From: Jakub Sitnicki <jkbs@redhat.com>
To: Eric Dumazet <edumazet@google.com>
Cc: "David S . Miller" <davem@davemloft.net>,
netdev <netdev@vger.kernel.org>,
Eric Dumazet <eric.dumazet@gmail.com>
Subject: Re: [PATCH net] ipv6: fix uninit-value in ip6_multipath_l3_keys()
Date: Mon, 30 Apr 2018 11:59:37 +0200 [thread overview]
Message-ID: <20180430115937.5a186020@beetle> (raw)
In-Reply-To: <20180429165459.164538-1-edumazet@google.com>
On Sun, 29 Apr 2018 09:54:59 -0700
Eric Dumazet <edumazet@google.com> wrote:
> syzbot/KMSAN reported an uninit-value in ip6_multipath_l3_keys(),
> root caused to a bad assumption of ICMP header being already
> pulled in skb->head
>
> ip_multipath_l3_keys() does the correct thing, so it is an IPv6 only bug.
>
> BUG: KMSAN: uninit-value in ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline]
> BUG: KMSAN: uninit-value in rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858
> CPU: 0 PID: 4507 Comm: syz-executor661 Not tainted 4.16.0+ #87
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:17 [inline]
> dump_stack+0x185/0x1d0 lib/dump_stack.c:53
> kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
> __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
> ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline]
> rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858
> ip6_route_input+0x65a/0x920 net/ipv6/route.c:1884
> ip6_rcv_finish+0x413/0x6e0 net/ipv6/ip6_input.c:69
> NF_HOOK include/linux/netfilter.h:288 [inline]
> ipv6_rcv+0x1e16/0x2340 net/ipv6/ip6_input.c:208
> __netif_receive_skb_core+0x47df/0x4a90 net/core/dev.c:4562
> __netif_receive_skb net/core/dev.c:4627 [inline]
> netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701
> netif_receive_skb+0x230/0x240 net/core/dev.c:4725
> tun_rx_batched drivers/net/tun.c:1555 [inline]
> tun_get_user+0x740f/0x7c60 drivers/net/tun.c:1962
> tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990
> call_write_iter include/linux/fs.h:1782 [inline]
> new_sync_write fs/read_write.c:469 [inline]
> __vfs_write+0x7fb/0x9f0 fs/read_write.c:482
> vfs_write+0x463/0x8d0 fs/read_write.c:544
> SYSC_write+0x172/0x360 fs/read_write.c:589
> SyS_write+0x55/0x80 fs/read_write.c:581
> do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
> entry_SYSCALL_64_after_hwframe+0x3d/0xa2
>
> Fixes: 23aebdacb05d ("ipv6: Compute multipath hash for ICMP errors from offending packet")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Cc: Jakub Sitnicki <jkbs@redhat.com>
> ---
> net/ipv6/route.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index cde7d8251377c1a115e02c46843d361d3c0b4313..f4d61736c41abe8cd7f439c4a37100e90c1eacca 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -1835,11 +1835,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb,
> const struct ipv6hdr *inner_iph;
> const struct icmp6hdr *icmph;
> struct ipv6hdr _inner_iph;
> + struct icmp6hdr _icmph;
>
> if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6))
> goto out;
>
> - icmph = icmp6_hdr(skb);
> + icmph = skb_header_pointer(skb, skb_transport_offset(skb),
> + sizeof(_icmph), &_icmph);
> + if (!icmph)
> + goto out;
> +
> if (icmph->icmp6_type != ICMPV6_DEST_UNREACH &&
> icmph->icmp6_type != ICMPV6_PKT_TOOBIG &&
> icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
Thank you for the fix. I was not being careful there.
Acked-by: Jakub Sitnicki <jkbs@redhat.com>
next prev parent reply other threads:[~2018-04-30 9:59 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-29 16:54 [PATCH net] ipv6: fix uninit-value in ip6_multipath_l3_keys() Eric Dumazet
2018-04-30 9:59 ` Jakub Sitnicki [this message]
2018-05-01 16:15 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180430115937.5a186020@beetle \
--to=jkbs@redhat.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).