On 01/16/2019 02:19 AM, Willem de Bruijn wrote:
> From: Willem de Bruijn <will...@google.com>
>
> Syzkaller was able to construct a packet of negative length by
> redirecting from bpf_prog_test_run_skb with BPF_PROG_TYPE_LWT_XMIT:
>
> BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:345
> [inline]
> BUG: KASAN: slab-out-of-bounds in skb_copy_from_linear_data
> include/linux/skbuff.h:3421 [inline]
> BUG: KASAN: slab-out-of-bounds in __pskb_copy_fclone+0x2dd/0xeb0
> net/core/skbuff.c:1395
> Read of size 4294967282 at addr ffff8801d798009c by task
> syz-executor2/12942
>
> kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
> check_memory_region_inline mm/kasan/kasan.c:260 [inline]
> check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
> memcpy+0x23/0x50 mm/kasan/kasan.c:302
> memcpy include/linux/string.h:345 [inline]
> skb_copy_from_linear_data include/linux/skbuff.h:3421 [inline]
> __pskb_copy_fclone+0x2dd/0xeb0 net/core/skbuff.c:1395
> __pskb_copy include/linux/skbuff.h:1053 [inline]
> pskb_copy include/linux/skbuff.h:2904 [inline]
> skb_realloc_headroom+0xe7/0x120 net/core/skbuff.c:1539
> ipip6_tunnel_xmit net/ipv6/sit.c:965 [inline]
> sit_tunnel_xmit+0xe1b/0x30d0 net/ipv6/sit.c:1029
> __netdev_start_xmit include/linux/netdevice.h:4325 [inline]
> netdev_start_xmit include/linux/netdevice.h:4334 [inline]
> xmit_one net/core/dev.c:3219 [inline]
> dev_hard_start_xmit+0x295/0xc90 net/core/dev.c:3235
> __dev_queue_xmit+0x2f0d/0x3950 net/core/dev.c:3805
> dev_queue_xmit+0x17/0x20 net/core/dev.c:3838
> __bpf_tx_skb net/core/filter.c:2016 [inline]
> __bpf_redirect_common net/core/filter.c:2054 [inline]
> __bpf_redirect+0x5cf/0xb20 net/core/filter.c:2061
> ____bpf_clone_redirect net/core/filter.c:2094 [inline]
> bpf_clone_redirect+0x2f6/0x490 net/core/filter.c:2066
> bpf_prog_41f2bcae09cd4ac3+0xb25/0x1000
>
> The generated test constructs a packet with mac header, network
> header, skb->data pointing to network header and skb->len 0.
>
> Redirecting to a sit0 through __bpf_redirect_no_mac pulls the
> mac length, even though skb->data already is at skb->network_header.
> bpf_prog_test_run_skb has already pulled it as LWT_XMIT !is_l2.
>
> Update the offset calculation to pull only if skb->data differs
> from skb->network_header, which is not true in this case.
>
> The test itself can be run only from commit 1cf1cae963c2 ("bpf:
> introduce BPF_PROG_TEST_RUN command"), but the same type of packets
> with skb at network header could already be built from lwt xmit hooks,
> so this fix is more relevant to that commit.
>
> Also set the mac header on redirect from LWT_XMIT, as even after this
> change to __bpf_redirect_no_mac that field is expected to be set, but
> is not yet in ip_finish_output2.
>
> Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure")
> Reported-by: syzbot <syzkal...@googlegroups.com>
> Signed-off-by: Willem de Bruijn <will...@google.com>
Applied, thanks!
