Messages in this thread | | | Subject | Re: [PATCH net] ipv4: ip_gre: Handle skb_pull() failure in ipgre_xmit() | From | Paolo Abeni <> | Date | Tue, 28 Nov 2023 16:51:09 +0100 |
| |
On Tue, 2023-11-28 at 16:45 +0100, Eric Dumazet wrote: > On Sun, Nov 26, 2023 at 4:17 PM Shigeru Yoshida <syoshida@redhat.com> wrote: > > > > In ipgre_xmit(), skb_pull() may fail even if pskb_inet_may_pull() returns > > true. For example, applications can create a malformed packet that causes > > this problem with PF_PACKET. > > > > This patch fixes the problem by dropping skb and returning from the > > function if skb_pull() fails. > > > > Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") > > Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> > > --- > > net/ipv4/ip_gre.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c > > index 22a26d1d29a0..95efa97cb84b 100644 > > --- a/net/ipv4/ip_gre.c > > +++ b/net/ipv4/ip_gre.c > > @@ -643,7 +643,8 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, > > /* Pull skb since ip_tunnel_xmit() needs skb->data pointing > > * to gre header. > > */ > > - skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); > > + if (!skb_pull(skb, tunnel->hlen + sizeof(struct iphdr))) > > + goto free_skb; > > skb_reset_mac_header(skb); > > > > if (skb->ip_summed == CHECKSUM_PARTIAL && > > -- > > > I have syszbot reports with an actual repro for this one.
Could you please share them? I could not find easily the reports in https://syzkaller.appspot.com/upstream
Thanks,
Paolo
| |