Revision 4dd2b82d5adfbe0b1587ccad7a8f76d826120f37 authored by Eric Dumazet on 02 May 2019, 01:56:28 UTC, committed by David S. Miller on 02 May 2019, 02:29:56 UTC
syzbot was able to crash host by sending UDP packets with a 0 payload.
TCP does not have this issue since we do not aggregate packets without
payload.
Since dev_gro_receive() sets gso_size based on skb_gro_len(skb)
it seems not worth trying to cope with padded packets.
BUG: KASAN: slab-out-of-bounds in skb_gro_receive+0xf5f/0x10e0 net/core/skbuff.c:3826
Read of size 16 at addr ffff88808893fff0 by task syz-executor612/7889
CPU: 0 PID: 7889 Comm: syz-executor612 Not tainted 5.1.0-rc7+ #96
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
__asan_report_load16_noabort+0x14/0x20 mm/kasan/generic_report.c:133
skb_gro_receive+0xf5f/0x10e0 net/core/skbuff.c:3826
udp_gro_receive_segment net/ipv4/udp_offload.c:382 [inline]
call_gro_receive include/linux/netdevice.h:2349 [inline]
udp_gro_receive+0xb61/0xfd0 net/ipv4/udp_offload.c:414
udp4_gro_receive+0x763/0xeb0 net/ipv4/udp_offload.c:478
inet_gro_receive+0xe72/0x1110 net/ipv4/af_inet.c:1510
dev_gro_receive+0x1cd0/0x23c0 net/core/dev.c:5581
napi_gro_frags+0x36b/0xd10 net/core/dev.c:5843
tun_get_user+0x2f24/0x3fb0 drivers/net/tun.c:1981
tun_chr_write_iter+0xbd/0x156 drivers/net/tun.c:2027
call_write_iter include/linux/fs.h:1866 [inline]
do_iter_readv_writev+0x5e1/0x8e0 fs/read_write.c:681
do_iter_write fs/read_write.c:957 [inline]
do_iter_write+0x184/0x610 fs/read_write.c:938
vfs_writev+0x1b3/0x2f0 fs/read_write.c:1002
do_writev+0x15e/0x370 fs/read_write.c:1037
__do_sys_writev fs/read_write.c:1110 [inline]
__se_sys_writev fs/read_write.c:1107 [inline]
__x64_sys_writev+0x75/0xb0 fs/read_write.c:1107
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441cc0
Code: 05 48 3d 01 f0 ff ff 0f 83 9d 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 51 93 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 74 09 fc ff c3 48 83 ec 08 e8 ba 2b 00 00
RSP: 002b:00007ffe8c716118 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007ffe8c716150 RCX: 0000000000441cc0
RDX: 0000000000000001 RSI: 00007ffe8c716170 RDI: 00000000000000f0
RBP: 0000000000000000 R08: 000000000000ffff R09: 0000000000a64668
R10: 0000000020000040 R11: 0000000000000246 R12: 000000000000c2d9
R13: 0000000000402b50 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 5143:
save_stack+0x45/0xd0 mm/kasan/common.c:75
set_track mm/kasan/common.c:87 [inline]
__kasan_kmalloc mm/kasan/common.c:497 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:470
kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:505
slab_post_alloc_hook mm/slab.h:437 [inline]
slab_alloc mm/slab.c:3393 [inline]
kmem_cache_alloc+0x11a/0x6f0 mm/slab.c:3555
mm_alloc+0x1d/0xd0 kernel/fork.c:1030
bprm_mm_init fs/exec.c:363 [inline]
__do_execve_file.isra.0+0xaa3/0x23f0 fs/exec.c:1791
do_execveat_common fs/exec.c:1865 [inline]
do_execve fs/exec.c:1882 [inline]
__do_sys_execve fs/exec.c:1958 [inline]
__se_sys_execve fs/exec.c:1953 [inline]
__x64_sys_execve+0x8f/0xc0 fs/exec.c:1953
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 5351:
save_stack+0x45/0xd0 mm/kasan/common.c:75
set_track mm/kasan/common.c:87 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:459
kasan_slab_free+0xe/0x10 mm/kasan/common.c:467
__cache_free mm/slab.c:3499 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3765
__mmdrop+0x238/0x320 kernel/fork.c:677
mmdrop include/linux/sched/mm.h:49 [inline]
finish_task_switch+0x47b/0x780 kernel/sched/core.c:2746
context_switch kernel/sched/core.c:2880 [inline]
__schedule+0x81b/0x1cc0 kernel/sched/core.c:3518
preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:3745
retint_kernel+0x1b/0x2d
arch_local_irq_restore arch/x86/include/asm/paravirt.h:767 [inline]
kmem_cache_free+0xab/0x260 mm/slab.c:3766
anon_vma_chain_free mm/rmap.c:134 [inline]
unlink_anon_vmas+0x2ba/0x870 mm/rmap.c:401
free_pgtables+0x1af/0x2f0 mm/memory.c:394
exit_mmap+0x2d1/0x530 mm/mmap.c:3144
__mmput kernel/fork.c:1046 [inline]
mmput+0x15f/0x4c0 kernel/fork.c:1067
exec_mmap fs/exec.c:1046 [inline]
flush_old_exec+0x8d9/0x1c20 fs/exec.c:1279
load_elf_binary+0x9bc/0x53f0 fs/binfmt_elf.c:864
search_binary_handler fs/exec.c:1656 [inline]
search_binary_handler+0x17f/0x570 fs/exec.c:1634
exec_binprm fs/exec.c:1698 [inline]
__do_execve_file.isra.0+0x1394/0x23f0 fs/exec.c:1818
do_execveat_common fs/exec.c:1865 [inline]
do_execve fs/exec.c:1882 [inline]
__do_sys_execve fs/exec.c:1958 [inline]
__se_sys_execve fs/exec.c:1953 [inline]
__x64_sys_execve+0x8f/0xc0 fs/exec.c:1953
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88808893f7c0
which belongs to the cache mm_struct of size 1496
The buggy address is located 600 bytes to the right of
1496-byte region [ffff88808893f7c0, ffff88808893fd98)
The buggy address belongs to the page:
page:ffffea0002224f80 count:1 mapcount:0 mapping:ffff88821bc40ac0 index:0xffff88808893f7c0 compound_mapcount: 0
flags: 0x1fffc0000010200(slab|head)
raw: 01fffc0000010200 ffffea00025b4f08 ffffea00027b9d08 ffff88821bc40ac0
raw: ffff88808893f7c0 ffff88808893e440 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88808893fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88808893ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88808893ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888088940000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888088940080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Fixes: e20cf8d3f1f7 ("udp: implement GRO for plain UDP sockets.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 886b7a5
| File | Mode | Size |
|---|---|---|
| asymmetric_keys | ||
| async_tx | ||
| 842.c | -rw-r--r-- | 4.2 KB |
| Kconfig | -rw-r--r-- | 54.7 KB |
| Makefile | -rw-r--r-- | 6.1 KB |
| ablkcipher.c | -rw-r--r-- | 10.6 KB |
| acompress.c | -rw-r--r-- | 4.7 KB |
| adiantum.c | -rw-r--r-- | 20.8 KB |
| aead.c | -rw-r--r-- | 10.2 KB |
| aegis.h | -rw-r--r-- | 2.0 KB |
| aegis128.c | -rw-r--r-- | 11.5 KB |
| aegis128l.c | -rw-r--r-- | 14.1 KB |
| aegis256.c | -rw-r--r-- | 12.2 KB |
| aes_generic.c | -rw-r--r-- | 62.2 KB |
| aes_ti.c | -rw-r--r-- | 12.7 KB |
| af_alg.c | -rw-r--r-- | 25.7 KB |
| ahash.c | -rw-r--r-- | 16.5 KB |
| akcipher.c | -rw-r--r-- | 3.9 KB |
| algapi.c | -rw-r--r-- | 29.4 KB |
| algboss.c | -rw-r--r-- | 6.0 KB |
| algif_aead.c | -rw-r--r-- | 16.0 KB |
| algif_hash.c | -rw-r--r-- | 9.8 KB |
| algif_rng.c | -rw-r--r-- | 5.2 KB |
| algif_skcipher.c | -rw-r--r-- | 10.1 KB |
| ansi_cprng.c | -rw-r--r-- | 10.9 KB |
| anubis.c | -rw-r--r-- | 27.8 KB |
| api.c | -rw-r--r-- | 13.9 KB |
| arc4.c | -rw-r--r-- | 3.5 KB |
| authenc.c | -rw-r--r-- | 14.2 KB |
| authencesn.c | -rw-r--r-- | 15.3 KB |
| blkcipher.c | -rw-r--r-- | 14.9 KB |
| blowfish_common.c | -rw-r--r-- | 15.7 KB |
| blowfish_generic.c | -rw-r--r-- | 3.4 KB |
| camellia_generic.c | -rw-r--r-- | 34.9 KB |
| cast5_generic.c | -rw-r--r-- | 20.8 KB |
| cast6_generic.c | -rw-r--r-- | 9.4 KB |
| cast_common.c | -rw-r--r-- | 13.1 KB |
| cbc.c | -rw-r--r-- | 2.5 KB |
| ccm.c | -rw-r--r-- | 24.9 KB |
| cfb.c | -rw-r--r-- | 6.1 KB |
| chacha20poly1305.c | -rw-r--r-- | 19.2 KB |
| chacha_generic.c | -rw-r--r-- | 6.0 KB |
| cipher.c | -rw-r--r-- | 3.3 KB |
| cmac.c | -rw-r--r-- | 7.7 KB |
| compress.c | -rw-r--r-- | 1.3 KB |
| crc32_generic.c | -rw-r--r-- | 3.7 KB |
| crc32c_generic.c | -rw-r--r-- | 4.4 KB |
| crct10dif_common.c | -rw-r--r-- | 3.6 KB |
| crct10dif_generic.c | -rw-r--r-- | 3.2 KB |
| cryptd.c | -rw-r--r-- | 36.5 KB |
| crypto_engine.c | -rw-r--r-- | 13.5 KB |
| crypto_null.c | -rw-r--r-- | 5.4 KB |
| crypto_user_base.c | -rw-r--r-- | 12.1 KB |
| crypto_user_stat.c | -rw-r--r-- | 9.7 KB |
| crypto_wq.c | -rw-r--r-- | 972 bytes |
| ctr.c | -rw-r--r-- | 10.4 KB |
| cts.c | -rw-r--r-- | 12.0 KB |
| deflate.c | -rw-r--r-- | 7.9 KB |
| des_generic.c | -rw-r--r-- | 35.8 KB |
| dh.c | -rw-r--r-- | 4.9 KB |
| dh_helper.c | -rw-r--r-- | 3.6 KB |
| drbg.c | -rw-r--r-- | 57.2 KB |
| ecb.c | -rw-r--r-- | 2.6 KB |
| ecc.c | -rw-r--r-- | 27.6 KB |
| ecc.h | -rw-r--r-- | 3.7 KB |
| ecc_curve_defs.h | -rw-r--r-- | 2.1 KB |
| ecdh.c | -rw-r--r-- | 4.1 KB |
| ecdh_helper.c | -rw-r--r-- | 2.3 KB |
| echainiv.c | -rw-r--r-- | 4.5 KB |
| fcrypt.c | -rw-r--r-- | 18.0 KB |
| fips.c | -rw-r--r-- | 1.6 KB |
| gcm.c | -rw-r--r-- | 32.2 KB |
| gf128mul.c | -rw-r--r-- | 12.4 KB |
| ghash-generic.c | -rw-r--r-- | 3.5 KB |
| hash_info.c | -rw-r--r-- | 2.1 KB |
| hmac.c | -rw-r--r-- | 6.9 KB |
| internal.h | -rw-r--r-- | 3.7 KB |
| jitterentropy-kcapi.c | -rw-r--r-- | 6.0 KB |
| jitterentropy.c | -rw-r--r-- | 23.9 KB |
| keywrap.c | -rw-r--r-- | 9.5 KB |
| khazad.c | -rw-r--r-- | 51.8 KB |
| kpp.c | -rw-r--r-- | 2.9 KB |
| lrw.c | -rw-r--r-- | 10.8 KB |
| lz4.c | -rw-r--r-- | 3.9 KB |
| lz4hc.c | -rw-r--r-- | 4.0 KB |
| lzo-rle.c | -rw-r--r-- | 4.0 KB |
| lzo.c | -rw-r--r-- | 3.9 KB |
| md4.c | -rw-r--r-- | 5.9 KB |
| md5.c | -rw-r--r-- | 7.4 KB |
| memneq.c | -rw-r--r-- | 6.1 KB |
| michael_mic.c | -rw-r--r-- | 3.6 KB |
| morus1280.c | -rw-r--r-- | 14.0 KB |
| morus640.c | -rw-r--r-- | 13.5 KB |
| nhpoly1305.c | -rw-r--r-- | 7.7 KB |
| ofb.c | -rw-r--r-- | 2.4 KB |
| pcbc.c | -rw-r--r-- | 4.9 KB |
| pcrypt.c | -rw-r--r-- | 13.2 KB |
| poly1305_generic.c | -rw-r--r-- | 8.5 KB |
| proc.c | -rw-r--r-- | 2.7 KB |
| ripemd.h | -rw-r--r-- | 1013 bytes |
| rmd128.c | -rw-r--r-- | 10.2 KB |
| rmd160.c | -rw-r--r-- | 12.6 KB |
| rmd256.c | -rw-r--r-- | 10.5 KB |
| rmd320.c | -rw-r--r-- | 13.0 KB |
| rng.c | -rw-r--r-- | 4.9 KB |
| rsa-pkcs1pad.c | -rw-r--r-- | 17.6 KB |
| rsa.c | -rw-r--r-- | 7.5 KB |
| rsa_helper.c | -rw-r--r-- | 4.2 KB |
| rsaprivkey.asn1 | -rw-r--r-- | 316 bytes |
| rsapubkey.asn1 | -rw-r--r-- | 82 bytes |
| salsa20_generic.c | -rw-r--r-- | 6.0 KB |
| scatterwalk.c | -rw-r--r-- | 2.2 KB |
| scompress.c | -rw-r--r-- | 7.4 KB |
| seed.c | -rw-r--r-- | 17.4 KB |
| seqiv.c | -rw-r--r-- | 5.2 KB |
| serpent_generic.c | -rw-r--r-- | 21.4 KB |
| sha1_generic.c | -rw-r--r-- | 2.6 KB |
| sha256_generic.c | -rw-r--r-- | 11.0 KB |
| sha3_generic.c | -rw-r--r-- | 8.2 KB |
| sha512_generic.c | -rw-r--r-- | 8.0 KB |
| shash.c | -rw-r--r-- | 14.9 KB |
| simd.c | -rw-r--r-- | 7.3 KB |
| skcipher.c | -rw-r--r-- | 31.2 KB |
| sm3_generic.c | -rw-r--r-- | 4.6 KB |
| sm4_generic.c | -rw-r--r-- | 6.3 KB |
| streebog_generic.c | -rw-r--r-- | 59.4 KB |
| tcrypt.c | -rw-r--r-- | 78.5 KB |
| tcrypt.h | -rw-r--r-- | 4.4 KB |
| tea.c | -rw-r--r-- | 6.6 KB |
| testmgr.c | -rw-r--r-- | 98.4 KB |
| testmgr.h | -rw-r--r-- | 1.2 MB |
| tgr192.c | -rw-r--r-- | 30.4 KB |
| twofish_common.c | -rw-r--r-- | 37.8 KB |
| twofish_generic.c | -rw-r--r-- | 6.2 KB |
| vmac.c | -rw-r--r-- | 18.8 KB |
| wp512.c | -rw-r--r-- | 59.7 KB |
| xcbc.c | -rw-r--r-- | 7.2 KB |
| xor.c | -rw-r--r-- | 3.8 KB |
| xts.c | -rw-r--r-- | 9.0 KB |
| zstd.c | -rw-r--r-- | 5.3 KB |
Computing file changes ...
