Eric Dumazet
888934af18
net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link()
[ Upstream commit d836f5c69d ]
rtnl_create_link() needs to apply dev->min_mtu and dev->max_mtu
checks that we apply in do_setlink()
Otherwise malicious users can crash the kernel, for example after
an integer overflow :
BUG: KASAN: use-after-free in memset include/linux/string.h:365 [inline]
BUG: KASAN: use-after-free in __alloc_skb+0x37b/0x5e0 net/core/skbuff.c:238
Write of size 32 at addr ffff88819f20b9c0 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
__kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:639
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192
memset+0x24/0x40 mm/kasan/common.c:108
memset include/linux/string.h:365 [inline]
__alloc_skb+0x37b/0x5e0 net/core/skbuff.c:238
alloc_skb include/linux/skbuff.h:1049 [inline]
alloc_skb_with_frags+0x93/0x590 net/core/skbuff.c:5664
sock_alloc_send_pskb+0x7ad/0x920 net/core/sock.c:2242
sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2259
mld_newpack+0x1d7/0x7f0 net/ipv6/mcast.c:1609
add_grhead.isra.0+0x299/0x370 net/ipv6/mcast.c:1713
add_grec+0x7db/0x10b0 net/ipv6/mcast.c:1844
mld_send_cr net/ipv6/mcast.c:1970 [inline]
mld_ifc_timer_expire+0x3d3/0x950 net/ipv6/mcast.c:2477
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786
__do_softirq+0x262/0x98c kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x19b/0x1e0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
</IRQ>
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
Code: 98 6b ea f9 eb 8a cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d 44 1c 60 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 34 1c 60 00 fb f4 <c3> cc 55 48 89 e5 41 57 41 56 41 55 41 54 53 e8 4e 5d 9a f9 e8 79
RSP: 0018:ffffffff89807ce8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13266ae RBX: ffffffff8987a1c0 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffffffff8987aa54
RBP: ffffffff89807d18 R08: ffffffff8987a1c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffffff8a799980 R14: 0000000000000000 R15: 0000000000000000
arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
default_idle_call+0x84/0xb0 kernel/sched/idle.c:94
cpuidle_idle_call kernel/sched/idle.c:154 [inline]
do_idle+0x3c8/0x6e0 kernel/sched/idle.c:269
cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
rest_init+0x23b/0x371 init/main.c:451
arch_call_rest_init+0xe/0x1b
start_kernel+0x904/0x943 init/main.c:784
x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:471
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242
The buggy address belongs to the page:
page:ffffea00067c82c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
raw: 057ffe0000000000 ffffea00067c82c8 ffffea00067c82c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88819f20b880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88819f20b900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88819f20b980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88819f20ba00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88819f20ba80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Fixes: 61e84623ac ("net: centralize net_device min/max MTU checking")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-29 16:45:21 +01:00
..
2020-01-14 20:08:28 +01:00
2019-09-16 12:06:23 +02:00
2019-09-17 10:27:46 -07:00
2019-10-02 12:19:53 -04:00
2019-09-18 11:14:31 -07:00
2019-10-15 01:18:46 +02:00
2019-08-28 17:24:22 +02:00
2019-09-19 14:14:28 -07:00
2019-09-16 09:56:27 -07:00
2019-08-20 10:35:46 +01:00
2019-09-17 00:40:05 -05:00
2019-12-17 19:56:49 +01:00
2019-10-29 16:27:17 -07:00
2020-01-26 10:01:07 +01:00
2019-09-21 10:59:54 -07:00
2019-09-13 12:47:36 +02:00
2019-09-13 12:47:36 +02:00
2019-09-13 12:47:36 +02:00
2019-09-13 12:47:36 +02:00
2019-09-13 12:47:36 +02:00
2019-08-23 11:09:41 +02:00
2019-10-14 13:33:44 +05:30
2019-09-21 10:26:24 -07:00
2020-01-23 08:23:00 +01:00
2019-12-31 16:46:06 +01:00
2019-09-19 16:24:24 -07:00
2019-09-04 14:57:28 +05:30
2019-10-30 12:04:35 -04:00
2019-09-18 10:33:46 -07:00
2019-09-28 08:14:15 -07:00
2020-01-09 10:19:59 +01:00
2019-08-20 22:09:52 +02:00
2019-08-30 21:29:32 -04:00
2019-08-27 09:22:38 -06:00
2019-08-27 09:22:38 -06:00
2019-09-02 15:55:03 +01:00
2020-01-09 10:19:54 +01:00
2019-10-14 15:04:01 -07:00
2019-10-01 15:45:03 +02:00
2019-08-28 21:17:12 -06:00
2019-08-28 21:17:04 -06:00
2019-09-05 19:52:34 -06:00
2020-01-23 08:22:32 +01:00
2019-08-28 00:30:11 +02:00
2019-10-31 21:41:33 +01:00
2019-09-05 10:15:16 +02:00
2019-09-19 15:31:27 -07:00
2019-09-20 15:45:07 -07:00
2019-09-24 15:54:10 -07:00
2019-11-29 10:10:08 +01:00
2019-10-11 09:26:05 -07:00
2019-09-21 09:47:19 -07:00
2019-09-08 14:53:58 +02:00
2019-09-04 13:38:26 +02:00
2019-11-04 12:22:02 +01:00
2019-12-31 16:46:06 +01:00
2019-09-03 09:36:36 +02:00
2019-09-17 19:15:14 -07:00
2019-09-25 17:51:40 -07:00
2019-09-23 11:21:04 -07:00
2019-08-25 12:44:38 +09:00
2019-09-18 10:33:46 -07:00
2019-08-13 09:09:30 +02:00
2019-08-21 07:14:10 +09:00
2020-01-04 19:17:24 +01:00
2019-08-17 18:46:33 +01:00
2020-01-04 19:17:00 +01:00
2019-08-29 16:43:22 +02:00
2019-08-16 12:40:58 +01:00
2020-01-09 10:19:58 +01:00
2019-10-22 12:54:44 -07:00
2019-09-03 19:21:19 +02:00
2019-10-31 09:40:19 +01:00
2019-09-05 19:52:33 -06:00
2019-10-18 15:32:52 +02:00
2019-08-21 22:23:48 +10:00
2019-08-23 07:57:13 -07:00
2019-10-22 11:26:09 -07:00
2019-09-25 09:55:59 -07:00
2019-12-17 19:55:30 +01:00
2019-08-12 19:18:50 -07:00
2019-08-19 11:00:39 -04:00
2019-08-12 19:33:50 -07:00
2019-11-29 10:10:13 +01:00
2019-08-26 11:40:24 +02:00
2019-10-28 16:17:31 -07:00
2019-09-05 11:40:54 +02:00
2019-08-27 19:02:59 +02:00
2019-09-18 15:58:13 +02:00
2019-08-20 09:35:02 -03:00
2020-01-04 19:18:41 +01:00
2019-09-29 10:33:41 -07:00
2019-09-24 15:54:08 -07:00
2019-10-02 06:36:50 -07:00
2019-09-24 12:36:31 -07:00
2019-09-24 16:48:02 -07:00
2019-09-03 11:33:29 +02:00
2019-11-08 08:46:49 -08:00
2020-01-12 12:21:46 +01:00
2019-10-24 14:53:49 -07:00
2019-10-24 14:53:48 -07:00
2019-10-24 14:53:49 -07:00
2019-09-28 08:14:15 -07:00
2019-08-28 11:50:33 +02:00
2019-08-20 12:04:07 -07:00
2019-11-11 16:10:54 +01:00
2019-08-13 23:02:48 +03:00
2019-08-13 23:02:44 +03:00
2019-09-17 19:15:14 -07:00
2019-09-25 17:51:39 -07:00
2019-08-30 16:12:10 +02:00
2019-09-19 15:32:45 -07:00
2019-08-23 10:09:58 +02:00
2019-08-20 09:39:41 -03:00
2019-12-31 16:44:14 +01:00
2019-12-13 08:42:53 +01:00
2019-09-07 04:28:05 -03:00
2019-12-13 08:42:53 +01:00
2019-09-28 08:14:15 -07:00
2019-09-02 11:43:54 +01:00
2019-09-25 17:51:40 -07:00
2019-09-24 15:54:11 -07:00
2019-11-12 13:19:15 -08:00
2019-10-08 22:05:58 +02:00
2020-01-09 10:19:59 +01:00
2020-01-04 19:18:28 +01:00
2019-08-29 13:49:13 -07:00
2019-08-13 14:54:24 +08:00
2019-09-28 08:14:15 -07:00
2019-09-05 12:32:05 +02:00
2019-10-07 15:47:20 -07:00
2020-01-09 10:19:56 +01:00
2019-11-15 18:34:00 -08:00
2019-09-28 14:05:38 -07:00
2019-09-29 10:33:41 -07:00
2019-10-17 16:31:52 -07:00
2019-08-20 09:35:03 -03:00
2019-10-04 18:11:08 -07:00
2019-12-13 08:43:18 +01:00
2019-09-25 17:51:40 -07:00
2019-11-06 08:28:58 -08:00
2020-01-23 08:22:40 +01:00
2019-09-07 04:28:04 -03:00
2020-01-23 08:22:39 +01:00
2019-12-31 16:41:16 +01:00
2019-09-27 19:37:27 -07:00
2019-08-14 15:30:35 +02:00
2019-09-03 09:30:45 -04:00
2020-01-29 16:45:21 +01:00
2019-09-13 12:35:33 +02:00
2019-09-13 12:35:33 +02:00
2019-09-13 12:47:36 +02:00
2019-09-20 15:15:24 -04:00
2020-01-09 10:19:41 +01:00
2019-12-31 16:44:40 +01:00
2019-12-31 16:44:43 +01:00
2019-09-11 14:46:02 +01:00
2019-09-13 21:15:41 +10:00
2019-10-14 15:04:00 -07:00
2019-11-06 08:28:58 -08:00
2019-09-24 15:54:08 -07:00
2019-09-07 04:28:04 -03:00
2019-08-28 15:25:53 -05:00
2019-09-23 19:16:01 -07:00
2019-08-16 08:41:26 -05:00
2020-01-09 10:19:53 +01:00
2019-10-28 11:02:01 +01:00
2019-09-05 11:54:14 +02:00
2019-12-31 16:41:26 +01:00
2019-10-07 12:52:44 +02:00
2019-12-21 11:04:31 +01:00
2019-08-21 00:20:40 +02:00
2020-01-04 19:18:48 +01:00
2019-09-05 21:16:22 +02:00
2019-09-25 17:51:39 -07:00
2019-08-26 11:35:13 +02:00
2019-09-21 03:25:10 +02:00
2020-01-04 19:17:25 +01:00
2019-12-17 19:56:43 +01:00
2019-11-01 22:26:34 -04:00
2019-09-12 21:05:34 -04:00
2019-08-23 16:39:26 +01:00
2019-09-25 17:51:39 -07:00
2019-08-13 14:35:49 -07:00
2020-01-04 19:19:13 +01:00
2019-09-16 17:25:49 -07:00
2019-08-26 16:27:01 -07:00
2019-09-25 17:42:29 +02:00
2019-10-28 12:18:23 +01:00
2019-10-24 10:26:33 +02:00
2019-09-16 11:43:38 -05:00
2019-11-29 10:10:13 +01:00
2019-08-12 12:23:02 +01:00
2019-10-31 09:40:21 +01:00
2019-09-12 21:05:34 -04:00
2019-09-24 15:54:11 -07:00
2019-08-19 06:34:13 -05:00
2020-01-04 19:18:39 +01:00
2020-01-23 08:22:45 +01:00
2019-10-07 15:47:20 -07:00
2019-10-31 14:01:40 -07:00
2019-08-19 13:14:53 -03:00
2019-09-11 15:27:09 +01:00
2019-10-08 13:27:05 +02:00
2019-09-25 17:51:41 -07:00
2019-09-11 12:34:29 +02:00
2019-09-07 21:42:25 +02:00
2019-10-02 10:06:45 +02:00
2019-09-17 20:03:49 -06:00
2019-10-13 10:13:08 -07:00
2020-01-04 19:18:42 +01:00
2019-08-26 12:15:06 +03:00
2019-08-30 07:27:17 -07:00
2019-12-18 16:08:43 +01:00
2019-08-23 02:12:11 +02:00
2019-08-28 11:50:43 +02:00
2020-01-23 08:22:44 +01:00
2019-09-16 17:25:49 -07:00
2019-10-07 15:24:36 +02:00
2019-08-31 06:51:49 -04:00
2020-01-17 19:48:40 +01:00
2019-08-21 10:03:35 -07:00
2019-08-14 01:10:42 +09:00
2019-10-28 04:25:04 -04:00
2019-09-24 15:54:10 -07:00
2019-09-04 14:34:31 +02:00
2019-09-17 12:35:15 -07:00
2019-09-13 21:15:39 +10:00
2019-08-27 09:22:38 -06:00
2019-10-14 15:04:01 -07:00
2019-09-24 15:54:12 -07:00