Lorenzo Bianconi bb9bd814eb
ipv6: sit: reset ip header pointer in ipip6_rcv ...
ipip6 tunnels run iptunnel_pull_header on received skbs. This can
determine the following use-after-free accessing iph pointer since
the packet will be 'uncloned' running pskb_expand_head if it is a
cloned gso skb (e.g if the packet has been sent though a veth device)
[ 706.369655] BUG: KASAN: use-after-free in ipip6_rcv+0x1678/0x16e0 [sit]
[ 706.449056] Read of size 1 at addr ffffe01b6bd855f5 by task ksoftirqd/1/=
[ 706.669494] Hardware name: HPE ProLiant m400 Server/ProLiant m400 Server, BIOS U02 08/19/2016
[ 706.771839] Call trace:
[ 706.801159] dump_backtrace+0x0/0x2f8
[ 706.845079] show_stack+0x24/0x30
[ 706.884833] dump_stack+0xe0/0x11c
[ 706.925629] print_address_description+0x68/0x260
[ 706.982070] kasan_report+0x178/0x340
[ 707.025995] __asan_report_load1_noabort+0x30/0x40
[ 707.083481] ipip6_rcv+0x1678/0x16e0 [sit]
[ 707.132623] tunnel64_rcv+0xd4/0x200 [tunnel4]
[ 707.185940] ip_local_deliver_finish+0x3b8/0x988
[ 707.241338] ip_local_deliver+0x144/0x470
[ 707.289436] ip_rcv_finish+0x43c/0x14b0
[ 707.335447] ip_rcv+0x628/0x1138
[ 707.374151] __netif_receive_skb_core+0x1670/0x2600
[ 707.432680] __netif_receive_skb+0x28/0x190
[ 707.482859] process_backlog+0x1d0/0x610
[ 707.529913] net_rx_action+0x37c/0xf68
[ 707.574882] __do_softirq+0x288/0x1018
[ 707.619852] run_ksoftirqd+0x70/0xa8
[ 707.662734] smpboot_thread_fn+0x3a4/0x9e8
[ 707.711875] kthread+0x2c8/0x350
[ 707.750583] ret_from_fork+0x10/0x18
[ 707.811302] Allocated by task 16982:
[ 707.854182] kasan_kmalloc.part.1+0x40/0x108
[ 707.905405] kasan_kmalloc+0xb4/0xc8
[ 707.948291] kasan_slab_alloc+0x14/0x20
[ 707.994309] __kmalloc_node_track_caller+0x158/0x5e0
[ 708.053902] __kmalloc_reserve.isra.8+0x54/0xe0
[ 708.108280] __alloc_skb+0xd8/0x400
[ 708.150139] sk_stream_alloc_skb+0xa4/0x638
[ 708.200346] tcp_sendmsg_locked+0x818/0x2b90
[ 708.251581] tcp_sendmsg+0x40/0x60
[ 708.292376] inet_sendmsg+0xf0/0x520
[ 708.335259] sock_sendmsg+0xac/0xf8
[ 708.377096] sock_write_iter+0x1c0/0x2c0
[ 708.424154] new_sync_write+0x358/0x4a8
[ 708.470162] __vfs_write+0xc4/0xf8
[ 708.510950] vfs_write+0x12c/0x3d0
[ 708.551739] ksys_write+0xcc/0x178
[ 708.592533] __arm64_sys_write+0x70/0xa0
[ 708.639593] el0_svc_handler+0x13c/0x298
[ 708.686646] el0_svc+0x8/0xc
[ 708.739019] Freed by task 17:
[ 708.774597] __kasan_slab_free+0x114/0x228
[ 708.823736] kasan_slab_free+0x10/0x18
[ 708.868703] kfree+0x100/0x3d8
[ 708.905320] skb_free_head+0x7c/0x98
[ 708.948204] skb_release_data+0x320/0x490
[ 708.996301] pskb_expand_head+0x60c/0x970
[ 709.044399] __iptunnel_pull_header+0x3b8/0x5d0
[ 709.098770] ipip6_rcv+0x41c/0x16e0 [sit]
[ 709.146873] tunnel64_rcv+0xd4/0x200 [tunnel4]
[ 709.200195] ip_local_deliver_finish+0x3b8/0x988
[ 709.255596] ip_local_deliver+0x144/0x470
[ 709.303692] ip_rcv_finish+0x43c/0x14b0
[ 709.349705] ip_rcv+0x628/0x1138
[ 709.388413] __netif_receive_skb_core+0x1670/0x2600
[ 709.446943] __netif_receive_skb+0x28/0x190
[ 709.497120] process_backlog+0x1d0/0x610
[ 709.544169] net_rx_action+0x37c/0xf68
[ 709.589131] __do_softirq+0x288/0x1018
[ 709.651938] The buggy address belongs to the object at ffffe01b6bd85580
which belongs to the cache kmalloc-1024 of size 1024
[ 709.804356] The buggy address is located 117 bytes inside of
1024-byte region [ffffe01b6bd85580, ffffe01b6bd85980)
[ 709.946340] The buggy address belongs to the page:
[ 710.003824] page:ffff7ff806daf600 count:1 mapcount:0 mapping:ffffe01c4001f600 index:0x0
[ 710.099914] flags: 0xfffff8000000100(slab)
[ 710.149059] raw: 0fffff8000000100 dead000000000100 dead000000000200 ffffe01c4001f600
[ 710.242011] raw: 0000000000000000 0000000000380038 00000001ffffffff 0000000000000000
[ 710.334966] page dumped because: kasan: bad access detected
Fix it resetting iph pointer after iptunnel_pull_header
Fixes: a09a4c8dd1jishi@redhat.com >
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com >
Signed-off-by: David S. Miller <davem@davemloft.net >
2019-04-04 18:34:23 -07:00
2019-03-27 22:46:16 -07:00
2019-03-18 16:22:48 +01:00
2019-02-13 18:27:55 -08:00
2019-03-04 13:14:34 -08:00
2019-01-19 10:09:59 -08:00
2019-02-13 18:27:55 -08:00
2017-11-15 11:56:19 -08:00
2018-11-08 17:04:43 -08:00
2018-07-05 20:15:26 +09:00
2019-01-10 09:36:41 -05:00
2018-12-19 11:21:37 -08:00
2019-01-28 11:20:58 +01:00
2018-05-07 23:50:27 -04:00
2018-07-05 20:15:26 +09:00
2017-09-01 20:33:42 -07:00
2018-05-11 00:10:56 +02:00
2019-03-08 15:19:53 -08:00
2019-02-24 21:57:26 -08:00
2017-01-28 10:33:06 -05:00
2018-12-14 15:55:20 -08:00
2018-10-24 14:18:16 -07:00
2019-01-02 20:15:43 -08:00
2018-07-07 10:58:49 +09:00
2019-02-24 12:06:19 -08:00
2017-11-02 11:10:55 +01:00
2018-12-09 21:43:31 -08:00
2019-02-20 11:24:27 -08:00
2019-04-03 21:42:20 -07:00
2019-04-02 13:19:34 -07:00
2019-01-17 14:55:52 -08:00
2019-01-01 12:05:02 -08:00
2019-03-04 10:55:48 -08:00
2019-03-03 21:05:10 -08:00
2018-07-24 14:10:43 -07:00
2017-11-02 11:10:55 +01:00
2019-02-21 13:48:00 -08:00
2019-01-22 17:18:08 -08:00
2016-12-25 17:21:23 +01:00
2018-10-26 15:58:06 -07:00
2019-02-18 11:38:30 -08:00
2017-11-24 01:37:35 +09:00
2018-07-07 10:58:49 +09:00
2018-05-16 07:24:30 +02:00
2017-03-24 13:17:07 -07:00
2018-12-20 11:53:36 -08:00
2019-02-26 08:27:05 -08:00
2019-03-20 11:06:56 -07:00
2018-07-03 10:29:26 +09:00
2019-01-30 14:06:12 -08:00
2018-07-31 09:22:48 +02:00
2019-02-12 12:36:02 -05:00
2019-04-04 18:34:23 -07:00
2018-03-25 20:53:54 -04:00
2018-04-25 13:02:15 -04:00
2019-03-19 14:00:27 -07:00
2018-12-15 13:23:02 -08:00
2018-11-08 17:13:08 -08:00
2019-01-17 15:01:08 -08:00
2018-12-15 13:23:02 -08:00
2019-02-22 16:05:11 -08:00
2019-01-17 15:01:08 -08:00
2018-12-19 11:21:37 -08:00
2017-06-16 11:48:39 -04:00
2018-07-11 15:26:35 +02:00
2018-09-04 10:26:30 +02:00
2018-03-07 10:54:29 +01:00
2018-09-03 07:37:57 +02:00
2018-11-22 07:55:48 +01:00
2018-11-08 17:13:08 -08:00
2018-04-26 07:51:48 +02:00
2019-02-05 06:29:20 +01:00
bb9bd814eb