From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Wang Subject: Re: [PATCH net v3] gso: validate gso_type in GSO handlers Date: Mon, 22 Jan 2018 10:42:47 +0800 Message-ID: <4d1d3376-1125-e0c4-5787-683ce9a606fc@redhat.com> References: <20180119142918.115831-1-willemdebruijn.kernel@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Cc: davem@davemloft.net, edumazet@google.com, tom@herbertland.com, herbert@gondor.apana.org.au, Willem de Bruijn To: Willem de Bruijn , netdev@vger.kernel.org Return-path: Received: from mx1.redhat.com ([209.132.183.28]:35248 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751098AbeAVCmy (ORCPT ); Sun, 21 Jan 2018 21:42:54 -0500 In-Reply-To: <20180119142918.115831-1-willemdebruijn.kernel@gmail.com> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 2018年01月19日 22:29, Willem de Bruijn wrote: > From: Willem de Bruijn > > Validate gso_type during segmentation as SKB_GSO_DODGY sources > may pass packets where the gso_type does not match the contents. > > Syzkaller was able to enter the SCTP gso handler with a packet of > gso_type SKB_GSO_TCPV4. > > On entry of transport layer gso handlers, verify that the gso_type > matches the transport protocol. > > Fixes: 90017accff61 ("sctp: Add GSO support") > Link:http://lkml.kernel.org/r/<001a1137452496ffc305617e5fe0@google.com> > Reported-by:syzbot+fee64147a25aecd48055@syzkaller.appspotmail.com > Signed-off-by: Willem de Bruijn > > --- > Similar checks existed until removed in commit 5c7cdf339af5 ("gso: > Remove arbitrary checks for unsupported GSO"). But those were limited > to the TSO path, not software GSO. I believe that this issue goes > back further, hence the Fixes at the first user of virtio_net_hdr. > --- > net/ipv4/esp4_offload.c | 3 +++ > net/ipv4/tcp_offload.c | 3 +++ > net/ipv4/udp_offload.c | 3 +++ > net/ipv6/esp6_offload.c | 3 +++ > net/ipv6/tcpv6_offload.c | 3 +++ > net/ipv6/udp_offload.c | 3 +++ > net/sctp/offload.c | 3 +++ > 7 files changed, 21 insertions(+) Acked-by: Jason Wang Thanks