| Message ID | 20220330194643.2706132-1-eric.dumazet@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 9d570741aec1e1ebd37823b34a2958f24809ff24 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] vxlan: do not feed vxlan_vnifilter_dump_dev with non vxlan devices | expand |
On 3/30/22 12:46, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google.com> > > vxlan_vnifilter_dump_dev() assumes it is called only > for vxlan devices. Make sure it is the case. > > BUG: KASAN: slab-out-of-bounds in vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349 > Read of size 4 at addr ffff888060d1ce70 by task syz-executor.3/17662 > > CPU: 0 PID: 17662 Comm: syz-executor.3 Tainted: G W 5.17.0-syzkaller-12888-g77c9387c0c5b #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 > print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 > print_report mm/kasan/report.c:429 [inline] > kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 > vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349 > vxlan_vnifilter_dump+0x3ff/0x650 drivers/net/vxlan/vxlan_vnifilter.c:428 > netlink_dump+0x4b5/0xb70 net/netlink/af_netlink.c:2270 > __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2375 > netlink_dump_start include/linux/netlink.h:245 [inline] > rtnetlink_rcv_msg+0x70c/0xb80 net/core/rtnetlink.c:5953 > netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496 > netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] > netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 > netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1921 > sock_sendmsg_nosec net/socket.c:705 [inline] > sock_sendmsg+0xcf/0x120 net/socket.c:725 > ____sys_sendmsg+0x6e2/0x800 net/socket.c:2413 > ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 > __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x44/0xae > RIP: 0033:0x7f87b8e89049 > > Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Cc: Roopa Prabhu <roopa@nvidia.com> > Reported-by: syzbot <syzkaller@googlegroups.com> Acked-by: Roopa Prabhu <roopa@nvidia.com> I thought i had a check there. thanks for the patch eric!.
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Wed, 30 Mar 2022 12:46:43 -0700 you wrote: > From: Eric Dumazet <edumazet@google.com> > > vxlan_vnifilter_dump_dev() assumes it is called only > for vxlan devices. Make sure it is the case. > > BUG: KASAN: slab-out-of-bounds in vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349 > Read of size 4 at addr ffff888060d1ce70 by task syz-executor.3/17662 > > [...] Here is the summary with links: - [net] vxlan: do not feed vxlan_vnifilter_dump_dev with non vxlan devices https://git.kernel.org/netdev/net/c/9d570741aec1 You are awesome, thank you!
diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c index 9f28d0b6a6b26690fec5379956d75b988ea07a36..3e04af4c5daa10f5bebf68f7b33876fe9b09fea9 100644 --- a/drivers/net/vxlan/vxlan_vnifilter.c +++ b/drivers/net/vxlan/vxlan_vnifilter.c @@ -425,6 +425,12 @@ static int vxlan_vnifilter_dump(struct sk_buff *skb, struct netlink_callback *cb err = -ENODEV; goto out_err; } + if (!netif_is_vxlan(dev)) { + NL_SET_ERR_MSG(cb->extack, + "The device is not a vxlan device"); + err = -EINVAL; + goto out_err; + } err = vxlan_vnifilter_dump_dev(dev, skb, cb); /* if the dump completed without an error we return 0 here */ if (err != -EMSGSIZE)