lkml.org 
[lkml]   [2022]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 20/30] ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
    Date
    From: Lu Wei <luwei32@huawei.com>

    [ Upstream commit 81225b2ea161af48e093f58e8dfee6d705b16af4 ]

    If an AF_PACKET socket is used to send packets through ipvlan and the
    default xmit function of the AF_PACKET socket is changed from
    dev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option
    name of PACKET_QDISC_BYPASS, the skb->mac_header may not be reset and
    remains as the initial value of 65535, this may trigger slab-out-of-bounds
    bugs as following:

    =================================================================
    UG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]
    PU: 2 PID: 1768 Comm: raw_send Kdump: loaded Not tainted 6.0.0-rc4+ #6
    ardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33
    all Trace:
    print_address_description.constprop.0+0x1d/0x160
    print_report.cold+0x4f/0x112
    kasan_report+0xa3/0x130
    ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]
    ipvlan_start_xmit+0x29/0xa0 [ipvlan]
    __dev_direct_xmit+0x2e2/0x380
    packet_direct_xmit+0x22/0x60
    packet_snd+0x7c9/0xc40
    sock_sendmsg+0x9a/0xa0
    __sys_sendto+0x18a/0x230
    __x64_sys_sendto+0x74/0x90
    do_syscall_64+0x3b/0x90
    entry_SYSCALL_64_after_hwframe+0x63/0xcd

    The root cause is:
    1. packet_snd() only reset skb->mac_header when sock->type is SOCK_RAW
    and skb->protocol is not specified as in packet_parse_headers()

    2. packet_direct_xmit() doesn't reset skb->mac_header as dev_queue_xmit()

    In this case, skb->mac_header is 65535 when ipvlan_xmit_mode_l2() is
    called. So when ipvlan_xmit_mode_l2() gets mac header with eth_hdr() which
    use "skb->head + skb->mac_header", out-of-bound access occurs.

    This patch replaces eth_hdr() with skb_eth_hdr() in ipvlan_xmit_mode_l2()
    and reset mac header in multicast to solve this out-of-bound bug.

    Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
    Signed-off-by: Lu Wei <luwei32@huawei.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ipvlan/ipvlan_core.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
    index 6c0982a39486..7668584c3843 100644
    --- a/drivers/net/ipvlan/ipvlan_core.c
    +++ b/drivers/net/ipvlan/ipvlan_core.c
    @@ -441,7 +441,6 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)

    static int ipvlan_process_outbound(struct sk_buff *skb)
    {
    - struct ethhdr *ethh = eth_hdr(skb);
    int ret = NET_XMIT_DROP;

    /* The ipvlan is a pseudo-L2 device, so the packets that we receive
    @@ -451,6 +450,8 @@ static int ipvlan_process_outbound(struct sk_buff *skb)
    if (skb_mac_header_was_set(skb)) {
    /* In this mode we dont care about
    * multicast and broadcast traffic */
    + struct ethhdr *ethh = eth_hdr(skb);
    +
    if (is_multicast_ether_addr(ethh->h_dest)) {
    pr_debug_ratelimited(
    "Dropped {multi|broad}cast of type=[%x]\n",
    @@ -520,7 +521,7 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
    static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
    {
    const struct ipvl_dev *ipvlan = netdev_priv(dev);
    - struct ethhdr *eth = eth_hdr(skb);
    + struct ethhdr *eth = skb_eth_hdr(skb);
    struct ipvl_addr *addr;
    void *lyr3h;
    int addr_type;
    @@ -544,6 +545,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
    return dev_forward_skb(ipvlan->phy_dev, skb);

    } else if (is_multicast_ether_addr(eth->h_dest)) {
    + skb_reset_mac_header(skb);
    ipvlan_skb_crossing_ns(skb, NULL);
    ipvlan_multicast_enqueue(ipvlan->port, skb);
    return NET_XMIT_SUCCESS;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-09-26 12:16    [W:2.431 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site