| Message ID | 20240201083817.12774-1-atenart@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d75abeec401f8c86b470e7028a13fcdc87e5dd06 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] tunnels: fix out of bounds access when building IPv6 PMTU error | expand |
Thu, Feb 01, 2024 at 09:38:15AM CET, atenart@kernel.org wrote: >If the ICMPv6 error is built from a non-linear skb we get the following >splat, > > BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 > Read of size 4 at addr ffff88811d402c80 by task netperf/820 > CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543 > ... > kasan_report+0xd8/0x110 > do_csum+0x220/0x240 > csum_partial+0xc/0x20 > skb_tunnel_check_pmtu+0xeb9/0x3280 > vxlan_xmit_one+0x14c2/0x4080 > vxlan_xmit+0xf61/0x5c00 > dev_hard_start_xmit+0xfb/0x510 > __dev_queue_xmit+0x7cd/0x32a0 > br_dev_queue_push_xmit+0x39d/0x6a0 > >Use skb_checksum instead of csum_partial who cannot deal with non-linear >SKBs. > >Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") >Signed-off-by: Antoine Tenart <atenart@kernel.org> Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Hello: This patch was applied to netdev/net.git (main) by David S. Miller <davem@davemloft.net>: On Thu, 1 Feb 2024 09:38:15 +0100 you wrote: > If the ICMPv6 error is built from a non-linear skb we get the following > splat, > > BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 > Read of size 4 at addr ffff88811d402c80 by task netperf/820 > CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543 > ... > kasan_report+0xd8/0x110 > do_csum+0x220/0x240 > csum_partial+0xc/0x20 > skb_tunnel_check_pmtu+0xeb9/0x3280 > vxlan_xmit_one+0x14c2/0x4080 > vxlan_xmit+0xf61/0x5c00 > dev_hard_start_xmit+0xfb/0x510 > __dev_queue_xmit+0x7cd/0x32a0 > br_dev_queue_push_xmit+0x39d/0x6a0 > > [...] Here is the summary with links: - [net] tunnels: fix out of bounds access when building IPv6 PMTU error https://git.kernel.org/netdev/net/c/d75abeec401f You are awesome, thank you!
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c index 586b1b3e35b8..80ccd6661aa3 100644 --- a/net/ipv4/ip_tunnel_core.c +++ b/net/ipv4/ip_tunnel_core.c @@ -332,7 +332,7 @@ static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu) }; skb_reset_network_header(skb); - csum = csum_partial(icmp6h, len, 0); + csum = skb_checksum(skb, skb_transport_offset(skb), len, 0); icmp6h->icmp6_cksum = csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr, len, IPPROTO_ICMPV6, csum);
If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 Read of size 4 at addr ffff88811d402c80 by task netperf/820 CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543 ... kasan_report+0xd8/0x110 do_csum+0x220/0x240 csum_partial+0xc/0x20 skb_tunnel_check_pmtu+0xeb9/0x3280 vxlan_xmit_one+0x14c2/0x4080 vxlan_xmit+0xf61/0x5c00 dev_hard_start_xmit+0xfb/0x510 __dev_queue_xmit+0x7cd/0x32a0 br_dev_queue_push_xmit+0x39d/0x6a0 Use skb_checksum instead of csum_partial who cannot deal with non-linear SKBs. Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Signed-off-by: Antoine Tenart <atenart@kernel.org> --- net/ipv4/ip_tunnel_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)