* [PATCH net] ipv6: fix uninit-value in ip6_multipath_l3_keys()
@ 2018-04-29 16:54 Eric Dumazet
2018-04-30 9:59 ` Jakub Sitnicki
2018-05-01 16:15 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Eric Dumazet @ 2018-04-29 16:54 UTC (permalink / raw)
To: David S . Miller; +Cc: netdev, Eric Dumazet, Eric Dumazet, Jakub Sitnicki
syzbot/KMSAN reported an uninit-value in ip6_multipath_l3_keys(),
root caused to a bad assumption of ICMP header being already
pulled in skb->head
ip_multipath_l3_keys() does the correct thing, so it is an IPv6 only bug.
BUG: KMSAN: uninit-value in ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline]
BUG: KMSAN: uninit-value in rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858
CPU: 0 PID: 4507 Comm: syz-executor661 Not tainted 4.16.0+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x185/0x1d0 lib/dump_stack.c:53
kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
__msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline]
rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858
ip6_route_input+0x65a/0x920 net/ipv6/route.c:1884
ip6_rcv_finish+0x413/0x6e0 net/ipv6/ip6_input.c:69
NF_HOOK include/linux/netfilter.h:288 [inline]
ipv6_rcv+0x1e16/0x2340 net/ipv6/ip6_input.c:208
__netif_receive_skb_core+0x47df/0x4a90 net/core/dev.c:4562
__netif_receive_skb net/core/dev.c:4627 [inline]
netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701
netif_receive_skb+0x230/0x240 net/core/dev.c:4725
tun_rx_batched drivers/net/tun.c:1555 [inline]
tun_get_user+0x740f/0x7c60 drivers/net/tun.c:1962
tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990
call_write_iter include/linux/fs.h:1782 [inline]
new_sync_write fs/read_write.c:469 [inline]
__vfs_write+0x7fb/0x9f0 fs/read_write.c:482
vfs_write+0x463/0x8d0 fs/read_write.c:544
SYSC_write+0x172/0x360 fs/read_write.c:589
SyS_write+0x55/0x80 fs/read_write.c:581
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
Fixes: 23aebdacb05d ("ipv6: Compute multipath hash for ICMP errors from offending packet")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Jakub Sitnicki <jkbs@redhat.com>
---
net/ipv6/route.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index cde7d8251377c1a115e02c46843d361d3c0b4313..f4d61736c41abe8cd7f439c4a37100e90c1eacca 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1835,11 +1835,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb,
const struct ipv6hdr *inner_iph;
const struct icmp6hdr *icmph;
struct ipv6hdr _inner_iph;
+ struct icmp6hdr _icmph;
if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6))
goto out;
- icmph = icmp6_hdr(skb);
+ icmph = skb_header_pointer(skb, skb_transport_offset(skb),
+ sizeof(_icmph), &_icmph);
+ if (!icmph)
+ goto out;
+
if (icmph->icmp6_type != ICMPV6_DEST_UNREACH &&
icmph->icmp6_type != ICMPV6_PKT_TOOBIG &&
icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
--
2.17.0.441.gb46fe60e1d-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] ipv6: fix uninit-value in ip6_multipath_l3_keys()
2018-04-29 16:54 [PATCH net] ipv6: fix uninit-value in ip6_multipath_l3_keys() Eric Dumazet
@ 2018-04-30 9:59 ` Jakub Sitnicki
2018-05-01 16:15 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Jakub Sitnicki @ 2018-04-30 9:59 UTC (permalink / raw)
To: Eric Dumazet; +Cc: David S . Miller, netdev, Eric Dumazet
On Sun, 29 Apr 2018 09:54:59 -0700
Eric Dumazet <edumazet@google.com> wrote:
> syzbot/KMSAN reported an uninit-value in ip6_multipath_l3_keys(),
> root caused to a bad assumption of ICMP header being already
> pulled in skb->head
>
> ip_multipath_l3_keys() does the correct thing, so it is an IPv6 only bug.
>
> BUG: KMSAN: uninit-value in ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline]
> BUG: KMSAN: uninit-value in rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858
> CPU: 0 PID: 4507 Comm: syz-executor661 Not tainted 4.16.0+ #87
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:17 [inline]
> dump_stack+0x185/0x1d0 lib/dump_stack.c:53
> kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
> __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
> ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline]
> rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858
> ip6_route_input+0x65a/0x920 net/ipv6/route.c:1884
> ip6_rcv_finish+0x413/0x6e0 net/ipv6/ip6_input.c:69
> NF_HOOK include/linux/netfilter.h:288 [inline]
> ipv6_rcv+0x1e16/0x2340 net/ipv6/ip6_input.c:208
> __netif_receive_skb_core+0x47df/0x4a90 net/core/dev.c:4562
> __netif_receive_skb net/core/dev.c:4627 [inline]
> netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701
> netif_receive_skb+0x230/0x240 net/core/dev.c:4725
> tun_rx_batched drivers/net/tun.c:1555 [inline]
> tun_get_user+0x740f/0x7c60 drivers/net/tun.c:1962
> tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990
> call_write_iter include/linux/fs.h:1782 [inline]
> new_sync_write fs/read_write.c:469 [inline]
> __vfs_write+0x7fb/0x9f0 fs/read_write.c:482
> vfs_write+0x463/0x8d0 fs/read_write.c:544
> SYSC_write+0x172/0x360 fs/read_write.c:589
> SyS_write+0x55/0x80 fs/read_write.c:581
> do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
> entry_SYSCALL_64_after_hwframe+0x3d/0xa2
>
> Fixes: 23aebdacb05d ("ipv6: Compute multipath hash for ICMP errors from offending packet")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Cc: Jakub Sitnicki <jkbs@redhat.com>
> ---
> net/ipv6/route.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index cde7d8251377c1a115e02c46843d361d3c0b4313..f4d61736c41abe8cd7f439c4a37100e90c1eacca 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -1835,11 +1835,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb,
> const struct ipv6hdr *inner_iph;
> const struct icmp6hdr *icmph;
> struct ipv6hdr _inner_iph;
> + struct icmp6hdr _icmph;
>
> if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6))
> goto out;
>
> - icmph = icmp6_hdr(skb);
> + icmph = skb_header_pointer(skb, skb_transport_offset(skb),
> + sizeof(_icmph), &_icmph);
> + if (!icmph)
> + goto out;
> +
> if (icmph->icmp6_type != ICMPV6_DEST_UNREACH &&
> icmph->icmp6_type != ICMPV6_PKT_TOOBIG &&
> icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
Thank you for the fix. I was not being careful there.
Acked-by: Jakub Sitnicki <jkbs@redhat.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] ipv6: fix uninit-value in ip6_multipath_l3_keys()
2018-04-29 16:54 [PATCH net] ipv6: fix uninit-value in ip6_multipath_l3_keys() Eric Dumazet
2018-04-30 9:59 ` Jakub Sitnicki
@ 2018-05-01 16:15 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2018-05-01 16:15 UTC (permalink / raw)
To: edumazet; +Cc: netdev, eric.dumazet, jkbs
From: Eric Dumazet <edumazet@google.com>
Date: Sun, 29 Apr 2018 09:54:59 -0700
> syzbot/KMSAN reported an uninit-value in ip6_multipath_l3_keys(),
> root caused to a bad assumption of ICMP header being already
> pulled in skb->head
>
> ip_multipath_l3_keys() does the correct thing, so it is an IPv6 only bug.
...
> Fixes: 23aebdacb05d ("ipv6: Compute multipath hash for ICMP errors from offending packet")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
Series applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-05-01 16:16 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-04-29 16:54 [PATCH net] ipv6: fix uninit-value in ip6_multipath_l3_keys() Eric Dumazet
2018-04-30 9:59 ` Jakub Sitnicki
2018-05-01 16:15 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).