Eric Dumazet
74165c1ca3
macvlan: do not assume mac_header is set in macvlan_broadcast()
[ Upstream commit 96cc4b6958 ]
Use of eth_hdr() in tx path is error prone.
Many drivers call skb_reset_mac_header() before using it,
but others do not.
Commit 6d1ccff627 ("net: reset mac header in dev_start_xmit()")
attempted to fix this generically, but commit d346a3fae3
("packet: introduce PACKET_QDISC_BYPASS socket option") brought
back the macvlan bug.
Lets add a new helper, so that tx paths no longer have
to call skb_reset_mac_header() only to get a pointer
to skb->data.
Hopefully we will be able to revert 6d1ccff627
("net: reset mac header in dev_start_xmit()") and save few cycles
in transmit fast path.
BUG: KASAN: use-after-free in __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
BUG: KASAN: use-after-free in mc_hash drivers/net/macvlan.c:251 [inline]
BUG: KASAN: use-after-free in macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
Read of size 4 at addr ffff8880a4932401 by task syz-executor947/9579
CPU: 0 PID: 9579 Comm: syz-executor947 Not tainted 5.5.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
__kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:639
__asan_report_load_n_noabort+0xf/0x20 mm/kasan/generic_report.c:145
__get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
mc_hash drivers/net/macvlan.c:251 [inline]
macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
macvlan_queue_xmit drivers/net/macvlan.c:520 [inline]
macvlan_start_xmit+0x402/0x77f drivers/net/macvlan.c:559
__netdev_start_xmit include/linux/netdevice.h:4447 [inline]
netdev_start_xmit include/linux/netdevice.h:4461 [inline]
dev_direct_xmit+0x419/0x630 net/core/dev.c:4079
packet_direct_xmit+0x1a9/0x250 net/packet/af_packet.c:240
packet_snd net/packet/af_packet.c:2966 [inline]
packet_sendmsg+0x260d/0x6220 net/packet/af_packet.c:2991
sock_sendmsg_nosec net/socket.c:639 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:659
__sys_sendto+0x262/0x380 net/socket.c:1985
__do_sys_sendto net/socket.c:1997 [inline]
__se_sys_sendto net/socket.c:1993 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1993
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x442639
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc13549e08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442639
RDX: 000000000000000e RSI: 0000000020000080 RDI: 0000000000000003
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000403bb0 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 9389:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527
__do_kmalloc mm/slab.c:3656 [inline]
__kmalloc+0x163/0x770 mm/slab.c:3665
kmalloc include/linux/slab.h:561 [inline]
tomoyo_realpath_from_path+0xc5/0x660 security/tomoyo/realpath.c:252
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
security_inode_getattr+0xf2/0x150 security/security.c:1222
vfs_getattr+0x25/0x70 fs/stat.c:115
vfs_statx_fd+0x71/0xc0 fs/stat.c:145
vfs_fstat include/linux/fs.h:3265 [inline]
__do_sys_newfstat+0x9b/0x120 fs/stat.c:378
__se_sys_newfstat fs/stat.c:375 [inline]
__x64_sys_newfstat+0x54/0x80 fs/stat.c:375
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 9389:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
__cache_free mm/slab.c:3426 [inline]
kfree+0x10a/0x2c0 mm/slab.c:3757
tomoyo_realpath_from_path+0x1a7/0x660 security/tomoyo/realpath.c:289
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
security_inode_getattr+0xf2/0x150 security/security.c:1222
vfs_getattr+0x25/0x70 fs/stat.c:115
vfs_statx_fd+0x71/0xc0 fs/stat.c:145
vfs_fstat include/linux/fs.h:3265 [inline]
__do_sys_newfstat+0x9b/0x120 fs/stat.c:378
__se_sys_newfstat fs/stat.c:375 [inline]
__x64_sys_newfstat+0x54/0x80 fs/stat.c:375
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8880a4932000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1025 bytes inside of
4096-byte region [ffff8880a4932000, ffff8880a4933000)
The buggy address belongs to the page:
page:ffffea0002924c80 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0
raw: 00fffe0000010200 ffffea0002846208 ffffea00028f3888 ffff8880aa402000
raw: 0000000000000000 ffff8880a4932000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a4932300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a4932380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880a4932400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a4932480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a4932500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Fixes: b863ceb7dd ("[NET]: Add macvlan driver")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-12 12:21:46 +01:00
..
2019-11-13 10:42:33 +01:00
2019-09-16 12:06:23 +02:00
2019-09-17 10:27:46 -07:00
2019-10-02 12:19:53 -04:00
2019-09-18 11:14:31 -07:00
2019-10-15 01:18:46 +02:00
2019-09-19 14:14:28 -07:00
2019-09-16 09:56:27 -07:00
2019-09-17 00:40:05 -05:00
2019-12-17 19:56:49 +01:00
2019-10-29 16:27:17 -07:00
2019-12-21 11:04:24 +01:00
2019-09-21 10:59:54 -07:00
2019-09-13 12:47:36 +02:00
2019-09-13 12:47:36 +02:00
2019-09-13 12:47:36 +02:00
2019-09-13 12:47:36 +02:00
2019-09-13 12:47:36 +02:00
2019-10-14 13:33:44 +05:30
2019-09-21 10:26:24 -07:00
2020-01-09 10:20:04 +01:00
2019-12-31 16:46:06 +01:00
2019-09-19 16:24:24 -07:00
2019-10-30 12:04:35 -04:00
2019-09-18 10:33:46 -07:00
2019-09-28 08:14:15 -07:00
2020-01-09 10:19:59 +01:00
2020-01-09 10:19:54 +01:00
2019-10-14 15:04:01 -07:00
2019-10-01 15:45:03 +02:00
2019-09-24 16:31:50 -07:00
2019-10-31 21:41:33 +01:00
2019-09-19 15:31:27 -07:00
2019-09-20 15:45:07 -07:00
2019-09-24 15:54:10 -07:00
2019-11-29 10:10:08 +01:00
2019-10-11 09:26:05 -07:00
2019-09-21 09:47:19 -07:00
2019-09-08 14:53:58 +02:00
2019-11-04 12:22:02 +01:00
2019-12-31 16:46:06 +01:00
2019-09-17 19:15:14 -07:00
2019-09-25 17:51:40 -07:00
2019-09-23 11:21:04 -07:00
2019-09-18 10:33:46 -07:00
2020-01-04 19:17:24 +01:00
2020-01-04 19:17:00 +01:00
2020-01-09 10:19:58 +01:00
2019-10-22 12:54:44 -07:00
2019-10-31 09:40:19 +01:00
2019-10-18 15:32:52 +02:00
2019-10-22 11:26:09 -07:00
2019-09-25 09:55:59 -07:00
2019-12-17 19:55:30 +01:00
2019-11-29 10:10:13 +01:00
2019-10-28 16:17:31 -07:00
2019-09-18 15:58:13 +02:00
2020-01-04 19:18:41 +01:00
2019-09-29 10:33:41 -07:00
2019-09-24 15:54:08 -07:00
2019-10-02 06:36:50 -07:00
2019-09-24 12:36:31 -07:00
2019-09-24 16:48:02 -07:00
2019-11-08 08:46:49 -08:00
2020-01-12 12:21:46 +01:00
2019-10-24 14:53:49 -07:00
2019-10-24 14:53:48 -07:00
2019-10-24 14:53:49 -07:00
2019-09-28 08:14:15 -07:00
2019-11-11 16:10:54 +01:00
2019-09-17 19:15:14 -07:00
2019-09-25 17:51:39 -07:00
2019-09-19 15:32:45 -07:00
2019-12-31 16:44:14 +01:00
2019-12-13 08:42:53 +01:00
2019-09-07 04:28:05 -03:00
2019-12-13 08:42:53 +01:00
2019-09-28 08:14:15 -07:00
2019-09-25 17:51:40 -07:00
2019-09-24 15:54:11 -07:00
2019-11-12 13:19:15 -08:00
2019-10-08 22:05:58 +02:00
2020-01-09 10:19:59 +01:00
2020-01-04 19:18:28 +01:00
2019-09-28 08:14:15 -07:00
2019-10-07 15:47:20 -07:00
2020-01-09 10:19:56 +01:00
2019-11-15 18:34:00 -08:00
2019-09-28 14:05:38 -07:00
2019-09-29 10:33:41 -07:00
2019-10-17 16:31:52 -07:00
2019-10-04 18:11:08 -07:00
2019-12-13 08:43:18 +01:00
2019-09-25 17:51:40 -07:00
2019-11-06 08:28:58 -08:00
2019-11-06 08:28:58 -08:00
2019-09-07 04:28:04 -03:00
2019-09-24 15:54:11 -07:00
2019-12-31 16:41:16 +01:00
2019-09-27 19:37:27 -07:00
2019-12-18 16:08:17 +01:00
2019-09-13 12:35:33 +02:00
2019-09-13 12:35:33 +02:00
2019-09-13 12:47:36 +02:00
2019-09-20 15:15:24 -04:00
2020-01-09 10:19:41 +01:00
2019-12-31 16:44:40 +01:00
2019-12-31 16:44:43 +01:00
2019-09-11 14:46:02 +01:00
2019-09-13 21:15:41 +10:00
2019-10-14 15:04:00 -07:00
2019-11-06 08:28:58 -08:00
2019-09-24 15:54:08 -07:00
2019-09-07 04:28:04 -03:00
2019-09-23 19:16:01 -07:00
2020-01-09 10:19:53 +01:00
2019-10-28 11:02:01 +01:00
2019-12-31 16:41:26 +01:00
2019-10-07 12:52:44 +02:00
2019-12-21 11:04:31 +01:00
2020-01-04 19:18:48 +01:00
2019-09-25 17:51:39 -07:00
2019-09-21 03:25:10 +02:00
2020-01-04 19:17:25 +01:00
2019-12-17 19:56:43 +01:00
2019-11-01 22:26:34 -04:00
2019-09-12 21:05:34 -04:00
2019-09-25 17:51:39 -07:00
2020-01-04 19:19:13 +01:00
2019-09-16 17:25:49 -07:00
2019-09-25 17:42:29 +02:00
2019-10-28 12:18:23 +01:00
2019-10-24 10:26:33 +02:00
2019-09-16 11:43:38 -05:00
2019-11-29 10:10:13 +01:00
2019-10-31 09:40:21 +01:00
2019-09-12 21:05:34 -04:00
2019-09-24 15:54:11 -07:00
2020-01-04 19:18:39 +01:00
2019-12-04 22:31:01 +01:00
2019-10-07 15:47:20 -07:00
2019-10-31 14:01:40 -07:00
2019-09-11 15:27:09 +01:00
2019-10-08 13:27:05 +02:00
2019-09-25 17:51:41 -07:00
2019-09-11 12:34:29 +02:00
2019-09-07 21:42:25 +02:00
2019-10-02 10:06:45 +02:00
2019-09-17 20:03:49 -06:00
2019-10-13 10:13:08 -07:00
2020-01-04 19:18:42 +01:00
2019-12-18 16:08:43 +01:00
2019-09-16 17:25:49 -07:00
2019-10-07 15:24:36 +02:00
2019-10-07 12:56:48 -07:00
2019-10-28 04:25:04 -04:00
2019-09-24 15:54:10 -07:00
2019-09-17 12:35:15 -07:00
2019-09-13 21:15:39 +10:00
2019-10-14 15:04:01 -07:00
2019-09-24 15:54:12 -07:00