On Thu, Jul 19, 2018 at 4:04 PM, Eric Dumazet <eduma...@google.com> wrote:
> syzbot caught a NULL deref [1], caused by skb_segment()
>
> skb_segment() has many "goto err;" that assume the @err variable
> contains -ENOMEM.
>
> A successful call to __skb_linearize() should not clear @err,
> otherwise a subsequent memory allocation error could return NULL.
>
> While we are at it, we might use -EINVAL instead of -ENOMEM when
> MAX_SKB_FRAGS limit is reached.
>
> [1]
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> CPU: 0 PID: 13285 Comm: syz-executor3 Not tainted 4.18.0-rc4+ #146
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:tcp_gso_segment+0x3dc/0x1780 net/ipv4/tcp_offload.c:106
> Code: f0 ff ff 0f 87 1c fd ff ff e8 00 88 0b fb 48 8b 75 d0 48 b9 00 00 00 00
> 00 fc ff df 48 8d be 90 00 00 00 48 89 f8 48 c1 e8 03 <0f> b6 14 08 48 8d 86
> 94 00 00 00 48 89 c6 83 e0 07 48 c1 ee 03 0f
> RSP: 0018:ffff88019b7fd060 EFLAGS: 00010206
> RAX: 0000000000000012 RBX: 0000000000000020 RCX: dffffc0000000000
> RDX: 0000000000040000 RSI: 0000000000000000 RDI: 0000000000000090
> RBP: ffff88019b7fd0f0 R08: ffff88019510e0c0 R09: ffffed003b5c46d6
> R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: 0000000000000001
> R13: ffff8801d6c581f4 R14: 0000000000000000 R15: ffff8801d6c58128
> FS: 00007fcae64d6700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000004e8664 CR3: 00000001b669b000 CR4: 00000000001406f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> tcp4_gso_segment+0x1c3/0x440 net/ipv4/tcp_offload.c:54
> inet_gso_segment+0x64e/0x12d0 net/ipv4/af_inet.c:1342
> inet_gso_segment+0x64e/0x12d0 net/ipv4/af_inet.c:1342
> skb_mac_gso_segment+0x3b5/0x740 net/core/dev.c:2792
> __skb_gso_segment+0x3c3/0x880 net/core/dev.c:2865
> skb_gso_segment include/linux/netdevice.h:4099 [inline]
> validate_xmit_skb+0x640/0xf30 net/core/dev.c:3104
> __dev_queue_xmit+0xc14/0x3910 net/core/dev.c:3561
> dev_queue_xmit+0x17/0x20 net/core/dev.c:3602
> neigh_hh_output include/net/neighbour.h:473 [inline]
> neigh_output include/net/neighbour.h:481 [inline]
> ip_finish_output2+0x1063/0x1860 net/ipv4/ip_output.c:229
> ip_finish_output+0x841/0xfa0 net/ipv4/ip_output.c:317
> NF_HOOK_COND include/linux/netfilter.h:276 [inline]
> ip_output+0x223/0x880 net/ipv4/ip_output.c:405
> dst_output include/net/dst.h:444 [inline]
> ip_local_out+0xc5/0x1b0 net/ipv4/ip_output.c:124
> iptunnel_xmit+0x567/0x850 net/ipv4/ip_tunnel_core.c:91
> ip_tunnel_xmit+0x1598/0x3af1 net/ipv4/ip_tunnel.c:778
> ipip_tunnel_xmit+0x264/0x2c0 net/ipv4/ipip.c:308
> __netdev_start_xmit include/linux/netdevice.h:4148 [inline]
> netdev_start_xmit include/linux/netdevice.h:4157 [inline]
> xmit_one net/core/dev.c:3034 [inline]
> dev_hard_start_xmit+0x26c/0xc30 net/core/dev.c:3050
> __dev_queue_xmit+0x29ef/0x3910 net/core/dev.c:3569
> dev_queue_xmit+0x17/0x20 net/core/dev.c:3602
> neigh_direct_output+0x15/0x20 net/core/neighbour.c:1403
> neigh_output include/net/neighbour.h:483 [inline]
> ip_finish_output2+0xa67/0x1860 net/ipv4/ip_output.c:229
> ip_finish_output+0x841/0xfa0 net/ipv4/ip_output.c:317
> NF_HOOK_COND include/linux/netfilter.h:276 [inline]
> ip_output+0x223/0x880 net/ipv4/ip_output.c:405
> dst_output include/net/dst.h:444 [inline]
> ip_local_out+0xc5/0x1b0 net/ipv4/ip_output.c:124
> ip_queue_xmit+0x9df/0x1f80 net/ipv4/ip_output.c:504
> tcp_transmit_skb+0x1bf9/0x3f10 net/ipv4/tcp_output.c:1168
> tcp_write_xmit+0x1641/0x5c20 net/ipv4/tcp_output.c:2363
> __tcp_push_pending_frames+0xb2/0x290 net/ipv4/tcp_output.c:2536
> tcp_push+0x638/0x8c0 net/ipv4/tcp.c:735
> tcp_sendmsg_locked+0x2ec5/0x3f00 net/ipv4/tcp.c:1410
> tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1447
> inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
> sock_sendmsg_nosec net/socket.c:641 [inline]
> sock_sendmsg+0xd5/0x120 net/socket.c:651
> __sys_sendto+0x3d7/0x670 net/socket.c:1797
> __do_sys_sendto net/socket.c:1809 [inline]
> __se_sys_sendto net/socket.c:1805 [inline]
> __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1805
> do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x455ab9
> Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48
> 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f
> 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007fcae64d5c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
> RAX: ffffffffffffffda RBX: 00007fcae64d66d4 RCX: 0000000000455ab9
> RDX: 0000000000000001 RSI: 0000000020000200 RDI: 0000000000000013
> RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014
> R13: 00000000004c1145 R14: 00000000004d1818 R15: 0000000000000006
> Modules linked in:
> Dumping ftrace buffer:
> (ftrace buffer empty)
>
> Fixes: ddff00d42043 ("net: Move skb_has_shared_frag check out of GRE code and
> into segmentation")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Cc: Alexander Duyck <alexander.h.du...@intel.com>
> Reported-by: syzbot <syzkal...@googlegroups.com>
Thanks for fixing this.
Acked-by: Alexander Duyck <alexander.h.du...@intel.com>
> ---
> net/core/skbuff.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index
> 8e51f8555e11b95bc48ab334f50571048f705101..fb35b62af2724025f743d61de24f9fb7eb9186a8
> 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -3720,6 +3720,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
> net_warn_ratelimited(
> "skb_segment: too many frags: %u
> %u\n",
> pos, mss);
> + err = -EINVAL;
> goto err;
> }
>
> @@ -3753,11 +3754,10 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
>
> perform_csum_check:
> if (!csum) {
> - if (skb_has_shared_frag(nskb)) {
> - err = __skb_linearize(nskb);
> - if (err)
> - goto err;
> - }
> + if (skb_has_shared_frag(nskb) &&
> + __skb_linearize(nskb))
> + goto err;
> +
> if (!nskb->remcsum_offload)
> nskb->ip_summed = CHECKSUM_NONE;
> SKB_GSO_CB(nskb)->csum =
> --
> 2.18.0.233.g985f88cf7e-goog
>
