Eyal Birger
b02d196c44
bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook ...
xmit_check_hhlen() observes the dst for getting the device hard header
length to make sure a modified packet can fit. When a helper which changes
the dst - such as bpf_skb_set_tunnel_key() - is called as part of the
xmit program the accessed dst is no longer valid.
This leads to the following splat:
BUG: kernel NULL pointer dereference, address: 00000000000000de
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1 ] PREEMPT SMP PTI
CPU: 0 PID: 798 Comm: ping Not tainted 5.18.0-rc2+ #103
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
RIP: 0010:bpf_xmit+0xfb/0x17f
Code: c6 c0 4d cd 8e 48 c7 c7 7d 33 f0 8e e8 42 09 fb ff 48 8b 45 58 48 8b 95 c8 00 00 00 48 2b 95 c0 00 00 00 48 83 e0 fe 48 8b 00 <0f> b7 80 de 00 00 00 39 c2 73 22 29 d0 b9 20 0a 00 00 31 d2 48 89
RSP: 0018:ffffb148c0bc7b98 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000240008 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 00000000ffffffea RDI: 00000000ffffffff
RBP: ffff922a828a4e00 R08: ffffffff8f1350e8 R09: 00000000ffffdfff
R10: ffffffff8f055100 R11: ffffffff8f105100 R12: 0000000000000000
R13: ffff922a828a4e00 R14: 0000000000000040 R15: 0000000000000000
FS: 00007f414e8f0080(0000) GS:ffff922afdc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000de CR3: 0000000002d80006 CR4: 0000000000370ef0
Call Trace:
<TASK>
lwtunnel_xmit.cold+0x71/0xc8
ip_finish_output2+0x279/0x520
? __ip_finish_output.part.0+0x21/0x130
Fix by fetching the device hard header length before running the BPF code.
Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure")
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20220420165219.1755407-1-eyal.birger@gmail.com
2022-04-22 17:45:25 +02:00
2022-02-04 14:15:11 -08:00
2022-03-15 20:34:40 -05:00
2021-11-19 11:23:23 +00:00
2022-03-17 16:34:49 -07:00
2022-01-22 08:33:37 +02:00
2022-03-29 10:24:34 +02:00
2022-03-07 11:40:41 +00:00
2022-03-18 17:12:08 +01:00
2022-04-11 17:30:15 +02:00
2022-02-25 09:36:06 +01:00
2022-03-23 10:32:44 -07:00
2022-03-04 12:02:19 +00:00
2022-03-31 09:46:58 +02:00
2022-03-01 18:26:36 +01:00
2022-04-22 17:45:25 +02:00
2022-03-03 08:01:55 -08:00
2022-01-27 13:53:27 +00:00
2022-02-28 13:21:32 +00:00
2022-04-01 11:59:01 +01:00
2021-11-24 17:21:42 -08:00
2022-02-23 20:33:05 -08:00
2022-03-11 23:17:24 -08:00
2022-03-03 14:38:48 +00:00
2022-04-01 12:09:17 +01:00
2022-04-06 15:14:30 +01:00
2022-02-22 16:09:13 -08:00
2021-12-29 08:48:14 -08:00
2022-03-10 07:39:47 +01:00
2021-12-10 06:38:27 -08:00
2022-03-15 20:20:02 -07:00
2022-03-25 16:55:41 -07:00
2022-03-15 11:50:33 +01:00
2021-10-20 14:27:40 +01:00
2022-04-01 12:04:15 +01:00
2022-02-10 15:29:39 +00:00
2022-03-23 10:53:49 -07:00
2022-01-15 08:47:31 -08:00
2022-04-05 11:55:46 +02:00
2022-03-21 10:59:11 +00:00
2022-03-18 21:47:14 -07:00
2022-01-07 14:11:05 +00:00
2022-03-03 10:43:37 +00:00
2022-04-06 13:36:50 +01:00
2022-03-17 13:56:58 -07:00
2022-03-07 11:40:41 +00:00
2021-12-17 17:17:14 +01:00
2021-12-16 16:13:19 -08:00
2022-03-18 13:09:17 +02:00
2021-12-29 08:48:14 -08:00
2022-04-06 13:48:51 +01:00
2022-03-26 17:00:51 -07:00
2022-04-05 09:51:12 +02:00
2022-03-28 16:06:27 -07:00
2021-11-09 01:05:28 +01:00
2022-03-29 18:55:37 -07:00
2022-02-24 21:31:43 -08:00
2022-03-23 10:53:49 -07:00
2022-04-01 11:53:35 +01:00
2022-03-23 10:53:49 -07:00
2022-03-24 18:36:36 -07:00
2022-03-11 13:00:17 -08:00
2022-03-26 11:48:16 -07:00
2022-04-07 23:09:08 +02:00
2022-03-19 14:49:08 +00:00
2022-03-03 09:55:28 +00:00
2021-12-10 06:38:26 -08:00
2022-03-22 15:57:03 -07:00
2021-11-09 10:02:50 -08:00
b02d196c44