[PATCH net] ipv6: gro: avoid truncating transport header offsets

[PATCH net] ipv6: gro: avoid truncating transport header offsets

[Hyunwoo Kim]

skb->transport_header is a 16-bit offset from skb->head, and U16_MAX is
reserved as the unset transport header value. A long IPv6 extension
header chain can make the final offset exceed the field's range.
skb_set_transport_header() then truncates it.

In the UDP reproducer, UDP_GRO is enabled on the receiving socket and
the first packet is held on the GRO list. The truncated offset makes
udp_hdr(p) point to the source MAC address. The first four bytes of the
source MAC address match the UDP source and destination ports, allowing
the second packet in the same flow to pass the port comparison.

gro_receive_network_flush() then derives the first packet's IPv6 header
address from the truncated transport header offset. ipv6_gro_flush()
consequently reads from an address 65,536 bytes before the first packet's
actual IPv6 header. Both UDP and TCP GRO call
gro_receive_network_flush().

KASAN reports:

  BUG: KASAN: use-after-free in udp_gro_receive+0x1f37/0x2680
  Read of size 4 at addr ffff8881065f005e by task swapper/1/0
  ...
  Call Trace:
   <IRQ>
   ...
   udp_gro_receive+0x1f37/0x2680
   udp6_gro_receive+0x23e/0x11d0
   ipv6_gro_receive+0x1200/0x2750
   ...
   dev_gro_receive+0x1a7c/0x2600
   gro_receive_skb+0x271/0x970
   virtnet_receive_done+0x3b5/0x12c0
   receive_buf+0x33a/0x4b40
   ...
   virtnet_poll+0xc69/0x1980
   ...
   __napi_poll+0xa0/0x530
   net_rx_action+0x8ff/0x1280
   ...
   </IRQ>

The out-of-bounds address was in a free page, so KASAN reported a
use-after-free. This classification reflects the state of that page,
not the lifetime of the skb. The invalid read was caused by truncation
of the 16-bit transport header offset.

Use skb_set_transport_header_careful() to validate the final offset
before assigning it. If the offset cannot be represented, the skb is
not held as a new GRO head and is instead delivered through the normal
receive path.

Fixes: 4b0ebbca3e16 ("net: gro: move L3 flush checks to tcp_gro_receive and udp_gro_receive_segment")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
 net/ipv6/ip6_offload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 700f1861d8eb7d..de4bab42359ba9 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -241,7 +241,8 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *ipv6_gro_receive(struct list_head *head,
 		skb_gro_pull(skb, sizeof(*iph));
 	}
 
-	skb_set_transport_header(skb, skb_gro_offset(skb));
+	if (!skb_set_transport_header_careful(skb, skb_gro_offset(skb)))
+		goto out;
 
 	NAPI_GRO_CB(skb)->proto = proto;
 
-- 
2.43.0

Re: [PATCH net] ipv6: gro: avoid truncating transport header offsets

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.