| Message ID | cbbedd1f-3e99-85f7-86d7-d02a86d59c29@huawei.com |
|---|---|
| State | Changes Requested |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] ipv6: Fix dangling pointer when ipv6 fragment | expand |
On 03/30/2019 12:29 AM, hujunwei wrote: > From: Junwei Hu <hujunwei4@huawei.com> > > At the beginning of ip6_fragment func, the prevhdr pointer is > obtained in the ip6_find_1stfragopt func. > However, all the pointers pointing into skb header may change > when calling skb_checksum_help func with > skb->ip_summed = CHECKSUM_PARTIAL condition. > The prevhdr pointe will be dangling if it is not reloaded after > calling __skb_linearize func in skb_checksum_help func. > > Here, I add a variable, nexthdr_offset, to evaluate the offset, > which does not changes even after calling __skb_linearize func. > > Fixes: 405c92f7a541 ("ipv6: add defensive check for CHECKSUM_PARTIAL skbs in ip_fragment") > Signed-off-by: Junwei Hu <hujunwei4@huawei.com> > Reported-by: Wenhao Zhang <zhangwenhao8@huawei.com> > Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com> Interesting. We got a syzbot report yesterday about this issue. (email thread : BUG: unable to handle kernel paging request in ip6_fragment) <quote> syzbot found the following crash on: HEAD commit: 8c838f53 dpaa2-eth: fix race condition with bql frame acco.. git tree: net console output: https://syzkaller.appspot.com/x/log.txt?x=12b83a9b200000 kernel config: https://syzkaller.appspot.com/x/.config?x=f05902bca21d8935 dashboard link: https://syzkaller.appspot.com/bug?extid=e8ce541d095e486074fc compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+e8ce541d095e486074fc@syzkaller.appspotmail.com </quote> > > --- > net/ipv6/ip6_output.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c > index edbd12067170..6db3c60b3b66 100644 > --- a/net/ipv6/ip6_output.c > +++ b/net/ipv6/ip6_output.c > @@ -606,12 +606,14 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, > __be32 frag_id; > int ptr, offset = 0, err = 0; > u8 *prevhdr, nexthdr = 0; > + u8 nexthdr_offset; > > err = ip6_find_1stfragopt(skb, &prevhdr); > if (err < 0) > goto fail; > hlen = err; > nexthdr = *prevhdr; > + nexthdr_offset = prevhdr - skb_network_header(skb); > > mtu = ip6_skb_dst_mtu(skb); > > @@ -646,6 +648,8 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, > (err = skb_checksum_help(skb))) > goto fail; > > + prevhdr = skb_network_header(skb) + nexthdr_offset; > + > hroom = LL_RESERVED_SPACE(rt->dst.dev); > if (skb_has_frag_list(skb)) { > unsigned int first_len = skb_pagelen(skb); >
On 03/30/2019 12:48 AM, Eric Dumazet wrote: > > > On 03/30/2019 12:29 AM, hujunwei wrote: >> From: Junwei Hu <hujunwei4@huawei.com> >> >> At the beginning of ip6_fragment func, the prevhdr pointer is >> obtained in the ip6_find_1stfragopt func. >> However, all the pointers pointing into skb header may change >> when calling skb_checksum_help func with >> skb->ip_summed = CHECKSUM_PARTIAL condition. >> The prevhdr pointe will be dangling if it is not reloaded after >> calling __skb_linearize func in skb_checksum_help func. >> >> Here, I add a variable, nexthdr_offset, to evaluate the offset, >> which does not changes even after calling __skb_linearize func. >> ... >> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c >> index edbd12067170..6db3c60b3b66 100644 >> --- a/net/ipv6/ip6_output.c >> +++ b/net/ipv6/ip6_output.c >> @@ -606,12 +606,14 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, >> __be32 frag_id; >> int ptr, offset = 0, err = 0; >> u8 *prevhdr, nexthdr = 0; >> + u8 nexthdr_offset; Why u8 here ? I would use "unsigned int" really. >> >> err = ip6_find_1stfragopt(skb, &prevhdr); >> if (err < 0) >> goto fail; >> hlen = err; >> nexthdr = *prevhdr; >> + nexthdr_offset = prevhdr - skb_network_header(skb); >> >> mtu = ip6_skb_dst_mtu(skb); >> >> @@ -646,6 +648,8 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, >> (err = skb_checksum_help(skb))) >> goto fail; >> >> + prevhdr = skb_network_header(skb) + nexthdr_offset; >> + >> hroom = LL_RESERVED_SPACE(rt->dst.dev); >> if (skb_has_frag_list(skb)) { >> unsigned int first_len = skb_pagelen(skb); >>
Hi Eri, Thanks for your suggestion, u8 may not enough when the packet have a lot of exthdr. I will update the patch in v2, by the way update Report-by tag. On 2019/3/30 15:57, Eric Dumazet wrote: > > On 03/30/2019 12:48 AM, Eric Dumazet wrote: >> >> On 03/30/2019 12:29 AM, hujunwei wrote: >>> From: Junwei Hu <hujunwei4@huawei.com> >>> >>> At the beginning of ip6_fragment func, the prevhdr pointer is >>> obtained in the ip6_find_1stfragopt func. >>> However, all the pointers pointing into skb header may change >>> when calling skb_checksum_help func with >>> skb->ip_summed = CHECKSUM_PARTIAL condition. >>> The prevhdr pointe will be dangling if it is not reloaded after >>> calling __skb_linearize func in skb_checksum_help func. >>> >>> Here, I add a variable, nexthdr_offset, to evaluate the offset, >>> which does not changes even after calling __skb_linearize func. >>> > ... > >>> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c >>> index edbd12067170..6db3c60b3b66 100644 >>> --- a/net/ipv6/ip6_output.c >>> +++ b/net/ipv6/ip6_output.c >>> @@ -606,12 +606,14 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, >>> __be32 frag_id; >>> int ptr, offset = 0, err = 0; >>> u8 *prevhdr, nexthdr = 0; >>> + u8 nexthdr_offset; > Why u8 here ? > > I would use "unsigned int" really. > >>> >>> err = ip6_find_1stfragopt(skb, &prevhdr); >>> if (err < 0) >>> goto fail; >>> hlen = err; >>> nexthdr = *prevhdr; >>> + nexthdr_offset = prevhdr - skb_network_header(skb); >>> >>> mtu = ip6_skb_dst_mtu(skb); >>> >>> @@ -646,6 +648,8 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, >>> (err = skb_checksum_help(skb))) >>> goto fail; >>> >>> + prevhdr = skb_network_header(skb) + nexthdr_offset; >>> + >>> hroom = LL_RESERVED_SPACE(rt->dst.dev); >>> if (skb_has_frag_list(skb)) { >>> unsigned int first_len = skb_pagelen(skb); >>> > . >
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index edbd12067170..6db3c60b3b66 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -606,12 +606,14 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, __be32 frag_id; int ptr, offset = 0, err = 0; u8 *prevhdr, nexthdr = 0; + u8 nexthdr_offset; err = ip6_find_1stfragopt(skb, &prevhdr); if (err < 0) goto fail; hlen = err; nexthdr = *prevhdr; + nexthdr_offset = prevhdr - skb_network_header(skb); mtu = ip6_skb_dst_mtu(skb); @@ -646,6 +648,8 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, (err = skb_checksum_help(skb))) goto fail; + prevhdr = skb_network_header(skb) + nexthdr_offset; + hroom = LL_RESERVED_SPACE(rt->dst.dev); if (skb_has_frag_list(skb)) { unsigned int first_len = skb_pagelen(skb);