| Message ID | 8f91703995c8de638695e330c06d17ecec8c9135.1632369904.git.lucien.xin@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | f7e745f8e94492a8ac0b0a26e25f2b19d342918f |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | warning | 2 maintainers not CCed: vyasevich@gmail.com nhorman@tuxdriver.com |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 3 this patch: 3 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 8 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 3 this patch: 3 |
| netdev/header_inline | success | Link |
On Thu, Sep 23, 2021 at 12:05:04AM -0400, Xin Long wrote: > We should always check if skb_header_pointer's return is NULL before > using it, otherwise it may cause null-ptr-deref, as syzbot reported: > > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] > RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline] > RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196 > Call Trace: > <IRQ> > sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109 > ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422 > ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463 > NF_HOOK include/linux/netfilter.h:307 [inline] > NF_HOOK include/linux/netfilter.h:301 [inline] > ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472 > dst_input include/net/dst.h:460 [inline] > ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] > NF_HOOK include/linux/netfilter.h:307 [inline] > NF_HOOK include/linux/netfilter.h:301 [inline] > ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297 > > Fixes: 3acb50c18d8d ("sctp: delay as much as possible skb_linearize") > Reported-by: syzbot+581aff2ae6b860625116@syzkaller.appspotmail.com > Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Thu, 23 Sep 2021 00:05:04 -0400 you wrote: > We should always check if skb_header_pointer's return is NULL before > using it, otherwise it may cause null-ptr-deref, as syzbot reported: > > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] > RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline] > RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196 > Call Trace: > <IRQ> > sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109 > ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422 > ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463 > NF_HOOK include/linux/netfilter.h:307 [inline] > NF_HOOK include/linux/netfilter.h:301 [inline] > ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472 > dst_input include/net/dst.h:460 [inline] > ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] > NF_HOOK include/linux/netfilter.h:307 [inline] > NF_HOOK include/linux/netfilter.h:301 [inline] > ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297 > > [...] Here is the summary with links: - [net] sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb https://git.kernel.org/netdev/net/c/f7e745f8e944 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/sctp/input.c b/net/sctp/input.c index 5ef86fdb1176..1f1786021d9c 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -702,7 +702,7 @@ static int sctp_rcv_ootb(struct sk_buff *skb) ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch); /* Break out if chunk length is less then minimal. */ - if (ntohs(ch->length) < sizeof(_ch)) + if (!ch || ntohs(ch->length) < sizeof(_ch)) break; ch_end = offset + SCTP_PAD4(ntohs(ch->length));
We should always check if skb_header_pointer's return is NULL before using it, otherwise it may cause null-ptr-deref, as syzbot reported: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline] RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196 Call Trace: <IRQ> sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109 ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422 ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297 Fixes: 3acb50c18d8d ("sctp: delay as much as possible skb_linearize") Reported-by: syzbot+581aff2ae6b860625116@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> --- net/sctp/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)