[PATCH net] xfrm: iptfs: do not seek the sequential skb reader backwards

[Jun Yang <juny24602@gmail.com>]

From: Jun Yang <junvyyang@tencent.com>

iptfs_reassem_cont() completes a saved runt by reading the missing bytes
at payload offset "data", and then reads from that same offset again to
fill the inner IP header, deliberately re-copying them.

skb_seq_read() is forward-only. Once a read has stepped past the current
segment of a non-linear skb, st->stepped_offset is larger than the offset
of the re-read, and

	*data = st->cur_skb->data + (abs_offset - st->stepped_offset);

underflows in unsigned arithmetic. The companion return value
"block_limit - abs_offset" stays large and positive, so
skb_copy_seq_read() memcpy()s up to iphlen - runtlen bytes from about
4GiB past the skb data.

  BUG: unable to handle page fault for address: ffffed1025327a04
  Oops: 0000 [#1] SMP KASAN
  RIP: 0010:kasan_check_range+0x1bd/0x220
  Call Trace:
   __asan_memcpy+0x23/0x60
   skb_copy_seq_read+0x13a/0x150
   iptfs_reassem_cont+0x363/0x1780
   iptfs_input_ordered+0x673/0x880
   iptfs_input+0x5f7/0xed0
   xfrm_input+0x332b/0x7960
   xfrm4_esp_rcv+0xb3/0x290
   ip_local_deliver+0x1c3/0x600

The sibling parser __input_process_payload() already restarts the walk
when the reader has stepped; do the same after the runt fill. While here,
pass 0 rather than "data" as the new lower bound in that sibling, since
every caller keeps handing skb_copy_seq_read() absolute payload offsets
and skb_seq_read() adds lower_offset to them.

Fixes: 075694765446 ("xfrm: iptfs: handle received fragmented inner packets")
Cc: stable@kernel.org
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Assisted-by: tencentos-corvus-ai:hy4-preview
Signed-off-by: Jun Yang <junvyyang@tencent.com>
---
A KASAN reproducer for this issue is available if requested.

 net/xfrm/xfrm_iptfs.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_iptfs.c b/net/xfrm/xfrm_iptfs.c
index 597aedeac26e..c614f3483f78 100644
--- a/net/xfrm/xfrm_iptfs.c
+++ b/net/xfrm/xfrm_iptfs.c
@@ -845,6 +845,12 @@ static u32 iptfs_reassem_cont(struct xfrm_iptfs_data *xtfs, u64 seq,
 		 */
 		memcpy(skb_put(newskb, runtlen), xtfs->ra_runt,
 		       sizeof(xtfs->ra_runt));
+
+		/* The re-read below cannot back up a stepped seq read. */
+		if (unlikely(st->stepped_offset)) {
+			skb_abort_seq_read(st);
+			skb_prepare_seq_read(skb, 0, skb->len, st);
+		}
 	}
 
 	/* Continue reassembling the packet */
@@ -1038,7 +1044,7 @@ static bool __input_process_payload(struct xfrm_state *x, u32 data,
 			struct sk_buff *save = skbseq->root_skb;
 
 			skb_abort_seq_read(skbseq);
-			skb_prepare_seq_read(save, data, tail, skbseq);
+			skb_prepare_seq_read(save, 0, tail, skbseq);
 		}
 
 		if (first_skb) {
-- 
2.55.0