| Message ID | 20230803152653.29535-2-fw@strlen.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 6a7ac3d20593865209dceb554d8b3f094c6bd940 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | tunnels: fix ipv4 pmtu icmp checksum | expand |
On Thu, Aug 03, 2023 at 05:26:49PM +0200, Florian Westphal wrote: > If we try to emit an icmp error in response to a nonliner skb, we get > > BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 > Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 > CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 > [..] > kasan_report+0x105/0x140 > ip_compute_csum+0x134/0x220 > iptunnel_pmtud_build_icmp+0x554/0x1020 > skb_tunnel_check_pmtu+0x513/0xb80 > vxlan_xmit_one+0x139e/0x2ef0 > vxlan_xmit+0x1867/0x2760 > dev_hard_start_xmit+0x1ee/0x4f0 > br_dev_queue_push_xmit+0x4d1/0x660 > [..] > > ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. > After this change, splat is gone and iperf3 is no longer stuck. Hi Florian, I wonder if there are other cases lurking elsewhere. Did you happen to take a look at that? > Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") > Signed-off-by: Florian Westphal <fw@strlen.de> > --- > net/ipv4/ip_tunnel_core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c > index 92c02c886fe7..586b1b3e35b8 100644 > --- a/net/ipv4/ip_tunnel_core.c > +++ b/net/ipv4/ip_tunnel_core.c > @@ -224,7 +224,7 @@ static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu) > .un.frag.__unused = 0, > .un.frag.mtu = htons(mtu), > }; > - icmph->checksum = ip_compute_csum(icmph, len); > + icmph->checksum = csum_fold(skb_checksum(skb, 0, len, 0)); > skb_reset_transport_header(skb); > > niph = skb_push(skb, sizeof(*niph)); > -- > 2.41.0 > >
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c index 92c02c886fe7..586b1b3e35b8 100644 --- a/net/ipv4/ip_tunnel_core.c +++ b/net/ipv4/ip_tunnel_core.c @@ -224,7 +224,7 @@ static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu) .un.frag.__unused = 0, .un.frag.mtu = htons(mtu), }; - icmph->checksum = ip_compute_csum(icmph, len); + icmph->checksum = csum_fold(skb_checksum(skb, 0, len, 0)); skb_reset_transport_header(skb); niph = skb_push(skb, sizeof(*niph));
If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..] ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck. Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Signed-off-by: Florian Westphal <fw@strlen.de> --- net/ipv4/ip_tunnel_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)