Eric Dumazet
5f3274c53a
macvlan: do not assume mac_header is set in macvlan_broadcast()
[ Upstream commit 96cc4b6958 ]
Use of eth_hdr() in tx path is error prone.
Many drivers call skb_reset_mac_header() before using it,
but others do not.
Commit 6d1ccff627 ("net: reset mac header in dev_start_xmit()")
attempted to fix this generically, but commit d346a3fae3
("packet: introduce PACKET_QDISC_BYPASS socket option") brought
back the macvlan bug.
Lets add a new helper, so that tx paths no longer have
to call skb_reset_mac_header() only to get a pointer
to skb->data.
Hopefully we will be able to revert 6d1ccff627
("net: reset mac header in dev_start_xmit()") and save few cycles
in transmit fast path.
BUG: KASAN: use-after-free in __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
BUG: KASAN: use-after-free in mc_hash drivers/net/macvlan.c:251 [inline]
BUG: KASAN: use-after-free in macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
Read of size 4 at addr ffff8880a4932401 by task syz-executor947/9579
CPU: 0 PID: 9579 Comm: syz-executor947 Not tainted 5.5.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
__kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:639
__asan_report_load_n_noabort+0xf/0x20 mm/kasan/generic_report.c:145
__get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
mc_hash drivers/net/macvlan.c:251 [inline]
macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
macvlan_queue_xmit drivers/net/macvlan.c:520 [inline]
macvlan_start_xmit+0x402/0x77f drivers/net/macvlan.c:559
__netdev_start_xmit include/linux/netdevice.h:4447 [inline]
netdev_start_xmit include/linux/netdevice.h:4461 [inline]
dev_direct_xmit+0x419/0x630 net/core/dev.c:4079
packet_direct_xmit+0x1a9/0x250 net/packet/af_packet.c:240
packet_snd net/packet/af_packet.c:2966 [inline]
packet_sendmsg+0x260d/0x6220 net/packet/af_packet.c:2991
sock_sendmsg_nosec net/socket.c:639 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:659
__sys_sendto+0x262/0x380 net/socket.c:1985
__do_sys_sendto net/socket.c:1997 [inline]
__se_sys_sendto net/socket.c:1993 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1993
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x442639
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc13549e08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442639
RDX: 000000000000000e RSI: 0000000020000080 RDI: 0000000000000003
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000403bb0 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 9389:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527
__do_kmalloc mm/slab.c:3656 [inline]
__kmalloc+0x163/0x770 mm/slab.c:3665
kmalloc include/linux/slab.h:561 [inline]
tomoyo_realpath_from_path+0xc5/0x660 security/tomoyo/realpath.c:252
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
security_inode_getattr+0xf2/0x150 security/security.c:1222
vfs_getattr+0x25/0x70 fs/stat.c:115
vfs_statx_fd+0x71/0xc0 fs/stat.c:145
vfs_fstat include/linux/fs.h:3265 [inline]
__do_sys_newfstat+0x9b/0x120 fs/stat.c:378
__se_sys_newfstat fs/stat.c:375 [inline]
__x64_sys_newfstat+0x54/0x80 fs/stat.c:375
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 9389:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
__cache_free mm/slab.c:3426 [inline]
kfree+0x10a/0x2c0 mm/slab.c:3757
tomoyo_realpath_from_path+0x1a7/0x660 security/tomoyo/realpath.c:289
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
security_inode_getattr+0xf2/0x150 security/security.c:1222
vfs_getattr+0x25/0x70 fs/stat.c:115
vfs_statx_fd+0x71/0xc0 fs/stat.c:145
vfs_fstat include/linux/fs.h:3265 [inline]
__do_sys_newfstat+0x9b/0x120 fs/stat.c:378
__se_sys_newfstat fs/stat.c:375 [inline]
__x64_sys_newfstat+0x54/0x80 fs/stat.c:375
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8880a4932000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1025 bytes inside of
4096-byte region [ffff8880a4932000, ffff8880a4933000)
The buggy address belongs to the page:
page:ffffea0002924c80 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0
raw: 00fffe0000010200 ffffea0002846208 ffffea00028f3888 ffff8880aa402000
raw: 0000000000000000 ffff8880a4932000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a4932300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a4932380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880a4932400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a4932480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a4932500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Fixes: b863ceb7dd ("[NET]: Add macvlan driver")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-12 12:17:25 +01:00
..
2019-12-13 08:51:18 +01:00
2019-09-10 10:33:53 +01:00
2019-12-05 09:20:15 +01:00
2019-05-31 06:46:24 -07:00
2019-03-13 14:02:35 -07:00
2019-12-17 20:35:45 +01:00
2019-11-20 18:45:52 +01:00
2019-10-05 13:09:57 +02:00
2019-12-13 08:52:21 +01:00
2019-04-17 08:38:46 +02:00
2019-12-13 08:51:43 +01:00
2019-02-27 10:08:52 +01:00
2020-01-09 10:19:05 +01:00
2019-12-31 16:36:22 +01:00
2019-11-24 08:19:24 +01:00
2019-12-13 08:51:47 +01:00
2020-01-09 10:19:01 +01:00
2019-12-13 08:52:59 +01:00
2019-03-05 17:58:50 +01:00
2019-05-31 06:46:00 -07:00
2019-12-01 09:17:07 +01:00
2019-06-09 09:17:11 +02:00
2019-04-17 08:38:51 +02:00
2019-10-05 13:10:03 +02:00
2019-08-04 09:30:57 +02:00
2019-12-05 09:21:08 +01:00
2019-07-03 13:14:48 +02:00
2019-05-25 18:23:48 +02:00
2019-10-05 13:09:54 +02:00
2019-08-16 10:12:38 +02:00
2019-08-09 17:52:34 +02:00
2019-08-09 17:52:34 +02:00
2019-04-05 22:33:03 +02:00
2019-08-06 19:06:52 +02:00
2019-08-06 19:06:52 +02:00
2019-06-09 09:17:23 +02:00
2019-02-27 10:08:53 +01:00
2019-06-09 09:17:23 +02:00
2019-02-27 10:08:53 +01:00
2019-06-04 08:02:34 +02:00
2019-11-12 19:21:38 +01:00
2019-11-20 18:47:11 +01:00
2019-12-31 16:36:22 +01:00
2019-07-26 09:14:12 +02:00
2019-11-24 08:20:07 +01:00
2019-07-31 07:27:11 +02:00
2019-05-25 18:23:26 +02:00
2019-09-16 08:22:12 +02:00
2019-08-09 17:52:28 +02:00
2019-12-13 08:51:54 +01:00
2020-01-09 10:19:00 +01:00
2019-06-04 08:02:34 +02:00
2019-11-20 18:47:40 +01:00
2019-05-16 19:41:22 +02:00
2019-05-16 19:41:17 +02:00
2019-04-05 22:32:59 +02:00
2019-11-24 08:19:14 +01:00
2019-07-10 09:53:47 +02:00
2019-07-28 08:29:29 +02:00
2019-11-20 18:45:55 +01:00
2019-12-01 09:17:38 +01:00
2019-12-05 09:21:03 +01:00
2019-05-31 06:46:18 -07:00
2019-11-10 11:27:40 +01:00
2019-09-10 10:33:44 +01:00
2019-03-23 20:10:08 +01:00
2019-02-12 19:47:24 +01:00
2019-05-31 06:46:28 -07:00
2019-07-31 07:26:59 +02:00
2020-01-04 19:13:32 +01:00
2019-12-17 20:35:45 +01:00
2019-05-22 07:37:40 +02:00
2019-10-17 13:45:42 -07:00
2019-11-20 18:47:31 +01:00
2019-05-08 07:21:43 +02:00
2019-12-05 09:19:39 +01:00
2019-10-11 18:21:43 +02:00
2019-03-05 17:58:51 +01:00
2020-01-12 12:17:25 +01:00
2019-08-09 17:52:34 +02:00
2019-12-01 09:17:05 +01:00
2019-11-20 18:45:19 +01:00
2019-08-04 09:30:54 +02:00
2019-12-31 16:35:23 +01:00
2019-03-05 17:58:45 +01:00
2019-04-05 22:33:09 +02:00
2019-12-13 08:52:43 +01:00
2019-06-04 08:02:34 +02:00
2019-06-04 08:02:34 +02:00
2019-04-20 09:15:59 +02:00
2019-07-21 09:03:11 +02:00
2019-12-13 08:52:43 +01:00
2019-03-23 20:09:48 +01:00
2019-12-05 09:20:26 +01:00
2019-12-01 09:17:35 +01:00
2020-01-09 10:19:01 +01:00
2020-01-04 19:13:15 +01:00
2019-06-09 09:17:19 +02:00
2019-09-06 10:22:19 +02:00
2019-04-17 08:38:51 +02:00
2019-12-05 09:21:08 +01:00
2019-12-31 16:35:38 +01:00
2019-11-12 19:20:36 +01:00
2019-11-12 19:20:36 +01:00
2019-12-31 16:34:36 +01:00
2019-06-09 09:17:23 +02:00
2019-05-31 06:46:05 -07:00
2019-02-23 09:07:25 +01:00
2020-01-09 10:19:09 +01:00
2019-06-04 08:02:34 +02:00
2019-06-04 08:02:34 +02:00
2019-09-06 10:22:22 +02:00
2019-09-06 10:22:23 +02:00
2020-01-09 10:18:54 +01:00
2019-06-09 09:17:24 +02:00
2019-05-31 06:46:30 -07:00
2019-11-12 19:20:36 +01:00
2019-05-25 18:23:38 +02:00
2019-07-28 08:29:28 +02:00
2019-05-04 09:20:11 +02:00
2020-01-04 19:13:35 +01:00
2019-03-23 20:10:04 +01:00
2019-06-11 12:20:52 +02:00
2019-06-15 11:54:10 +02:00
2019-12-13 08:52:28 +01:00
2020-01-04 19:12:53 +01:00
2019-12-17 20:35:17 +01:00
2020-01-04 19:13:41 +01:00
2019-07-26 09:14:07 +02:00
2019-04-05 22:32:56 +02:00
2019-12-05 09:19:38 +01:00
2019-04-05 22:32:56 +02:00
2019-08-04 09:30:56 +02:00
2019-12-05 09:20:25 +01:00
2019-12-13 08:51:07 +01:00
2019-06-04 08:02:30 +02:00
2020-01-04 19:13:30 +01:00
2019-04-03 06:26:28 +02:00
2019-05-31 06:46:16 -07:00
2019-03-13 14:02:35 -07:00
2019-04-17 08:38:45 +02:00
2019-12-05 09:20:57 +01:00
2019-06-17 19:51:56 +02:00
2019-05-31 06:46:29 -07:00
2019-12-21 10:57:17 +01:00
2019-11-20 18:45:24 +01:00
2019-12-05 09:19:49 +01:00
2019-12-13 08:52:28 +01:00
2019-05-08 07:21:44 +02:00
2019-02-27 10:09:01 +01:00
2019-04-17 08:38:52 +02:00
2019-07-14 08:11:21 +02:00