* [PATCH net] gtp: pull network headers in gtp_dev_xmit()
@ 2024-08-08 13:24 Eric Dumazet
2024-08-09 7:59 ` Pablo Neira Ayuso
2024-08-10 5:10 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Eric Dumazet @ 2024-08-08 13:24 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: netdev, eric.dumazet, Eric Dumazet, Pablo Neira Ayuso,
Harald Welte
syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1]
We must make sure the IPv4 or Ipv6 header is pulled in skb->head
before accessing fields in them.
Use pskb_inet_may_pull() to fix this issue.
[1]
BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline]
BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline]
BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281
ipv6_pdp_find drivers/net/gtp.c:220 [inline]
gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline]
gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281
__netdev_start_xmit include/linux/netdevice.h:4913 [inline]
netdev_start_xmit include/linux/netdevice.h:4922 [inline]
xmit_one net/core/dev.c:3580 [inline]
dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596
__dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423
dev_queue_xmit include/linux/netdevice.h:3105 [inline]
packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276
packet_snd net/packet/af_packet.c:3145 [inline]
packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745
__sys_sendto+0x685/0x830 net/socket.c:2204
__do_sys_sendto net/socket.c:2216 [inline]
__se_sys_sendto net/socket.c:2212 [inline]
__x64_sys_sendto+0x125/0x1d0 net/socket.c:2212
x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3994 [inline]
slab_alloc_node mm/slub.c:4037 [inline]
kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080
kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583
__alloc_skb+0x363/0x7b0 net/core/skbuff.c:674
alloc_skb include/linux/skbuff.h:1320 [inline]
alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526
sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815
packet_alloc_skb net/packet/af_packet.c:2994 [inline]
packet_snd net/packet/af_packet.c:3088 [inline]
packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745
__sys_sendto+0x685/0x830 net/socket.c:2204
__do_sys_sendto net/socket.c:2216 [inline]
__se_sys_sendto net/socket.c:2212 [inline]
__x64_sys_sendto+0x125/0x1d0 net/socket.c:2212
x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Fixes: 999cb275c807 ("gtp: add IPv6 support")
Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Harald Welte <laforge@gnumonks.org>
---
drivers/net/gtp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 427b91aca50d3a370e4ad00071f0c477fefa5076..0696faf60013e0669ceb4aa39dfbac17ad741540 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -1269,6 +1269,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev)
if (skb_cow_head(skb, dev->needed_headroom))
goto tx_err;
+ if (!pskb_inet_may_pull(skb))
+ goto tx_err;
+
skb_reset_inner_headers(skb);
/* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */
--
2.46.0.rc2.264.g509ed76dc8-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net] gtp: pull network headers in gtp_dev_xmit()
2024-08-08 13:24 [PATCH net] gtp: pull network headers in gtp_dev_xmit() Eric Dumazet
@ 2024-08-09 7:59 ` Pablo Neira Ayuso
2024-08-10 5:10 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2024-08-09 7:59 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, netdev,
eric.dumazet, Harald Welte
On Thu, Aug 08, 2024 at 01:24:55PM +0000, Eric Dumazet wrote:
> syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1]
>
> We must make sure the IPv4 or Ipv6 header is pulled in skb->head
> before accessing fields in them.
>
> Use pskb_inet_may_pull() to fix this issue.
>
> [1]
> BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline]
> BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline]
> BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281
> ipv6_pdp_find drivers/net/gtp.c:220 [inline]
> gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline]
> gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281
> __netdev_start_xmit include/linux/netdevice.h:4913 [inline]
> netdev_start_xmit include/linux/netdevice.h:4922 [inline]
> xmit_one net/core/dev.c:3580 [inline]
> dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596
> __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423
> dev_queue_xmit include/linux/netdevice.h:3105 [inline]
> packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276
> packet_snd net/packet/af_packet.c:3145 [inline]
> packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x30f/0x380 net/socket.c:745
> __sys_sendto+0x685/0x830 net/socket.c:2204
> __do_sys_sendto net/socket.c:2216 [inline]
> __se_sys_sendto net/socket.c:2212 [inline]
> __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212
> x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Uninit was created at:
> slab_post_alloc_hook mm/slub.c:3994 [inline]
> slab_alloc_node mm/slub.c:4037 [inline]
> kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080
> kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583
> __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674
> alloc_skb include/linux/skbuff.h:1320 [inline]
> alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526
> sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815
> packet_alloc_skb net/packet/af_packet.c:2994 [inline]
> packet_snd net/packet/af_packet.c:3088 [inline]
> packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x30f/0x380 net/socket.c:745
> __sys_sendto+0x685/0x830 net/socket.c:2204
> __do_sys_sendto net/socket.c:2216 [inline]
> __se_sys_sendto net/socket.c:2212 [inline]
> __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212
> x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
>
> Fixes: 999cb275c807 ("gtp: add IPv6 support")
> Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] gtp: pull network headers in gtp_dev_xmit()
2024-08-08 13:24 [PATCH net] gtp: pull network headers in gtp_dev_xmit() Eric Dumazet
2024-08-09 7:59 ` Pablo Neira Ayuso
@ 2024-08-10 5:10 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2024-08-10 5:10 UTC (permalink / raw)
To: Eric Dumazet; +Cc: davem, kuba, pabeni, netdev, eric.dumazet, pablo, laforge
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 8 Aug 2024 13:24:55 +0000 you wrote:
> syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1]
>
> We must make sure the IPv4 or Ipv6 header is pulled in skb->head
> before accessing fields in them.
>
> Use pskb_inet_may_pull() to fix this issue.
>
> [...]
Here is the summary with links:
- [net] gtp: pull network headers in gtp_dev_xmit()
https://git.kernel.org/netdev/net/c/3a3be7ff9224
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-08-10 5:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-08 13:24 [PATCH net] gtp: pull network headers in gtp_dev_xmit() Eric Dumazet
2024-08-09 7:59 ` Pablo Neira Ayuso
2024-08-10 5:10 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).