* [PATCH 5.15.y 0/2] Backport fix for CVE-2024-38538 @ 2024-10-04 17:03 Sherry Yang 2024-10-04 17:03 ` [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper Sherry Yang 2024-10-04 17:03 ` [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes Sherry Yang 0 siblings, 2 replies; 6+ messages in thread From: Sherry Yang @ 2024-10-04 17:03 UTC (permalink / raw) To: stable Cc: sashal, kuba, gregkh, roopa, nikolay, davem, bridge, netdev, sherry.yang The 2nd patch fixes CVE-2024-38538, but it requires the helper function pskb_may_pull_reason which is defined in the 1st patch. Backport both together. Eric Dumazet (1): net: add pskb_may_pull_reason() helper Nikolay Aleksandrov (1): net: bridge: xmit: make sure we have at least eth header len bytes include/linux/skbuff.h | 19 +++++++++++++++---- net/bridge/br_device.c | 6 ++++++ 2 files changed, 21 insertions(+), 4 deletions(-) -- 2.46.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper 2024-10-04 17:03 [PATCH 5.15.y 0/2] Backport fix for CVE-2024-38538 Sherry Yang @ 2024-10-04 17:03 ` Sherry Yang 2024-10-08 10:36 ` Greg KH 2024-10-04 17:03 ` [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes Sherry Yang 1 sibling, 1 reply; 6+ messages in thread From: Sherry Yang @ 2024-10-04 17:03 UTC (permalink / raw) To: stable Cc: sashal, kuba, gregkh, roopa, nikolay, davem, bridge, netdev, sherry.yang From: Eric Dumazet <edumazet@google.com> [ Upstream commit 1fb2d41501f38192d8a19da585cd441cf8845697 ] pskb_may_pull() can fail for two different reasons. Provide pskb_may_pull_reason() helper to distinguish between these reasons. It returns: SKB_NOT_DROPPED_YET : Success SKB_DROP_REASON_PKT_TOO_SMALL : packet too small SKB_DROP_REASON_NOMEM : skb->head could not be resized Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: David Ahern <dsahern@kernel.org> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Stable-dep-of: 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes") Signed-off-by: Sasha Levin <sashal@kernel.org> [Sherry: bp to 5.15.y. Minor conflicts due to missing commit d427c8999b07 ("net-next: skbuff: refactor pskb_pull") which is not necessary in 5.15.y. Ignore context change. Signed-off-by: Sherry Yang <sherry.yang@oracle.com> --- include/linux/skbuff.h | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index b230c422dc3b..f92e8fe4f5eb 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2465,13 +2465,24 @@ static inline void *pskb_pull(struct sk_buff *skb, unsigned int len) return unlikely(len > skb->len) ? NULL : __pskb_pull(skb, len); } -static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) +static inline enum skb_drop_reason +pskb_may_pull_reason(struct sk_buff *skb, unsigned int len) { if (likely(len <= skb_headlen(skb))) - return true; + return SKB_NOT_DROPPED_YET; + if (unlikely(len > skb->len)) - return false; - return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL; + return SKB_DROP_REASON_PKT_TOO_SMALL; + + if (unlikely(!__pskb_pull_tail(skb, len - skb_headlen(skb)))) + return SKB_DROP_REASON_NOMEM; + + return SKB_NOT_DROPPED_YET; +} + +static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) +{ + return pskb_may_pull_reason(skb, len) == SKB_NOT_DROPPED_YET; } void skb_condense(struct sk_buff *skb); -- 2.46.0 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper 2024-10-04 17:03 ` [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper Sherry Yang @ 2024-10-08 10:36 ` Greg KH 2024-10-08 17:11 ` Sherry Yang 0 siblings, 1 reply; 6+ messages in thread From: Greg KH @ 2024-10-08 10:36 UTC (permalink / raw) To: Sherry Yang; +Cc: stable, sashal, kuba, roopa, nikolay, davem, bridge, netdev On Fri, Oct 04, 2024 at 10:03:27AM -0700, Sherry Yang wrote: > From: Eric Dumazet <edumazet@google.com> > > [ Upstream commit 1fb2d41501f38192d8a19da585cd441cf8845697 ] > > pskb_may_pull() can fail for two different reasons. > > Provide pskb_may_pull_reason() helper to distinguish > between these reasons. > > It returns: > > SKB_NOT_DROPPED_YET : Success > SKB_DROP_REASON_PKT_TOO_SMALL : packet too small > SKB_DROP_REASON_NOMEM : skb->head could not be resized > > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reviewed-by: David Ahern <dsahern@kernel.org> > Signed-off-by: Jakub Kicinski <kuba@kernel.org> > Stable-dep-of: 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes") > Signed-off-by: Sasha Levin <sashal@kernel.org> > [Sherry: bp to 5.15.y. Minor conflicts due to missing commit > d427c8999b07 ("net-next: skbuff: refactor pskb_pull") which is not > necessary in 5.15.y. Ignore context change. > Signed-off-by: Sherry Yang <sherry.yang@oracle.com> > --- > include/linux/skbuff.h | 19 +++++++++++++++---- > 1 file changed, 15 insertions(+), 4 deletions(-) > > diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h > index b230c422dc3b..f92e8fe4f5eb 100644 > --- a/include/linux/skbuff.h > +++ b/include/linux/skbuff.h > @@ -2465,13 +2465,24 @@ static inline void *pskb_pull(struct sk_buff *skb, unsigned int len) > return unlikely(len > skb->len) ? NULL : __pskb_pull(skb, len); > } > > -static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) > +static inline enum skb_drop_reason > +pskb_may_pull_reason(struct sk_buff *skb, unsigned int len) > { > if (likely(len <= skb_headlen(skb))) > - return true; > + return SKB_NOT_DROPPED_YET; > + > if (unlikely(len > skb->len)) > - return false; > - return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL; > + return SKB_DROP_REASON_PKT_TOO_SMALL; > + > + if (unlikely(!__pskb_pull_tail(skb, len - skb_headlen(skb)))) > + return SKB_DROP_REASON_NOMEM; > + > + return SKB_NOT_DROPPED_YET; > +} > + > +static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) > +{ > + return pskb_may_pull_reason(skb, len) == SKB_NOT_DROPPED_YET; > } > > void skb_condense(struct sk_buff *skb); > -- > 2.46.0 > > Any specific reason why you didn't test build this patch? It breaks the build into thousands of tiny pieces. greg k-h ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper 2024-10-08 10:36 ` Greg KH @ 2024-10-08 17:11 ` Sherry Yang 0 siblings, 0 replies; 6+ messages in thread From: Sherry Yang @ 2024-10-08 17:11 UTC (permalink / raw) To: Greg KH Cc: linux-stable, sashal@kernel.org, kuba@kernel.org, roopa@nvidia.com, nikolay@nvidia.com, davem@davemloft.net, bridge@lists.linux-foundation.org, netdev@vger.kernel.org Hi Greg, > On Oct 8, 2024, at 3:36 AM, Greg KH <gregkh@linuxfoundation.org> wrote: > > On Fri, Oct 04, 2024 at 10:03:27AM -0700, Sherry Yang wrote: >> From: Eric Dumazet <edumazet@google.com> >> >> [ Upstream commit 1fb2d41501f38192d8a19da585cd441cf8845697 ] >> >> pskb_may_pull() can fail for two different reasons. >> >> Provide pskb_may_pull_reason() helper to distinguish >> between these reasons. >> >> It returns: >> >> SKB_NOT_DROPPED_YET : Success >> SKB_DROP_REASON_PKT_TOO_SMALL : packet too small >> SKB_DROP_REASON_NOMEM : skb->head could not be resized >> >> Signed-off-by: Eric Dumazet <edumazet@google.com> >> Reviewed-by: David Ahern <dsahern@kernel.org> >> Signed-off-by: Jakub Kicinski <kuba@kernel.org> >> Stable-dep-of: 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes") >> Signed-off-by: Sasha Levin <sashal@kernel.org> >> [Sherry: bp to 5.15.y. Minor conflicts due to missing commit >> d427c8999b07 ("net-next: skbuff: refactor pskb_pull") which is not >> necessary in 5.15.y. Ignore context change. >> Signed-off-by: Sherry Yang <sherry.yang@oracle.com> >> --- >> include/linux/skbuff.h | 19 +++++++++++++++---- >> 1 file changed, 15 insertions(+), 4 deletions(-) >> >> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h >> index b230c422dc3b..f92e8fe4f5eb 100644 >> --- a/include/linux/skbuff.h >> +++ b/include/linux/skbuff.h >> @@ -2465,13 +2465,24 @@ static inline void *pskb_pull(struct sk_buff *skb, unsigned int len) >> return unlikely(len > skb->len) ? NULL : __pskb_pull(skb, len); >> } >> >> -static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) >> +static inline enum skb_drop_reason >> +pskb_may_pull_reason(struct sk_buff *skb, unsigned int len) >> { >> if (likely(len <= skb_headlen(skb))) >> - return true; >> + return SKB_NOT_DROPPED_YET; >> + >> if (unlikely(len > skb->len)) >> - return false; >> - return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL; >> + return SKB_DROP_REASON_PKT_TOO_SMALL; >> + >> + if (unlikely(!__pskb_pull_tail(skb, len - skb_headlen(skb)))) >> + return SKB_DROP_REASON_NOMEM; >> + >> + return SKB_NOT_DROPPED_YET; >> +} >> + >> +static inline bool pskb_may_pull(struct sk_buff *skb, unsigned int len) >> +{ >> + return pskb_may_pull_reason(skb, len) == SKB_NOT_DROPPED_YET; >> } >> >> void skb_condense(struct sk_buff *skb); >> -- >> 2.46.0 >> >> > > Any specific reason why you didn't test build this patch? > > It breaks the build into thousands of tiny pieces. Sorry about the build failure. We have a branch which was forked from 5.15.y, and I did build and some smoke tests there. The build and smoke tests passed on our branch. However, I didn’t notice our branch backported prerequisite commits which made it diverge from linux-stable 5.15.y. I will apply the patch to upstream/linux-stable and build there before I send patch to upstream/linux-stable next time. Sorry about the inconvenience. Sherry > > greg k-h ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes 2024-10-04 17:03 [PATCH 5.15.y 0/2] Backport fix for CVE-2024-38538 Sherry Yang 2024-10-04 17:03 ` [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper Sherry Yang @ 2024-10-04 17:03 ` Sherry Yang 2024-10-29 21:14 ` [PATCH 5.15.y] " Randy.MacLeod 1 sibling, 1 reply; 6+ messages in thread From: Sherry Yang @ 2024-10-04 17:03 UTC (permalink / raw) To: stable Cc: sashal, kuba, gregkh, roopa, nikolay, davem, bridge, netdev, sherry.yang From: Nikolay Aleksandrov <razor@blackwall.org> [ Upstream commit 8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc ] syzbot triggered an uninit value[1] error in bridge device's xmit path by sending a short (less than ETH_HLEN bytes) skb. To fix it check if we can actually pull that amount instead of assuming. Tested with dropwatch: drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3) origin: software timestamp: Mon May 13 11:31:53 2024 778214037 nsec protocol: 0x88a8 length: 2 original length: 2 drop reason: PKT_TOO_SMALL [1] BUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65 br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341 dev_queue_xmit include/linux/netdevice.h:3091 [inline] __bpf_tx_skb net/core/filter.c:2136 [inline] __bpf_redirect_common net/core/filter.c:2180 [inline] __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187 ____bpf_clone_redirect net/core/filter.c:2460 [inline] bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997 __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline] __bpf_prog_run include/linux/filter.h:657 [inline] bpf_prog_run include/linux/filter.h:664 [inline] bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425 bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058 bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678 __do_sys_bpf kernel/bpf/syscall.c:5767 [inline] __se_sys_bpf kernel/bpf/syscall.c:5765 [inline] __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765 x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40 Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org> [Sherry: bp to 5.15.y. This is to fix CVE-2024-38538] Signed-off-by: Sherry Yang <sherry.yang@oracle.com> --- net/bridge/br_device.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c index 8d6bab244c4a..89ca2169ea43 100644 --- a/net/bridge/br_device.c +++ b/net/bridge/br_device.c @@ -27,6 +27,7 @@ EXPORT_SYMBOL_GPL(nf_br_ops); /* net device transmit always called with BH disabled */ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) { + enum skb_drop_reason reason = pskb_may_pull_reason(skb, ETH_HLEN); struct net_bridge_mcast_port *pmctx_null = NULL; struct net_bridge *br = netdev_priv(dev); struct net_bridge_mcast *brmctx = &br->multicast_ctx; @@ -38,6 +39,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) const unsigned char *dest; u16 vid = 0; + if (unlikely(reason != SKB_NOT_DROPPED_YET)) { + kfree_skb_reason(skb, reason); + return NETDEV_TX_OK; + } + memset(skb->cb, 0, sizeof(struct br_input_skb_cb)); rcu_read_lock(); -- 2.46.0 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 5.15.y] net: bridge: xmit: make sure we have at least eth header len bytes 2024-10-04 17:03 ` [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes Sherry Yang @ 2024-10-29 21:14 ` Randy.MacLeod 0 siblings, 0 replies; 6+ messages in thread From: Randy.MacLeod @ 2024-10-29 21:14 UTC (permalink / raw) To: sherry.yang Cc: bridge, davem, gregkh, kuba, netdev, nikolay, roopa, sashal, stable, randy.macleod From: Randy MacLeod <Randy.MacLeod@windriver.com> [ Upstream commit 8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc ] Based on above commit but simplified since pskb_may_pull_reason() does not exist until 6.1. syzbot triggered an uninit value[1] error in bridge device's xmit path by sending a short (less than ETH_HLEN bytes) skb. To fix it check if we can actually pull that amount instead of assuming. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40 Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> --- net/bridge/br_device.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c index 8d6bab244c4a..b2fa4ca28102 100644 --- a/net/bridge/br_device.c +++ b/net/bridge/br_device.c @@ -38,6 +38,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) const unsigned char *dest; u16 vid = 0; + if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) { + kfree_skb(skb); + return NETDEV_TX_OK; + } + memset(skb->cb, 0, sizeof(struct br_input_skb_cb)); rcu_read_lock(); -- 2.34.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-10-29 21:14 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-10-04 17:03 [PATCH 5.15.y 0/2] Backport fix for CVE-2024-38538 Sherry Yang 2024-10-04 17:03 ` [PATCH 5.15.y 1/2] net: add pskb_may_pull_reason() helper Sherry Yang 2024-10-08 10:36 ` Greg KH 2024-10-08 17:11 ` Sherry Yang 2024-10-04 17:03 ` [PATCH 5.15.y 2/2] net: bridge: xmit: make sure we have at least eth header len bytes Sherry Yang 2024-10-29 21:14 ` [PATCH 5.15.y] " Randy.MacLeod
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).