Revision bbb40a0b75209734ff9286f3326171638c9f6569 authored by Mathieu Xhonneux on 25 May 2018, 12:29:41 UTC, committed by David S. Miller on 29 May 2018, 03:09:49 UTC
seg6_do_srh_encap and seg6_do_srh_inline can possibly do an out-of-bounds access when adding the SRH to the packet. This no longer happen when expanding the skb not only by the size of the SRH (+ outer IPv6 header), but also by skb->mac_len. [ 53.793056] BUG: KASAN: use-after-free in seg6_do_srh_encap+0x284/0x620 [ 53.794564] Write of size 14 at addr ffff88011975ecfa by task ping/674 [ 53.796665] CPU: 0 PID: 674 Comm: ping Not tainted 4.17.0-rc3-ARCH+ #90 [ 53.796670] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014 [ 53.796673] Call Trace: [ 53.796679] <IRQ> [ 53.796689] dump_stack+0x71/0xab [ 53.796700] print_address_description+0x6a/0x270 [ 53.796707] kasan_report+0x258/0x380 [ 53.796715] ? seg6_do_srh_encap+0x284/0x620 [ 53.796722] memmove+0x34/0x50 [ 53.796730] seg6_do_srh_encap+0x284/0x620 [ 53.796741] ? seg6_do_srh+0x29b/0x360 [ 53.796747] seg6_do_srh+0x29b/0x360 [ 53.796756] seg6_input+0x2e/0x2e0 [ 53.796765] lwtunnel_input+0x93/0xd0 [ 53.796774] ipv6_rcv+0x690/0x920 [ 53.796783] ? ip6_input+0x170/0x170 [ 53.796791] ? eth_gro_receive+0x2d0/0x2d0 [ 53.796800] ? ip6_input+0x170/0x170 [ 53.796809] __netif_receive_skb_core+0xcc0/0x13f0 [ 53.796820] ? netdev_info+0x110/0x110 [ 53.796827] ? napi_complete_done+0xb6/0x170 [ 53.796834] ? e1000_clean+0x6da/0xf70 [ 53.796845] ? process_backlog+0x129/0x2a0 [ 53.796853] process_backlog+0x129/0x2a0 [ 53.796862] net_rx_action+0x211/0x5c0 [ 53.796870] ? napi_complete_done+0x170/0x170 [ 53.796887] ? run_rebalance_domains+0x11f/0x150 [ 53.796891] __do_softirq+0x10e/0x39e [ 53.796894] do_softirq_own_stack+0x2a/0x40 [ 53.796895] </IRQ> [ 53.796898] do_softirq.part.16+0x54/0x60 [ 53.796900] __local_bh_enable_ip+0x5b/0x60 [ 53.796903] ip6_finish_output2+0x416/0x9f0 [ 53.796906] ? ip6_dst_lookup_flow+0x110/0x110 [ 53.796909] ? ip6_sk_dst_lookup_flow+0x390/0x390 [ 53.796911] ? __rcu_read_unlock+0x66/0x80 [ 53.796913] ? ip6_mtu+0x44/0xf0 [ 53.796916] ? ip6_output+0xfc/0x220 [ 53.796918] ip6_output+0xfc/0x220 [ 53.796921] ? ip6_finish_output+0x2b0/0x2b0 [ 53.796923] ? memcpy+0x34/0x50 [ 53.796926] ip6_send_skb+0x43/0xc0 [ 53.796929] rawv6_sendmsg+0x1216/0x1530 [ 53.796932] ? __orc_find+0x6b/0xc0 [ 53.796934] ? rawv6_rcv_skb+0x160/0x160 [ 53.796937] ? __rcu_read_unlock+0x66/0x80 [ 53.796939] ? __rcu_read_unlock+0x66/0x80 [ 53.796942] ? is_bpf_text_address+0x1e/0x30 [ 53.796944] ? kernel_text_address+0xec/0x100 [ 53.796946] ? __kernel_text_address+0xe/0x30 [ 53.796948] ? unwind_get_return_address+0x2f/0x50 [ 53.796950] ? __save_stack_trace+0x92/0x100 [ 53.796954] ? save_stack+0x89/0xb0 [ 53.796956] ? kasan_kmalloc+0xa0/0xd0 [ 53.796958] ? kmem_cache_alloc+0xd2/0x1f0 [ 53.796961] ? prepare_creds+0x23/0x160 [ 53.796963] ? __x64_sys_capset+0x252/0x3e0 [ 53.796966] ? do_syscall_64+0x69/0x160 [ 53.796968] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 53.796971] ? __alloc_pages_nodemask+0x170/0x380 [ 53.796973] ? __alloc_pages_slowpath+0x12c0/0x12c0 [ 53.796977] ? tty_vhangup+0x20/0x20 [ 53.796979] ? policy_nodemask+0x1a/0x90 [ 53.796982] ? __mod_node_page_state+0x8d/0xa0 [ 53.796986] ? __check_object_size+0xe7/0x240 [ 53.796989] ? __sys_sendto+0x229/0x290 [ 53.796991] ? rawv6_rcv_skb+0x160/0x160 [ 53.796993] __sys_sendto+0x229/0x290 [ 53.796996] ? __ia32_sys_getpeername+0x50/0x50 [ 53.796999] ? commit_creds+0x2de/0x520 [ 53.797002] ? security_capset+0x57/0x70 [ 53.797004] ? __x64_sys_capset+0x29f/0x3e0 [ 53.797007] ? __x64_sys_rt_sigsuspend+0xe0/0xe0 [ 53.797011] ? __do_page_fault+0x664/0x770 [ 53.797014] __x64_sys_sendto+0x74/0x90 [ 53.797017] do_syscall_64+0x69/0x160 [ 53.797019] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 53.797022] RIP: 0033:0x7f43b7a6714a [ 53.797023] RSP: 002b:00007ffd891bd368 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 53.797026] RAX: ffffffffffffffda RBX: 00000000006129c0 RCX: 00007f43b7a6714a [ 53.797028] RDX: 0000000000000040 RSI: 00000000006129c0 RDI: 0000000000000004 [ 53.797029] RBP: 00007ffd891be640 R08: 0000000000610940 R09: 000000000000001c [ 53.797030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 53.797032] R13: 000000000060e6a0 R14: 0000000000008004 R15: 000000000040b661 [ 53.797171] Allocated by task 642: [ 53.797460] kasan_kmalloc+0xa0/0xd0 [ 53.797463] kmem_cache_alloc+0xd2/0x1f0 [ 53.797465] getname_flags+0x40/0x210 [ 53.797467] user_path_at_empty+0x1d/0x40 [ 53.797469] do_faccessat+0x12a/0x320 [ 53.797471] do_syscall_64+0x69/0x160 [ 53.797473] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 53.797607] Freed by task 642: [ 53.797869] __kasan_slab_free+0x130/0x180 [ 53.797871] kmem_cache_free+0xa8/0x230 [ 53.797872] filename_lookup+0x15b/0x230 [ 53.797874] do_faccessat+0x12a/0x320 [ 53.797876] do_syscall_64+0x69/0x160 [ 53.797878] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 53.798014] The buggy address belongs to the object at ffff88011975e600 which belongs to the cache names_cache of size 4096 [ 53.799043] The buggy address is located 1786 bytes inside of 4096-byte region [ffff88011975e600, ffff88011975f600) [ 53.800013] The buggy address belongs to the page: [ 53.800414] page:ffffea000465d600 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0 [ 53.801259] flags: 0x17fff0000008100(slab|head) [ 53.801640] raw: 017fff0000008100 0000000000000000 0000000000000000 0000000100070007 [ 53.803147] raw: dead000000000100 dead000000000200 ffff88011b185a40 0000000000000000 [ 53.803787] page dumped because: kasan: bad access detected [ 53.804384] Memory state around the buggy address: [ 53.804788] ffff88011975eb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.805384] ffff88011975ec00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.805979] >ffff88011975ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.806577] ^ [ 53.807165] ffff88011975ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.807762] ffff88011975ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.808356] ================================================================== [ 53.808949] Disabling lock debugging due to kernel taint Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels") Signed-off-by: David Lebrun <dlebrun@google.com> Signed-off-by: Mathieu Xhonneux <m.xhonneux@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 513acc5
File | Mode | Size |
---|---|---|
netfilter | ||
Kconfig | -rw-r--r-- | 25.6 KB |
Makefile | -rw-r--r-- | 2.7 KB |
af_inet.c | -rw-r--r-- | 50.0 KB |
ah4.c | -rw-r--r-- | 13.6 KB |
arp.c | -rw-r--r-- | 36.0 KB |
cipso_ipv4.c | -rw-r--r-- | 61.2 KB |
datagram.c | -rw-r--r-- | 3.2 KB |
devinet.c | -rw-r--r-- | 61.9 KB |
esp4.c | -rw-r--r-- | 23.8 KB |
esp4_offload.c | -rw-r--r-- | 6.4 KB |
fib_frontend.c | -rw-r--r-- | 32.7 KB |
fib_lookup.h | -rw-r--r-- | 1.5 KB |
fib_notifier.c | -rw-r--r-- | 1.6 KB |
fib_rules.c | -rw-r--r-- | 9.6 KB |
fib_semantics.c | -rw-r--r-- | 42.1 KB |
fib_trie.c | -rw-r--r-- | 66.6 KB |
fou.c | -rw-r--r-- | 23.4 KB |
gre_demux.c | -rw-r--r-- | 4.3 KB |
gre_offload.c | -rw-r--r-- | 7.0 KB |
icmp.c | -rw-r--r-- | 29.8 KB |
igmp.c | -rw-r--r-- | 72.9 KB |
inet_connection_sock.c | -rw-r--r-- | 30.6 KB |
inet_diag.c | -rw-r--r-- | 31.2 KB |
inet_fragment.c | -rw-r--r-- | 5.4 KB |
inet_hashtables.c | -rw-r--r-- | 21.7 KB |
inet_timewait_sock.c | -rw-r--r-- | 8.8 KB |
inetpeer.c | -rw-r--r-- | 8.3 KB |
ip_forward.c | -rw-r--r-- | 3.9 KB |
ip_fragment.c | -rw-r--r-- | 20.7 KB |
ip_gre.c | -rw-r--r-- | 44.5 KB |
ip_input.c | -rw-r--r-- | 14.6 KB |
ip_options.c | -rw-r--r-- | 15.0 KB |
ip_output.c | -rw-r--r-- | 39.0 KB |
ip_sockglue.c | -rw-r--r-- | 36.3 KB |
ip_tunnel.c | -rw-r--r-- | 28.9 KB |
ip_tunnel_core.c | -rw-r--r-- | 12.0 KB |
ip_vti.c | -rw-r--r-- | 14.9 KB |
ipcomp.c | -rw-r--r-- | 4.6 KB |
ipconfig.c | -rw-r--r-- | 38.8 KB |
ipip.c | -rw-r--r-- | 18.8 KB |
ipmr.c | -rw-r--r-- | 72.8 KB |
ipmr_base.c | -rw-r--r-- | 8.6 KB |
netfilter.c | -rw-r--r-- | 4.4 KB |
ping.c | -rw-r--r-- | 29.1 KB |
proc.c | -rw-r--r-- | 20.3 KB |
protocol.c | -rw-r--r-- | 2.3 KB |
raw.c | -rw-r--r-- | 27.1 KB |
raw_diag.c | -rw-r--r-- | 6.4 KB |
route.c | -rw-r--r-- | 76.6 KB |
syncookies.c | -rw-r--r-- | 11.7 KB |
sysctl_net_ipv4.c | -rw-r--r-- | 30.4 KB |
tcp.c | -rw-r--r-- | 94.9 KB |
tcp_bbr.c | -rw-r--r-- | 34.1 KB |
tcp_bic.c | -rw-r--r-- | 5.9 KB |
tcp_cdg.c | -rw-r--r-- | 11.1 KB |
tcp_cong.c | -rw-r--r-- | 11.5 KB |
tcp_cubic.c | -rw-r--r-- | 14.5 KB |
tcp_dctcp.c | -rw-r--r-- | 9.7 KB |
tcp_diag.c | -rw-r--r-- | 4.6 KB |
tcp_fastopen.c | -rw-r--r-- | 15.4 KB |
tcp_highspeed.c | -rw-r--r-- | 4.9 KB |
tcp_htcp.c | -rw-r--r-- | 7.4 KB |
tcp_hybla.c | -rw-r--r-- | 4.9 KB |
tcp_illinois.c | -rw-r--r-- | 8.3 KB |
tcp_input.c | -rw-r--r-- | 180.5 KB |
tcp_ipv4.c | -rw-r--r-- | 66.9 KB |
tcp_lp.c | -rw-r--r-- | 8.8 KB |
tcp_metrics.c | -rw-r--r-- | 26.8 KB |
tcp_minisocks.c | -rw-r--r-- | 26.8 KB |
tcp_nv.c | -rw-r--r-- | 15.6 KB |
tcp_offload.c | -rw-r--r-- | 8.2 KB |
tcp_output.c | -rw-r--r-- | 107.9 KB |
tcp_rate.c | -rw-r--r-- | 7.6 KB |
tcp_recovery.c | -rw-r--r-- | 6.6 KB |
tcp_scalable.c | -rw-r--r-- | 1.4 KB |
tcp_timer.c | -rw-r--r-- | 20.5 KB |
tcp_ulp.c | -rw-r--r-- | 3.6 KB |
tcp_vegas.c | -rw-r--r-- | 9.6 KB |
tcp_vegas.h | -rw-r--r-- | 940 bytes |
tcp_veno.c | -rw-r--r-- | 5.7 KB |
tcp_westwood.c | -rw-r--r-- | 8.2 KB |
tcp_yeah.c | -rw-r--r-- | 6.9 KB |
tunnel4.c | -rw-r--r-- | 5.4 KB |
udp.c | -rw-r--r-- | 73.1 KB |
udp_diag.c | -rw-r--r-- | 7.5 KB |
udp_impl.h | -rw-r--r-- | 1.2 KB |
udp_offload.c | -rw-r--r-- | 10.1 KB |
udp_tunnel.c | -rw-r--r-- | 5.4 KB |
udplite.c | -rw-r--r-- | 3.3 KB |
xfrm4_input.c | -rw-r--r-- | 4.3 KB |
xfrm4_mode_beet.c | -rw-r--r-- | 3.7 KB |
xfrm4_mode_transport.c | -rw-r--r-- | 3.1 KB |
xfrm4_mode_tunnel.c | -rw-r--r-- | 3.8 KB |
xfrm4_output.c | -rw-r--r-- | 2.7 KB |
xfrm4_policy.c | -rw-r--r-- | 8.6 KB |
xfrm4_protocol.c | -rw-r--r-- | 6.6 KB |
xfrm4_state.c | -rw-r--r-- | 2.4 KB |
xfrm4_tunnel.c | -rw-r--r-- | 2.7 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...