6_gre.c
1296 static int ip6gre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
1297 {
1298 const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb_mac_header(skb);
1299 memcpy(haddr, &ipv6h->saddr, sizeof(struct in6_addr));
^^^^^
Smatch thinks this buffer is only 8 characters sometimes.
1300 return sizeof(struct in6_addr);
1301 }
One call tree where this would happen would be the
(struct sockaddr_ll *)sll->sll_addr[] in packet_rcv().
-> packet_rcv()
-> dev_parse_header()
-> ip6gre_header_parse()
I don't know the code well enough to say if this is a bug or not. Could
you take a look?
regards,
dan carpenter
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gre: Support GRE over IPv6
2012-09-13 16:01 gre: Support GRE over IPv6 Dan Carpenter
@ 2012-09-26 11:02 ` Dan Carpenter
2012-09-26 11:39 ` Eric Dumazet
0 siblings, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2012-09-26 11:02 UTC (permalink / raw)
To: xeb; +Cc: netdev
Hi Dmitry,
I never heard back on this whether it was memory corruption bug or
not?
regards,
dan carpenter
On Thu, Sep 13, 2012 at 07:01:05PM +0300, Dan Carpenter wrote:
> Hello Dmitry Kozlov,
>
> The patch c12b395a4664: "gre: Support GRE over IPv6" from Aug 10,
> 2012, leads to the following warning:
> net/ipv6/ip6_gre.c:1299 ip6gre_header_parse()
> error: memcpy() 'haddr' too small (8 vs 16)
>
> net/ipv6/ip6_gre.c
> 1296 static int ip6gre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
> 1297 {
> 1298 const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb_mac_header(skb);
> 1299 memcpy(haddr, &ipv6h->saddr, sizeof(struct in6_addr));
> ^^^^^
> Smatch thinks this buffer is only 8 characters sometimes.
>
> 1300 return sizeof(struct in6_addr);
> 1301 }
>
> One call tree where this would happen would be the
> (struct sockaddr_ll *)sll->sll_addr[] in packet_rcv().
>
> -> packet_rcv()
> -> dev_parse_header()
> -> ip6gre_header_parse()
>
> I don't know the code well enough to say if this is a bug or not. Could
> you take a look?
>
> regards,
> dan carpenter
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gre: Support GRE over IPv6
2012-09-26 11:02 ` Dan Carpenter
@ 2012-09-26 11:39 ` Eric Dumazet
2012-09-27 23:07 ` David Miller
0 siblings, 1 reply; 6+ messages in thread
From: Eric Dumazet @ 2012-09-26 11:39 UTC (permalink / raw)
To: Dan Carpenter; +Cc: xeb, netdev
From: Eric Dumazet <edumazet@google.com>
On Wed, 2012-09-26 at 14:02 +0300, Dan Carpenter wrote:
> Hi Dmitry,
>
> I never heard back on this whether it was memory corruption bug or
> not?
>
> regards,
> dan carpenter
>
> On Thu, Sep 13, 2012 at 07:01:05PM +0300, Dan Carpenter wrote:
> > Hello Dmitry Kozlov,
> >
> > The patch c12b395a4664: "gre: Support GRE over IPv6" from Aug 10,
> > 2012, leads to the following warning:
> > net/ipv6/ip6_gre.c:1299 ip6gre_header_parse()
> > error: memcpy() 'haddr' too small (8 vs 16)
> >
> > net/ipv6/ip6_gre.c
> > 1296 static int ip6gre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
> > 1297 {
> > 1298 const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb_mac_header(skb);
> > 1299 memcpy(haddr, &ipv6h->saddr, sizeof(struct in6_addr));
> > ^^^^^
> > Smatch thinks this buffer is only 8 characters sometimes.
> >
> > 1300 return sizeof(struct in6_addr);
> > 1301 }
> >
> > One call tree where this would happen would be the
> > (struct sockaddr_ll *)sll->sll_addr[] in packet_rcv().
> >
> > -> packet_rcv()
> > -> dev_parse_header()
> > -> ip6gre_header_parse()
> >
> > I don't know the code well enough to say if this is a bug or not. Could
> > you take a look?
All dev_parse_header() callers provide 8 bytes of storage.
By the way net/netfilter/nfnetlink_log.c and
net/netfilter/nfnetlink_queue_core.c leaks the _pad field to userspace,
I will send a separate patch to netfilter guys.
I would just remove this stuff, as it was copied/pasted from
ipv4/ip_gre.c without thinking of its use.
Thanks
[PATCH net-next] ipv6: gre: remove ip6gre_header_parse()
dev_parse_header() callers provide 8 bytes of storage,
so it's not possible to store an IPv6 address.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
---
net/ipv6/ip6_gre.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 424d11a..796f5d5 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1293,16 +1293,8 @@ static int ip6gre_header(struct sk_buff *skb, struct net_device *dev,
return -t->hlen;
}
-static int ip6gre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
-{
- const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb_mac_header(skb);
- memcpy(haddr, &ipv6h->saddr, sizeof(struct in6_addr));
- return sizeof(struct in6_addr);
-}
-
static const struct header_ops ip6gre_header_ops = {
.create = ip6gre_header,
- .parse = ip6gre_header_parse,
};
static const struct net_device_ops ip6gre_netdev_ops = {
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: gre: Support GRE over IPv6
2012-09-26 11:39 ` Eric Dumazet
@ 2012-09-27 23:07 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2012-09-27 23:07 UTC (permalink / raw)
To: eric.dumazet; +Cc: dan.carpenter, xeb, netdev
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Wed, 26 Sep 2012 13:39:20 +0200
> From: Eric Dumazet <edumazet@google.com>
...
> [PATCH net-next] ipv6: gre: remove ip6gre_header_parse()
>
> dev_parse_header() callers provide 8 bytes of storage,
> so it's not possible to store an IPv6 address.
>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied, thanks Eric.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gre: Support GRE over IPv6
[not found] <20121002205219.7C3BD340556@ra.kernel.org>
@ 2013-04-24 12:23 ` Geert Uytterhoeven
2013-04-24 15:14 ` Eric Dumazet
0 siblings, 1 reply; 6+ messages in thread
From: Geert Uytterhoeven @ 2013-04-24 12:23 UTC (permalink / raw)
To: Dmitry Kozlov, David S. Miller; +Cc: netdev, Linux Kernel Development
On Tue, 2 Oct 2012, Linux Kernel Mailing List wrote:
> Gitweb: http://git.kernel.org/linus/;a=commit;h=c12b395a46646bab69089ce7016ac78177f6001f
> Commit: c12b395a46646bab69089ce7016ac78177f6001f
> Parent: b7bc2a5b5bd99b216c3e5fe68c7f45c684ab5745
> Author: xeb@mail.ru <xeb@mail.ru>
> AuthorDate: Fri Aug 10 00:51:50 2012 +0000
> Committer: David S. Miller <davem@davemloft.net>
> CommitDate: Tue Aug 14 14:28:32 2012 -0700
>
> gre: Support GRE over IPv6
>
> GRE over IPv6 implementation.
>
> Signed-off-by: Dmitry Kozlov <xeb@mail.ru>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> --- /dev/null
> +++ b/net/ipv6/ip6_gre.c
> +static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
> + struct net_device *dev,
> + __u8 dsfield,
> + struct flowi6 *fl6,
> + int encap_limit,
> + __u32 *pmtu)
> +{
> + struct net *net = dev_net(dev);
> + struct ip6_tnl *tunnel = netdev_priv(dev);
> + struct net_device *tdev; /* Device to other host */
> + struct ipv6hdr *ipv6h; /* Our new IP header */
> + unsigned int max_headroom; /* The extra header space needed */
max_headroom is not initialized
> + mtu = dst_mtu(dst) - sizeof(*ipv6h);
> + if (encap_limit >= 0) {
> + max_headroom += 8;
Hence gcc (4.1.2) rightfully complains:
net/ipv6/ip6_gre.c: In function ‘ip6gre_xmit2’:
net/ipv6/ip6_gre.c:713: warning: ‘max_headroom’ is used uninitialized in this function
However, initializing max_headroom to zero at the top, or replacing the line
above by "max_headroom = 8" doesn't seem to be the right fix...
> + mtu -= 8;
> + }
> + if (mtu < IPV6_MIN_MTU)
> + mtu = IPV6_MIN_MTU;
> + if (skb_dst(skb))
> + skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
> + if (skb->len > mtu) {
> + *pmtu = mtu;
> + err = -EMSGSIZE;
> + goto tx_err_dst_release;
> + }
> +
> + if (tunnel->err_count > 0) {
> + if (time_before(jiffies,
> + tunnel->err_time + IP6TUNNEL_ERR_TIMEO)) {
> + tunnel->err_count--;
> +
> + dst_link_failure(skb);
> + } else
> + tunnel->err_count = 0;
> + }
> +
> + max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
... as max_headroom is overwritten here anyway?
So something is really wrong here. What is the right fix?
This issue is present in current mainline as of v3.7.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: gre: Support GRE over IPv6
2013-04-24 12:23 ` Geert Uytterhoeven
@ 2013-04-24 15:14 ` Eric Dumazet
0 siblings, 0 replies; 6+ messages in thread
From: Eric Dumazet @ 2013-04-24 15:14 UTC (permalink / raw)
To: Geert Uytterhoeven
Cc: Dmitry Kozlov, David S. Miller, netdev, Linux Kernel Development
On Wed, 2013-04-24 at 14:23 +0200, Geert Uytterhoeven wrote:
> On Tue, 2 Oct 2012, Linux Kernel Mailing List wrote:
> > Gitweb: http://git.kernel.org/linus/;a=commit;h=c12b395a46646bab69089ce7016ac78177f6001f
> > Commit: c12b395a46646bab69089ce7016ac78177f6001f
> > Parent: b7bc2a5b5bd99b216c3e5fe68c7f45c684ab5745
> > Author: xeb@mail.ru <xeb@mail.ru>
> > AuthorDate: Fri Aug 10 00:51:50 2012 +0000
> > Committer: David S. Miller <davem@davemloft.net>
> > CommitDate: Tue Aug 14 14:28:32 2012 -0700
> >
> > gre: Support GRE over IPv6
> >
> > GRE over IPv6 implementation.
> >
> > Signed-off-by: Dmitry Kozlov <xeb@mail.ru>
> > Signed-off-by: David S. Miller <davem@davemloft.net>
>
> > --- /dev/null
> > +++ b/net/ipv6/ip6_gre.c
>
> > +static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
> > + struct net_device *dev,
> > + __u8 dsfield,
> > + struct flowi6 *fl6,
> > + int encap_limit,
> > + __u32 *pmtu)
> > +{
> > + struct net *net = dev_net(dev);
> > + struct ip6_tnl *tunnel = netdev_priv(dev);
> > + struct net_device *tdev; /* Device to other host */
> > + struct ipv6hdr *ipv6h; /* Our new IP header */
> > + unsigned int max_headroom; /* The extra header space needed */
>
> max_headroom is not initialized
>
> > + mtu = dst_mtu(dst) - sizeof(*ipv6h);
> > + if (encap_limit >= 0) {
> > + max_headroom += 8;
>
> Hence gcc (4.1.2) rightfully complains:
>
> net/ipv6/ip6_gre.c: In function ‘ip6gre_xmit2’:
> net/ipv6/ip6_gre.c:713: warning: ‘max_headroom’ is used uninitialized in this function
>
> However, initializing max_headroom to zero at the top, or replacing the line
> above by "max_headroom = 8" doesn't seem to be the right fix...
>
> > + mtu -= 8;
> > + }
> > + if (mtu < IPV6_MIN_MTU)
> > + mtu = IPV6_MIN_MTU;
> > + if (skb_dst(skb))
> > + skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
> > + if (skb->len > mtu) {
> > + *pmtu = mtu;
> > + err = -EMSGSIZE;
> > + goto tx_err_dst_release;
> > + }
> > +
> > + if (tunnel->err_count > 0) {
> > + if (time_before(jiffies,
> > + tunnel->err_time + IP6TUNNEL_ERR_TIMEO)) {
> > + tunnel->err_count--;
> > +
> > + dst_link_failure(skb);
> > + } else
> > + tunnel->err_count = 0;
> > + }
> > +
> > + max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
>
> ... as max_headroom is overwritten here anyway?
>
> So something is really wrong here. What is the right fix?
>
> This issue is present in current mainline as of v3.7.
I would use following fix. Can you provide an official patch ?
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index d3ddd84..150d17d 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -620,7 +620,7 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
struct ip6_tnl *tunnel = netdev_priv(dev);
struct net_device *tdev; /* Device to other host */
struct ipv6hdr *ipv6h; /* Our new IP header */
- unsigned int max_headroom; /* The extra header space needed */
+ unsigned int max_headroom = 0; /* The extra header space needed */
int gre_hlen;
struct ipv6_tel_txoption opt;
int mtu;
@@ -693,7 +693,7 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
tunnel->err_count = 0;
}
- max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
+ max_headroom += LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
(skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-04-24 15:14 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-13 16:01 gre: Support GRE over IPv6 Dan Carpenter
2012-09-26 11:02 ` Dan Carpenter
2012-09-26 11:39 ` Eric Dumazet
2012-09-27 23:07 ` David Miller
[not found] <20121002205219.7C3BD340556@ra.kernel.org>
2013-04-24 12:23 ` Geert Uytterhoeven
2013-04-24 15:14 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).