Eric Dumazet
b703414675
net: fix use-after-free in kfree_skb_list
...
syzbot reported nasty use-after-free [1]
Lets remove frag_list field from structs ip_fraglist_iter
and ip6_fraglist_iter. This seens not needed anyway.
[1] :
BUG: KASAN: use-after-free in kfree_skb_list+0x5d/0x60 net/core/skbuff.c:706
Read of size 8 at addr ffff888085a3cbc0 by task syz-executor303/8947
CPU: 0 PID: 8947 Comm: syz-executor303 Not tainted 5.2.0-rc2+ #12
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:188
__kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
kasan_report+0x12/0x20 mm/kasan/common.c:614
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
kfree_skb_list+0x5d/0x60 net/core/skbuff.c:706
ip6_fragment+0x1ef4/0x2680 net/ipv6/ip6_output.c:882
__ip6_finish_output+0x577/0xaa0 net/ipv6/ip6_output.c:144
ip6_finish_output+0x38/0x1f0 net/ipv6/ip6_output.c:156
NF_HOOK_COND include/linux/netfilter.h:294 [inline]
ip6_output+0x235/0x7f0 net/ipv6/ip6_output.c:179
dst_output include/net/dst.h:433 [inline]
ip6_local_out+0xbb/0x1b0 net/ipv6/output_core.c:179
ip6_send_skb+0xbb/0x350 net/ipv6/ip6_output.c:1796
ip6_push_pending_frames+0xc8/0xf0 net/ipv6/ip6_output.c:1816
rawv6_push_pending_frames net/ipv6/raw.c:617 [inline]
rawv6_sendmsg+0x2993/0x35e0 net/ipv6/raw.c:947
inet_sendmsg+0x141/0x5d0 net/ipv4/af_inet.c:802
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:671
___sys_sendmsg+0x803/0x920 net/socket.c:2292
__sys_sendmsg+0x105/0x1d0 net/socket.c:2330
__do_sys_sendmsg net/socket.c:2339 [inline]
__se_sys_sendmsg net/socket.c:2337 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337
do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x44add9
Code: e8 7c e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 05 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f826f33bce8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006e7a18 RCX: 000000000044add9
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005
RBP: 00000000006e7a10 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006e7a1c
R13: 00007ffcec4f7ebf R14: 00007f826f33c9c0 R15: 20c49ba5e353f7cf
Allocated by task 8947:
save_stack+0x23/0x90 mm/kasan/common.c:71
set_track mm/kasan/common.c:79 [inline]
__kasan_kmalloc mm/kasan/common.c:489 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462
kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:497
slab_post_alloc_hook mm/slab.h:437 [inline]
slab_alloc_node mm/slab.c:3269 [inline]
kmem_cache_alloc_node+0x131/0x710 mm/slab.c:3579
__alloc_skb+0xd5/0x5e0 net/core/skbuff.c:199
alloc_skb include/linux/skbuff.h:1058 [inline]
__ip6_append_data.isra.0+0x2a24/0x3640 net/ipv6/ip6_output.c:1519
ip6_append_data+0x1e5/0x320 net/ipv6/ip6_output.c:1688
rawv6_sendmsg+0x1467/0x35e0 net/ipv6/raw.c:940
inet_sendmsg+0x141/0x5d0 net/ipv4/af_inet.c:802
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:671
___sys_sendmsg+0x803/0x920 net/socket.c:2292
__sys_sendmsg+0x105/0x1d0 net/socket.c:2330
__do_sys_sendmsg net/socket.c:2339 [inline]
__se_sys_sendmsg net/socket.c:2337 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337
do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 8947:
save_stack+0x23/0x90 mm/kasan/common.c:71
set_track mm/kasan/common.c:79 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:451
kasan_slab_free+0xe/0x10 mm/kasan/common.c:459
__cache_free mm/slab.c:3432 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3698
kfree_skbmem net/core/skbuff.c:625 [inline]
kfree_skbmem+0xc5/0x150 net/core/skbuff.c:619
__kfree_skb net/core/skbuff.c:682 [inline]
kfree_skb net/core/skbuff.c:699 [inline]
kfree_skb+0xf0/0x390 net/core/skbuff.c:693
kfree_skb_list+0x44/0x60 net/core/skbuff.c:708
__dev_xmit_skb net/core/dev.c:3551 [inline]
__dev_queue_xmit+0x3034/0x36b0 net/core/dev.c:3850
dev_queue_xmit+0x18/0x20 net/core/dev.c:3914
neigh_direct_output+0x16/0x20 net/core/neighbour.c:1532
neigh_output include/net/neighbour.h:511 [inline]
ip6_finish_output2+0x1034/0x2550 net/ipv6/ip6_output.c:120
ip6_fragment+0x1ebb/0x2680 net/ipv6/ip6_output.c:863
__ip6_finish_output+0x577/0xaa0 net/ipv6/ip6_output.c:144
ip6_finish_output+0x38/0x1f0 net/ipv6/ip6_output.c:156
NF_HOOK_COND include/linux/netfilter.h:294 [inline]
ip6_output+0x235/0x7f0 net/ipv6/ip6_output.c:179
dst_output include/net/dst.h:433 [inline]
ip6_local_out+0xbb/0x1b0 net/ipv6/output_core.c:179
ip6_send_skb+0xbb/0x350 net/ipv6/ip6_output.c:1796
ip6_push_pending_frames+0xc8/0xf0 net/ipv6/ip6_output.c:1816
rawv6_push_pending_frames net/ipv6/raw.c:617 [inline]
rawv6_sendmsg+0x2993/0x35e0 net/ipv6/raw.c:947
inet_sendmsg+0x141/0x5d0 net/ipv4/af_inet.c:802
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:671
___sys_sendmsg+0x803/0x920 net/socket.c:2292
__sys_sendmsg+0x105/0x1d0 net/socket.c:2330
__do_sys_sendmsg net/socket.c:2339 [inline]
__se_sys_sendmsg net/socket.c:2337 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2337
do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff888085a3cbc0
which belongs to the cache skbuff_head_cache of size 224
The buggy address is located 0 bytes inside of
224-byte region [ffff888085a3cbc0, ffff888085a3cca0)
The buggy address belongs to the page:
page:ffffea0002168f00 refcount:1 mapcount:0 mapping:ffff88821b6f63c0 index:0x0
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea00027bbf88 ffffea0002105b88 ffff88821b6f63c0
raw: 0000000000000000 ffff888085a3c080 000000010000000c 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888085a3ca80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888085a3cb00: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
>ffff888085a3cb80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff888085a3cc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888085a3cc80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
Fixes: 0feca6190f88 ("net: ipv6: add skbuff fraglist splitter")
Fixes: c8b17be0b7a4 ("net: ipv4: add skbuff fraglist splitter")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-03 15:18:00 -07:00
..
2018-09-08 01:39:47 +09:00
2019-05-05 19:29:04 +02:00
2018-01-19 14:02:12 -05:00
2018-09-26 09:56:07 -07:00
2019-06-01 16:21:19 -07:00
2019-05-28 21:37:30 -07:00
2019-05-21 11:28:45 +02:00
2019-02-21 16:23:56 -08:00
2019-05-31 10:49:43 -07:00
2019-05-29 21:43:54 -07:00
2017-04-12 22:02:36 +02:00
2019-03-21 13:26:42 -07:00
2019-03-29 10:53:45 -07:00
2018-07-13 12:18:18 -04:00
2019-05-16 16:25:20 +01:00
2019-02-28 08:24:23 -07:00
2018-08-07 12:39:13 -07:00
2017-11-02 11:10:55 +01:00
2019-05-05 11:25:49 -07:00
2017-11-02 11:10:55 +01:00
2019-01-23 11:18:00 -08:00
2018-04-19 16:11:11 -04:00
2019-05-24 17:37:53 +02:00
2019-05-21 11:28:40 +02:00
2017-05-27 18:51:41 -04:00
2018-09-26 20:22:19 -07:00
2019-04-27 09:07:04 -07:00
2018-07-30 09:10:25 -07:00
2019-05-21 11:28:45 +02:00
2019-04-26 16:05:52 -04:00
2016-07-08 12:20:57 +02:00
2019-01-03 18:57:57 -08:00
2019-05-21 11:28:45 +02:00
2016-06-25 12:19:35 -04:00
2019-04-19 14:07:40 -07:00
2017-11-02 11:10:55 +01:00
2018-07-27 13:17:50 -07:00
2019-05-23 09:18:43 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-05-21 11:52:39 +02:00
2019-05-21 11:52:39 +02:00
2017-11-04 09:26:51 +09:00
2019-05-29 21:48:53 -07:00
2017-11-02 11:10:55 +01:00
2018-03-05 12:52:45 -05:00
2017-11-04 09:26:51 +09:00
2017-11-02 11:10:55 +01:00
2019-03-21 13:39:25 -07:00
2018-05-20 18:31:42 -04:00
2017-11-02 11:10:55 +01:00
2018-02-28 11:43:28 -05:00
2018-05-28 22:59:54 -04:00
2019-04-22 21:50:53 -07:00
2019-05-22 17:50:24 -07:00
2017-11-02 11:10:55 +01:00
2019-06-03 14:56:35 -07:00
2019-06-03 14:57:04 -07:00
2019-02-27 12:50:17 -08:00
2017-11-02 11:10:55 +01:00
2019-04-26 13:02:11 +02:00
2017-10-11 09:49:34 +02:00
2017-11-02 11:10:55 +01:00
2018-11-17 21:37:29 -08:00
2019-04-27 17:07:22 -04:00
2019-03-22 12:09:31 -07:00
2018-12-10 15:53:04 -08:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-12-11 14:10:06 -05:00
2017-11-02 11:10:55 +01:00
2019-02-25 14:32:35 -08:00
2019-02-22 12:56:24 -08:00
2018-11-02 23:54:56 -07:00
2019-04-22 21:50:53 -07:00
2017-01-18 13:04:28 -05:00
2018-11-07 16:12:38 -08:00
2018-12-15 13:23:02 -08:00
2019-01-27 13:29:43 -08:00
2018-10-17 17:45:07 -07:00
2019-05-28 17:22:15 -07:00
2018-12-24 15:27:56 -08:00
2018-11-07 16:12:38 -08:00
2018-06-05 10:45:24 -04:00
2019-02-08 21:50:15 -08:00
2019-05-24 13:26:44 -07:00
2019-05-24 13:26:44 -07:00
2018-11-08 17:13:08 -08:00
2019-05-22 17:48:44 -07:00
2019-02-27 12:50:17 -08:00
2019-05-31 18:23:52 +02:00
2019-06-03 15:18:00 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-05-05 10:40:24 -07:00
2019-05-22 17:48:43 -07:00
2019-06-03 15:18:00 -07:00
2017-11-02 11:10:55 +01:00
2018-03-27 09:51:23 +02:00
2016-08-17 19:36:23 -04:00
2019-01-30 22:13:34 -08:00
2018-07-11 23:10:19 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-10-25 12:06:25 +09:00
2018-04-22 14:55:03 -04:00
2018-09-13 09:04:58 -07:00
2019-04-23 19:42:29 -07:00
2019-04-26 16:05:52 -04:00
2016-07-08 13:23:12 +02:00
2019-05-21 11:28:45 +02:00
2017-11-02 11:10:55 +01:00
2017-04-01 20:21:44 -07:00
2016-10-03 02:00:22 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-04-08 15:22:40 -07:00
2019-04-17 23:19:07 -07:00
2018-05-28 22:59:54 -04:00
2019-05-28 21:37:30 -07:00
2017-11-02 11:10:55 +01:00
2018-08-01 09:52:30 -07:00
2019-05-21 11:28:45 +02:00
2019-05-04 01:27:11 -04:00
2019-04-11 13:59:49 -07:00
2019-05-28 21:37:30 -07:00
2016-07-08 12:20:57 +02:00
2017-11-08 16:12:33 +09:00
2017-11-02 11:10:55 +01:00
2018-05-24 18:36:15 -07:00
2018-05-16 07:23:35 +02:00
2019-05-07 12:23:40 -07:00
2018-09-25 20:17:35 -07:00
2017-11-02 11:10:55 +01:00
2018-11-08 17:13:08 -08:00
2019-04-22 21:50:53 -07:00
2017-11-02 11:10:55 +01:00
2018-11-07 16:12:39 -08:00
2017-11-02 11:10:55 +01:00
2017-12-05 14:37:13 -05:00
2018-08-28 11:11:47 +02:00
2019-03-19 14:13:01 -07:00
2018-05-16 07:23:35 +02:00
2019-04-08 15:22:41 -07:00
2018-03-13 18:37:02 +02:00
2018-11-06 15:00:45 -08:00
2019-04-22 21:47:25 -07:00
2019-04-23 18:36:33 +02:00
2018-07-21 10:43:12 -05:00
2017-11-02 11:10:55 +01:00
2018-06-22 13:43:27 +09:00
2018-07-31 09:22:48 +02:00
2018-12-20 16:56:04 -08:00
2018-04-11 10:33:46 -04:00
2019-02-21 10:34:37 -08:00
2018-08-11 01:58:46 +02:00
2019-05-15 09:22:41 -07:00
2018-03-01 21:21:36 -05:00
2017-11-02 11:10:55 +01:00
2018-06-06 14:07:53 -04:00
2019-03-01 21:35:19 -08:00
2018-02-21 15:06:05 -05:00
2019-05-30 13:41:26 -07:00
2018-05-08 00:02:41 -04:00
2019-04-27 16:52:21 -04:00
2018-07-07 10:58:49 +09:00
2017-11-02 11:10:55 +01:00
2017-08-29 15:16:52 -07:00
2019-03-29 10:53:45 -07:00
2019-05-30 11:10:39 -07:00
2018-02-16 15:57:42 -05:00
2019-03-22 12:09:31 -07:00
2018-01-24 19:13:45 -05:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-03-16 01:27:51 +01:00
2018-08-29 12:25:53 -07:00
2019-05-07 22:03:58 -07:00