iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/bridge
History
Nikolay Aleksandrov 8bd67ebb50 net: bridge: xmit: make sure we have at least eth header len bytes 
syzbot triggered an uninit value[1] error in bridge device's xmit path
by sending a short (less than ETH_HLEN bytes) skb. To fix it check if
we can actually pull that amount instead of assuming.

Tested with dropwatch:
 drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3)
 origin: software
 timestamp: Mon May 13 11:31:53 2024 778214037 nsec
 protocol: 0x88a8
 length: 2
 original length: 2
 drop reason: PKT_TOO_SMALL

[1]
BUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65
 br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65
 __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
 netdev_start_xmit include/linux/netdevice.h:4917 [inline]
 xmit_one net/core/dev.c:3531 [inline]
 dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547
 __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341
 dev_queue_xmit include/linux/netdevice.h:3091 [inline]
 __bpf_tx_skb net/core/filter.c:2136 [inline]
 __bpf_redirect_common net/core/filter.c:2180 [inline]
 __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187
 ____bpf_clone_redirect net/core/filter.c:2460 [inline]
 bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432
 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997
 __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425
 bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058
 bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269
 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678
 __do_sys_bpf kernel/bpf/syscall.c:5767 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5765 [inline]
 __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765
 x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-05-15 11:41:02 +01:00
..
netfilter
netfilter: br_netfilter: skip conntrack input hook for promisc packets
2024-04-11 12:09:33 +02:00
br_arp_nd_proxy.c
bridge: Add per-{Port, VLAN} neighbor suppression data path support
2023-04-21 08:25:50 +01:00
br_cfm_netlink.c
bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
2023-12-26 22:38:13 +00:00
br_cfm.c
bridge: cfm: remove redundant return
2021-06-22 10:35:15 -07:00
br_device.c
net: bridge: xmit: make sure we have at least eth header len bytes
2024-05-15 11:41:02 +01:00
br_fdb.c
net: bridge: Use KMEM_CACHE instead of kmem_cache_create
2024-01-31 16:39:46 -08:00
br_forward.c
net: bridge: fix corrupted ethernet header on multicast-to-unicast
2024-05-08 10:37:57 +01:00
br_if.c
net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
2023-07-03 09:11:34 +01:00
br_input.c
netfilter: br_netfilter: skip conntrack input hook for promisc packets
2024-04-11 12:09:33 +02:00
br_ioctl.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2021-12-31 14:35:40 +00:00
br_mdb.c
bridge: mdb: Add MDB bulk deletion support
2023-12-20 11:27:20 +00:00
br_mrp_netlink.c
bridge: mrp: Use hlist_head instead of list_head for mrp
2020-11-09 16:42:12 -08:00
br_mrp_switchdev.c
bridge: mrp: Extend br_mrp_switchdev to detect better the errors
2021-02-16 14:47:46 -08:00
br_mrp.c
net: bridge: mrp: Update the Test frames for MRA
2021-06-28 15:46:10 -07:00
br_mst.c
net: bridge: mst: Add helper to query a port's MST state
2022-03-17 16:49:58 -07:00
br_multicast_eht.c
treewide: Convert del_timer*() to timer_shutdown*()
2022-12-25 13:38:09 -08:00
br_multicast.c
treewide: update LLVM Bugzilla links
2024-02-22 15:38:51 -08:00
br_netfilter_hooks.c
netfilter: br_netfilter: skip conntrack input hook for promisc packets
2024-04-11 12:09:33 +02:00
br_netfilter_ipv6.c
netfilter: bridge: replace physindev with physinif in nf_bridge_info
2024-01-17 12:02:49 +01:00
br_netlink_tunnel.c
net: bridge: Set strict_start_type at two policies
2023-02-06 08:48:25 +00:00
br_netlink.c
bridge/br_netlink.c: no need to return void function
2024-04-22 11:57:14 +01:00
br_nf_core.c
net: dst: Switch to rcuref_t reference counting
2023-03-28 18:52:28 -07:00
br_private_cfm.h
bridge: cfm: Kernel space implementation of CFM. CCM frame RX added.
2020-10-29 18:39:43 -07:00
br_private_mcast_eht.h
net: bridge: multicast: use multicast contexts instead of bridge or port
2021-07-20 05:41:19 -07:00
br_private_mrp.h
net: bridge: mrp: Update the Test frames for MRA
2021-06-28 15:46:10 -07:00
br_private_stp.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
br_private_tunnel.h
bridge: always declare tunnel functions
2023-05-17 21:28:58 -07:00
br_private.h
netfilter: br_netfilter: skip conntrack input hook for promisc packets
2024-04-11 12:09:33 +02:00
br_stp_bpdu.c
net: bridge: add STP xstats
2019-12-14 20:02:36 -08:00
br_stp_if.c
net: use eth_hw_addr_set()
2021-10-02 14:18:25 +01:00
br_stp_timer.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
br_stp.c
net: bridge: mst: Multiple Spanning Tree (MST) mode
2022-03-17 16:49:57 -07:00
br_switchdev.c
net: bridge: switchdev: Ensure deferred event delivery on unoffload
2024-02-16 09:36:37 +00:00
br_sysfs_br.c
bridge: Fix flushing of dynamic FDB entries
2022-11-02 20:47:09 -07:00
br_sysfs_if.c
bridge: move from strlcpy with unused retval to strscpy
2022-08-22 17:57:30 -07:00
br_vlan_options.c
bridge: vlan: Allow setting VLAN neighbor suppression state
2023-04-21 08:25:50 +01:00
br_vlan_tunnel.c
bridge: Add backup nexthop ID support
2023-07-19 10:53:49 +01:00
br_vlan.c
bridge: vlan: use synchronize_net() when holding RTNL
2024-02-12 12:17:02 +00:00
br.c
bridge: use exit_batch_rtnl() method
2024-02-07 18:55:12 -08:00
Kconfig
bridge: cfm: Add BRIDGE_CFM to Kconfig.
2020-10-29 18:39:43 -07:00
Makefile
net: bridge: mst: Multiple Spanning Tree (MST) mode
2022-03-17 16:49:57 -07:00