mirror of
git://git.yoctoproject.org/linux-yocto.git
synced 2025-07-08 14:55:21 +02:00

[ Upstream commite269d79c7d
] Two missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again 1. After the skb_segment function the buffer may become non-linear (nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere the __skb_linearize function will not be executed, then the buffer will remain non-linear. Then the condition (offset >= skb_headlen(skb)) becomes true, which causes WARN_ON_ONCE in skb_checksum_help. 2. The struct sk_buff and struct virtio_net_hdr members must be mathematically related. (gso_size) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) may be 0 if division is without remainder. offset+2 (4191) > skb_headlen() (1116) WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Modules linked in: CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209 RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001 RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777 ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584 ip_finish_output_gso net/ipv4/ip_output.c:286 [inline] __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:451 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129 iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline] sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3545 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Found by Linux Verification Center (linuxtesting.org) with Syzkaller Fixes:0f6925b3e8
("virtio_net: Do not pull payload in skb->head") Signed-off-by: Denis Arefev <arefev@swemel.ru> Message-Id: <20240613095448.27118-1-arefev@swemel.ru> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
222 lines
5.8 KiB
C
222 lines
5.8 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _LINUX_VIRTIO_NET_H
|
|
#define _LINUX_VIRTIO_NET_H
|
|
|
|
#include <linux/if_vlan.h>
|
|
#include <uapi/linux/tcp.h>
|
|
#include <uapi/linux/udp.h>
|
|
#include <uapi/linux/virtio_net.h>
|
|
|
|
static inline bool virtio_net_hdr_match_proto(__be16 protocol, __u8 gso_type)
|
|
{
|
|
switch (gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
|
|
case VIRTIO_NET_HDR_GSO_TCPV4:
|
|
return protocol == cpu_to_be16(ETH_P_IP);
|
|
case VIRTIO_NET_HDR_GSO_TCPV6:
|
|
return protocol == cpu_to_be16(ETH_P_IPV6);
|
|
case VIRTIO_NET_HDR_GSO_UDP:
|
|
return protocol == cpu_to_be16(ETH_P_IP) ||
|
|
protocol == cpu_to_be16(ETH_P_IPV6);
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
|
|
const struct virtio_net_hdr *hdr)
|
|
{
|
|
if (skb->protocol)
|
|
return 0;
|
|
|
|
switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
|
|
case VIRTIO_NET_HDR_GSO_TCPV4:
|
|
case VIRTIO_NET_HDR_GSO_UDP:
|
|
skb->protocol = cpu_to_be16(ETH_P_IP);
|
|
break;
|
|
case VIRTIO_NET_HDR_GSO_TCPV6:
|
|
skb->protocol = cpu_to_be16(ETH_P_IPV6);
|
|
break;
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
|
|
const struct virtio_net_hdr *hdr,
|
|
bool little_endian)
|
|
{
|
|
unsigned int gso_type = 0;
|
|
unsigned int thlen = 0;
|
|
unsigned int p_off = 0;
|
|
unsigned int ip_proto;
|
|
u64 ret, remainder, gso_size;
|
|
|
|
if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
|
|
switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
|
|
case VIRTIO_NET_HDR_GSO_TCPV4:
|
|
gso_type = SKB_GSO_TCPV4;
|
|
ip_proto = IPPROTO_TCP;
|
|
thlen = sizeof(struct tcphdr);
|
|
break;
|
|
case VIRTIO_NET_HDR_GSO_TCPV6:
|
|
gso_type = SKB_GSO_TCPV6;
|
|
ip_proto = IPPROTO_TCP;
|
|
thlen = sizeof(struct tcphdr);
|
|
break;
|
|
case VIRTIO_NET_HDR_GSO_UDP:
|
|
gso_type = SKB_GSO_UDP;
|
|
ip_proto = IPPROTO_UDP;
|
|
thlen = sizeof(struct udphdr);
|
|
break;
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (hdr->gso_type & VIRTIO_NET_HDR_GSO_ECN)
|
|
gso_type |= SKB_GSO_TCP_ECN;
|
|
|
|
if (hdr->gso_size == 0)
|
|
return -EINVAL;
|
|
}
|
|
|
|
skb_reset_mac_header(skb);
|
|
|
|
if (hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
|
|
u32 start = __virtio16_to_cpu(little_endian, hdr->csum_start);
|
|
u32 off = __virtio16_to_cpu(little_endian, hdr->csum_offset);
|
|
u32 needed = start + max_t(u32, thlen, off + sizeof(__sum16));
|
|
|
|
if (hdr->gso_size) {
|
|
gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size);
|
|
ret = div64_u64_rem(skb->len, gso_size, &remainder);
|
|
if (!(ret && (hdr->gso_size > needed) &&
|
|
((remainder > needed) || (remainder == 0)))) {
|
|
return -EINVAL;
|
|
}
|
|
skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG;
|
|
}
|
|
|
|
if (!pskb_may_pull(skb, needed))
|
|
return -EINVAL;
|
|
|
|
if (!skb_partial_csum_set(skb, start, off))
|
|
return -EINVAL;
|
|
|
|
p_off = skb_transport_offset(skb) + thlen;
|
|
if (!pskb_may_pull(skb, p_off))
|
|
return -EINVAL;
|
|
} else {
|
|
/* gso packets without NEEDS_CSUM do not set transport_offset.
|
|
* probe and drop if does not match one of the above types.
|
|
*/
|
|
if (gso_type && skb->network_header) {
|
|
struct flow_keys_basic keys;
|
|
|
|
if (!skb->protocol) {
|
|
__be16 protocol = dev_parse_header_protocol(skb);
|
|
|
|
if (!protocol)
|
|
virtio_net_hdr_set_proto(skb, hdr);
|
|
else if (!virtio_net_hdr_match_proto(protocol, hdr->gso_type))
|
|
return -EINVAL;
|
|
else
|
|
skb->protocol = protocol;
|
|
}
|
|
retry:
|
|
if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
|
|
NULL, 0, 0, 0,
|
|
0)) {
|
|
/* UFO does not specify ipv4 or 6: try both */
|
|
if (gso_type & SKB_GSO_UDP &&
|
|
skb->protocol == htons(ETH_P_IP)) {
|
|
skb->protocol = htons(ETH_P_IPV6);
|
|
goto retry;
|
|
}
|
|
return -EINVAL;
|
|
}
|
|
|
|
p_off = keys.control.thoff + thlen;
|
|
if (!pskb_may_pull(skb, p_off) ||
|
|
keys.basic.ip_proto != ip_proto)
|
|
return -EINVAL;
|
|
|
|
skb_set_transport_header(skb, keys.control.thoff);
|
|
} else if (gso_type) {
|
|
p_off = thlen;
|
|
if (!pskb_may_pull(skb, p_off))
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
|
|
if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
|
|
u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size);
|
|
unsigned int nh_off = p_off;
|
|
struct skb_shared_info *shinfo = skb_shinfo(skb);
|
|
|
|
/* UFO may not include transport header in gso_size. */
|
|
if (gso_type & SKB_GSO_UDP)
|
|
nh_off -= thlen;
|
|
|
|
/* Kernel has a special handling for GSO_BY_FRAGS. */
|
|
if (gso_size == GSO_BY_FRAGS)
|
|
return -EINVAL;
|
|
|
|
/* Too small packets are not really GSO ones. */
|
|
if (skb->len - nh_off > gso_size) {
|
|
shinfo->gso_size = gso_size;
|
|
shinfo->gso_type = gso_type;
|
|
|
|
/* Header must be checked, and gso_segs computed. */
|
|
shinfo->gso_type |= SKB_GSO_DODGY;
|
|
shinfo->gso_segs = 0;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
|
|
struct virtio_net_hdr *hdr,
|
|
bool little_endian,
|
|
bool has_data_valid,
|
|
int vlan_hlen)
|
|
{
|
|
memset(hdr, 0, sizeof(*hdr)); /* no info leak */
|
|
|
|
if (skb_is_gso(skb)) {
|
|
struct skb_shared_info *sinfo = skb_shinfo(skb);
|
|
|
|
/* This is a hint as to how much should be linear. */
|
|
hdr->hdr_len = __cpu_to_virtio16(little_endian,
|
|
skb_headlen(skb));
|
|
hdr->gso_size = __cpu_to_virtio16(little_endian,
|
|
sinfo->gso_size);
|
|
if (sinfo->gso_type & SKB_GSO_TCPV4)
|
|
hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
|
|
else if (sinfo->gso_type & SKB_GSO_TCPV6)
|
|
hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
|
|
else
|
|
return -EINVAL;
|
|
if (sinfo->gso_type & SKB_GSO_TCP_ECN)
|
|
hdr->gso_type |= VIRTIO_NET_HDR_GSO_ECN;
|
|
} else
|
|
hdr->gso_type = VIRTIO_NET_HDR_GSO_NONE;
|
|
|
|
if (skb->ip_summed == CHECKSUM_PARTIAL) {
|
|
hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
|
|
hdr->csum_start = __cpu_to_virtio16(little_endian,
|
|
skb_checksum_start_offset(skb) + vlan_hlen);
|
|
hdr->csum_offset = __cpu_to_virtio16(little_endian,
|
|
skb->csum_offset);
|
|
} else if (has_data_valid &&
|
|
skb->ip_summed == CHECKSUM_UNNECESSARY) {
|
|
hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
|
|
} /* else everything is zero */
|
|
|
|
return 0;
|
|
}
|
|
|
|
#endif /* _LINUX_VIRTIO_NET_H */
|