stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 5.15.y 0/2] Backport fix for CVE-2024-38538
@ 2024-10-04 17:03 Sherry Yang
  2024-10-04 17:03 ` [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper Sherry Yang
  2024-10-04 17:03 ` [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes Sherry Yang
  0 siblings, 2 replies; 6+ messages in thread
From: Sherry Yang @ 2024-10-04 17:03 UTC (permalink / raw)
  To: stable
  Cc: sashal, kuba, gregkh, roopa, nikolay, davem, bridge, netdev,
	sherry.yang

The 2nd patch fixes CVE-2024-38538, but it requires the helper function
pskb_may_pull_reason which is defined in the 1st patch. Backport both
together.


Eric Dumazet (1):
  net: add pskb_may_pull_reason() helper

Nikolay Aleksandrov (1):
  net: bridge: xmit: make sure we have at least eth header len bytes

 include/linux/skbuff.h | 19 +++++++++++++++----
 net/bridge/br_device.c |  6 ++++++
 2 files changed, 21 insertions(+), 4 deletions(-)

-- 
2.46.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper
  2024-10-04 17:03 [PATCH 5.15.y 0/2] Backport fix for CVE-2024-38538 Sherry Yang
@ 2024-10-04 17:03 ` Sherry Yang
  2024-10-08 10:36   ` Greg KH
  2024-10-04 17:03 ` [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes Sherry Yang
  1 sibling, 1 reply; 6+ messages in thread
From: Sherry Yang @ 2024-10-04 17:03 UTC (permalink / raw)
  To: stable
  Cc: sashal, kuba, gregkh, roopa, nikolay, davem, bridge, netdev,
	sherry.yang

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 1fb2d41501f38192d8a19da585cd441cf8845697 ]

pskb_may_pull() can fail for two different reasons.

Provide pskb_may_pull_reason() helper to distinguish
between these reasons.

It returns:

SKB_NOT_DROPPED_YET           : Success
SKB_DROP_REASON_PKT_TOO_SMALL : packet too small
SKB_DROP_REASON_NOMEM         : skb->head could not be resized

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[Sherry: bp to 5.15.y. Minor conflicts due to missing commit
d427c8999b07 ("net-next: skbuff: refactor pskb_pull") which is not
necessary in 5.15.y. Ignore context change.
Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
---
 include/linux/skbuff.h | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index b230c422dc3b..f92e8fe4f5eb 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2465,13 +2465,24 @@ static inline void *pskb_pull(struct sk_buff *skb, unsigned int len)
 	return unlikely(len > skb->len) ? NULL : __pskb_pull(skb, len);
 }
 
-static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len)
+static inline enum skb_drop_reason
+pskb_may_pull_reason(struct sk_buff *skb, unsigned int len)
 {
 	if (likely(len <= skb_headlen(skb)))
-		return true;
+		return SKB_NOT_DROPPED_YET;
+
 	if (unlikely(len > skb->len))
-		return false;
-	return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL;
+		return SKB_DROP_REASON_PKT_TOO_SMALL;
+
+	if (unlikely(!__pskb_pull_tail(skb, len - skb_headlen(skb))))
+		return SKB_DROP_REASON_NOMEM;
+
+	return SKB_NOT_DROPPED_YET;
+}
+
+static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len)
+{
+	return pskb_may_pull_reason(skb, len) == SKB_NOT_DROPPED_YET;
 }
 
 void skb_condense(struct sk_buff *skb);
-- 
2.46.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread

* [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes
  2024-10-04 17:03 [PATCH 5.15.y 0/2] Backport fix for CVE-2024-38538 Sherry Yang
  2024-10-04 17:03 ` [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper Sherry Yang
@ 2024-10-04 17:03 ` Sherry Yang
  2024-10-29 21:14   ` [PATCH 5.15.y] " Randy.MacLeod
  1 sibling, 1 reply; 6+ messages in thread
From: Sherry Yang @ 2024-10-04 17:03 UTC (permalink / raw)
  To: stable
  Cc: sashal, kuba, gregkh, roopa, nikolay, davem, bridge, netdev,
	sherry.yang

From: Nikolay Aleksandrov <razor@blackwall.org>

[ Upstream commit 8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc ]

syzbot triggered an uninit value[1] error in bridge device's xmit path
by sending a short (less than ETH_HLEN bytes) skb. To fix it check if
we can actually pull that amount instead of assuming.

Tested with dropwatch:
 drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3)
 origin: software
 timestamp: Mon May 13 11:31:53 2024 778214037 nsec
 protocol: 0x88a8
 length: 2
 original length: 2
 drop reason: PKT_TOO_SMALL

[1]
BUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65
 br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65
 __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
 netdev_start_xmit include/linux/netdevice.h:4917 [inline]
 xmit_one net/core/dev.c:3531 [inline]
 dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547
 __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341
 dev_queue_xmit include/linux/netdevice.h:3091 [inline]
 __bpf_tx_skb net/core/filter.c:2136 [inline]
 __bpf_redirect_common net/core/filter.c:2180 [inline]
 __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187
 ____bpf_clone_redirect net/core/filter.c:2460 [inline]
 bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432
 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997
 __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425
 bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058
 bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269
 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678
 __do_sys_bpf kernel/bpf/syscall.c:5767 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5765 [inline]
 __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765
 x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[Sherry: bp to 5.15.y. This is to fix CVE-2024-38538]
Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
---
 net/bridge/br_device.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 8d6bab244c4a..89ca2169ea43 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -27,6 +27,7 @@ EXPORT_SYMBOL_GPL(nf_br_ops);
 /* net device transmit always called with BH disabled */
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
+	enum skb_drop_reason reason = pskb_may_pull_reason(skb, ETH_HLEN);
 	struct net_bridge_mcast_port *pmctx_null = NULL;
 	struct net_bridge *br = netdev_priv(dev);
 	struct net_bridge_mcast *brmctx = &br->multicast_ctx;
@@ -38,6 +39,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 	const unsigned char *dest;
 	u16 vid = 0;
 
+	if (unlikely(reason != SKB_NOT_DROPPED_YET)) {
+		kfree_skb_reason(skb, reason);
+		return NETDEV_TX_OK;
+	}
+
 	memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
 
 	rcu_read_lock();
-- 
2.46.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper
  2024-10-04 17:03 ` [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper Sherry Yang
@ 2024-10-08 10:36   ` Greg KH
  2024-10-08 17:11     ` Sherry Yang
  0 siblings, 1 reply; 6+ messages in thread
From: Greg KH @ 2024-10-08 10:36 UTC (permalink / raw)
  To: Sherry Yang; +Cc: stable, sashal, kuba, roopa, nikolay, davem, bridge, netdev

On Fri, Oct 04, 2024 at 10:03:27AM -0700, Sherry Yang wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> [ Upstream commit 1fb2d41501f38192d8a19da585cd441cf8845697 ]
> 
> pskb_may_pull() can fail for two different reasons.
> 
> Provide pskb_may_pull_reason() helper to distinguish
> between these reasons.
> 
> It returns:
> 
> SKB_NOT_DROPPED_YET           : Success
> SKB_DROP_REASON_PKT_TOO_SMALL : packet too small
> SKB_DROP_REASON_NOMEM         : skb->head could not be resized
> 
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reviewed-by: David Ahern <dsahern@kernel.org>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> Stable-dep-of: 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes")
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> [Sherry: bp to 5.15.y. Minor conflicts due to missing commit
> d427c8999b07 ("net-next: skbuff: refactor pskb_pull") which is not
> necessary in 5.15.y. Ignore context change.
> Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
> ---
>  include/linux/skbuff.h | 19 +++++++++++++++----
>  1 file changed, 15 insertions(+), 4 deletions(-)
> 
> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
> index b230c422dc3b..f92e8fe4f5eb 100644
> --- a/include/linux/skbuff.h
> +++ b/include/linux/skbuff.h
> @@ -2465,13 +2465,24 @@ static inline void *pskb_pull(struct sk_buff *skb, unsigned int len)
>  	return unlikely(len > skb->len) ? NULL : __pskb_pull(skb, len);
>  }
>  
> -static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len)
> +static inline enum skb_drop_reason
> +pskb_may_pull_reason(struct sk_buff *skb, unsigned int len)
>  {
>  	if (likely(len <= skb_headlen(skb)))
> -		return true;
> +		return SKB_NOT_DROPPED_YET;
> +
>  	if (unlikely(len > skb->len))
> -		return false;
> -	return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL;
> +		return SKB_DROP_REASON_PKT_TOO_SMALL;
> +
> +	if (unlikely(!__pskb_pull_tail(skb, len - skb_headlen(skb))))
> +		return SKB_DROP_REASON_NOMEM;
> +
> +	return SKB_NOT_DROPPED_YET;
> +}
> +
> +static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len)
> +{
> +	return pskb_may_pull_reason(skb, len) == SKB_NOT_DROPPED_YET;
>  }
>  
>  void skb_condense(struct sk_buff *skb);
> -- 
> 2.46.0
> 
> 

Any specific reason why you didn't test build this patch?

It breaks the build into thousands of tiny pieces.

greg k-h

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper
  2024-10-08 10:36   ` Greg KH
@ 2024-10-08 17:11     ` Sherry Yang
  0 siblings, 0 replies; 6+ messages in thread
From: Sherry Yang @ 2024-10-08 17:11 UTC (permalink / raw)
  To: Greg KH
  Cc: linux-stable, sashal@kernel.org, kuba@kernel.org,
	roopa@nvidia.com, nikolay@nvidia.com, davem@davemloft.net,
	bridge@lists.linux-foundation.org, netdev@vger.kernel.org

Hi Greg,

> On Oct 8, 2024, at 3:36 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> 
> On Fri, Oct 04, 2024 at 10:03:27AM -0700, Sherry Yang wrote:
>> From: Eric Dumazet <edumazet@google.com>
>> 
>> [ Upstream commit 1fb2d41501f38192d8a19da585cd441cf8845697 ]
>> 
>> pskb_may_pull() can fail for two different reasons.
>> 
>> Provide pskb_may_pull_reason() helper to distinguish
>> between these reasons.
>> 
>> It returns:
>> 
>> SKB_NOT_DROPPED_YET           : Success
>> SKB_DROP_REASON_PKT_TOO_SMALL : packet too small
>> SKB_DROP_REASON_NOMEM         : skb->head could not be resized
>> 
>> Signed-off-by: Eric Dumazet <edumazet@google.com>
>> Reviewed-by: David Ahern <dsahern@kernel.org>
>> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>> Stable-dep-of: 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes")
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> [Sherry: bp to 5.15.y. Minor conflicts due to missing commit
>> d427c8999b07 ("net-next: skbuff: refactor pskb_pull") which is not
>> necessary in 5.15.y. Ignore context change.
>> Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
>> ---
>> include/linux/skbuff.h | 19 +++++++++++++++----
>> 1 file changed, 15 insertions(+), 4 deletions(-)
>> 
>> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
>> index b230c422dc3b..f92e8fe4f5eb 100644
>> --- a/include/linux/skbuff.h
>> +++ b/include/linux/skbuff.h
>> @@ -2465,13 +2465,24 @@ static inline void *pskb_pull(struct sk_buff *skb, unsigned int len)
>> return unlikely(len > skb->len) ? NULL : __pskb_pull(skb, len);
>> }
>> 
>> -static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len)
>> +static inline enum skb_drop_reason
>> +pskb_may_pull_reason(struct sk_buff *skb, unsigned int len)
>> {
>> if (likely(len <= skb_headlen(skb)))
>> - return true;
>> + return SKB_NOT_DROPPED_YET;
>> +
>> if (unlikely(len > skb->len))
>> - return false;
>> - return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL;
>> + return SKB_DROP_REASON_PKT_TOO_SMALL;
>> +
>> + if (unlikely(!__pskb_pull_tail(skb, len - skb_headlen(skb))))
>> + return SKB_DROP_REASON_NOMEM;
>> +
>> + return SKB_NOT_DROPPED_YET;
>> +}
>> +
>> +static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len)
>> +{
>> + return pskb_may_pull_reason(skb, len) == SKB_NOT_DROPPED_YET;
>> }
>> 
>> void skb_condense(struct sk_buff *skb);
>> -- 
>> 2.46.0
>> 
>> 
> 
> Any specific reason why you didn't test build this patch?
> 
> It breaks the build into thousands of tiny pieces.

Sorry about the build failure. We have a branch which was forked from 5.15.y, and I did build and some smoke tests there. The build and smoke tests passed on our branch. However, I didn’t notice our branch backported prerequisite commits which made it diverge from linux-stable 5.15.y. I will apply the patch to upstream/linux-stable and build there before I send patch to upstream/linux-stable next time.

Sorry about the inconvenience.

Sherry
> 
> greg k-h


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH 5.15.y] net: bridge: xmit: make sure we have at least eth header len bytes
  2024-10-04 17:03 ` [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes Sherry Yang
@ 2024-10-29 21:14   ` Randy.MacLeod
  0 siblings, 0 replies; 6+ messages in thread
From: Randy.MacLeod @ 2024-10-29 21:14 UTC (permalink / raw)
  To: sherry.yang
  Cc: bridge, davem, gregkh, kuba, netdev, nikolay, roopa, sashal,
	stable, randy.macleod

From: Randy MacLeod <Randy.MacLeod@windriver.com>

[ Upstream commit 8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc ]

Based on above commit but simplified since pskb_may_pull_reason()
does not exist until 6.1.

syzbot triggered an uninit value[1] error in bridge device's xmit path
by sending a short (less than ETH_HLEN bytes) skb. To fix it check if
we can actually pull that amount instead of assuming.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
---
 net/bridge/br_device.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 8d6bab244c4a..b2fa4ca28102 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -38,6 +38,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 	const unsigned char *dest;
 	u16 vid = 0;
 
+	if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) {
+		kfree_skb(skb);
+		return NETDEV_TX_OK;
+	}
+
 	memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
 
 	rcu_read_lock();
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2024-10-29 21:14 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-04 17:03 [PATCH 5.15.y 0/2] Backport fix for CVE-2024-38538 Sherry Yang
2024-10-04 17:03 ` [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper Sherry Yang
2024-10-08 10:36   ` Greg KH
2024-10-08 17:11     ` Sherry Yang
2024-10-04 17:03 ` [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes Sherry Yang
2024-10-29 21:14   ` [PATCH 5.15.y] " Randy.MacLeod

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).