
Denis ArefevandMichael S. Tsirkin
e269d79c7d
net: missing check virtio
Two missing check in virtio_net_hdr_to_skb() allowed syzbot
to crash kernels again
1. After the skb_segment function the buffer may become non-linear
(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere
the __skb_linearize function will not be executed, then the buffer will
remain non-linear. Then the condition (offset >= skb_headlen(skb))
becomes true, which causes WARN_ON_ONCE in skb_checksum_help.
2. The struct sk_buff and struct virtio_net_hdr members must be
mathematically related.
(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE.
(remainder) must be greater than (needed) otherwise WARN_ON_ONCE.
(remainder) may be 0 if division is without remainder.
offset+2 (4191) > skb_headlen() (1116)
WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303
Modules linked in:
CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0
Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303
Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef
RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209
RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001
RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c
R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d
FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777
ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584
ip_finish_output_gso net/ipv4/ip_output.c:286 [inline]
__ip_finish_output net/ipv4/ip_output.c:308 [inline]
__ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295
ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433
dst_output include/net/dst.h:451 [inline]
ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129
iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82
ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline]
sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076
__netdev_start_xmit include/linux/netdevice.h:4940 [inline]
netdev_start_xmit include/linux/netdevice.h:4954 [inline]
xmit_one net/core/dev.c:3545 [inline]
dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561
__dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346
dev_queue_xmit include/linux/netdevice.h:3134 [inline]
packet_xmit+0x257/0x380 net/packet/af_packet.c:276
packet_snd net/packet/af_packet.c:3087 [inline]
packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
__sys_sendto+0x255/0x340 net/socket.c:2190
__do_sys_sendto net/socket.c:2202 [inline]
__se_sys_sendto net/socket.c:2198 [inline]
__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Found by Linux Verification Center (linuxtesting.org) with Syzkaller
Fixes: 0f6925b3e8 ("virtio_net: Do not pull payload in skb->head")
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Message-Id: <20240613095448.27118-1-arefev@swemel.ru>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-04 11:00:31 -04:00
..
2024-06-05 15:52:34 +02:00
2024-05-15 10:02:36 -07:00
2024-05-14 15:07:07 -07:00
2024-05-03 11:48:56 +01:00
2024-05-22 12:26:46 -07:00
2024-05-24 13:27:07 +01:00
2024-05-16 08:56:49 -07:00
2024-05-22 12:26:46 -07:00
2024-06-11 19:33:37 -07:00
2024-05-23 13:39:42 -07:00
2024-04-30 10:44:53 -06:00
2024-05-23 12:04:36 -07:00
2024-05-04 18:26:50 +05:30
2024-06-18 14:48:27 +01:00
2024-05-06 09:07:22 -04:00
2024-05-10 10:36:31 +01:00
2024-05-14 15:07:07 -07:00
2024-05-26 14:40:39 -07:00
2024-05-02 20:35:57 +02:00
2024-05-10 15:43:31 +01:00
2024-06-12 11:00:50 -06:00
2024-05-21 15:29:01 -07:00
2024-05-21 13:02:56 -07:00
2024-05-27 09:16:22 -06:00
2024-05-30 15:03:52 -06:00
2024-06-13 11:16:01 -07:00
2024-05-19 09:21:03 -07:00
2024-04-29 16:28:07 -07:00
2024-06-14 19:14:37 +02:00
2024-05-21 09:51:42 -07:00
2024-05-15 10:05:24 -04:00
2024-06-23 00:57:21 -04:00
2024-06-24 18:29:20 +02:00
2024-05-09 09:25:08 -07:00
2024-06-14 19:08:32 +02:00
2024-05-22 14:12:11 -07:00
2024-05-08 09:53:00 -07:00
2024-05-22 09:56:00 -07:00
2024-05-02 12:12:08 -07:00
2024-05-05 17:53:55 -07:00
2024-06-04 15:53:36 +02:00
2024-05-14 11:43:40 +02:00
2024-05-06 13:28:59 -07:00
2024-05-20 10:23:39 -07:00
2024-05-09 19:00:29 +02:00
2024-05-25 10:48:57 -07:00
2024-05-14 00:31:43 -07:00
2024-05-11 00:41:15 +00:00
2024-05-22 10:45:12 -07:00
2024-05-09 13:02:39 +02:00
2024-06-27 17:43:40 +02:00
2024-05-21 15:29:01 -07:00
2024-05-06 11:06:04 +09:00
2024-05-24 11:55:05 -07:00
2024-05-01 23:18:47 +09:00
2024-05-19 14:36:17 -07:00
2024-05-21 13:11:44 -07:00
2024-04-29 15:01:42 +01:00
2024-06-18 16:25:50 +02:00
2024-06-27 17:43:40 +02:00
2024-05-19 14:40:44 -07:00
2024-05-19 09:21:03 -07:00
2024-05-07 15:38:36 +02:00
2024-06-05 19:19:24 -07:00
2024-05-19 09:21:03 -07:00
2024-05-13 16:13:19 +02:00
2024-06-21 13:33:17 +02:00
2024-04-30 21:10:37 +02:00
2024-04-29 13:01:08 +02:00
2024-06-24 19:46:10 -06:00
2024-05-19 09:21:03 -07:00
2024-06-04 13:54:31 +02:00
2024-05-07 13:29:45 +02:00
2024-05-15 17:02:08 -05:00
2024-05-21 09:51:42 -07:00
2024-06-17 12:30:07 -07:00
2024-05-19 14:02:03 -07:00
2024-05-22 11:53:02 -07:00
2024-05-16 07:23:30 +09:00
2024-06-05 19:19:26 -07:00
2024-05-12 03:16:47 -04:00
2024-05-03 10:44:42 +01:00
2024-06-30 22:23:21 +02:00
2024-05-09 15:48:01 +02:00
2024-06-04 12:10:05 -05:00
2024-06-13 14:26:50 -04:00
2024-05-07 15:17:52 -07:00
2024-05-07 10:37:00 -07:00
2024-05-05 17:53:25 -07:00
2024-06-05 19:19:26 -07:00
2024-06-24 20:52:09 -07:00
2024-06-24 20:52:11 -07:00
2024-05-22 11:31:10 +02:00
2024-06-27 17:43:40 +02:00
2024-05-14 00:31:43 -07:00
2024-05-15 17:02:08 -05:00
2024-05-21 10:09:28 -07:00
2024-05-13 18:19:09 -06:00
2024-05-13 18:35:02 -07:00
2024-05-28 14:34:15 +02:00
2024-05-06 09:07:17 -04:00
2024-05-20 11:09:20 -04:00
2024-05-08 08:41:29 -07:00
2024-06-16 10:17:57 +03:00
2024-06-21 08:49:10 -07:00
2024-05-03 07:26:38 +02:00
2024-05-01 23:18:48 +09:00
2024-05-03 07:49:13 -05:00
2024-05-19 22:29:43 -05:00
2024-05-05 17:53:49 -07:00
2024-06-24 20:52:10 -07:00
2024-06-15 10:43:06 -07:00
2024-05-02 17:48:09 -04:00
2024-05-21 10:09:28 -07:00
2024-06-04 12:10:05 -05:00
2024-06-15 10:43:05 -07:00
2024-05-05 17:53:42 -07:00
2024-05-13 18:35:02 -07:00
2024-05-17 12:22:46 +02:00
2024-05-28 21:53:51 +02:00
2024-06-25 07:58:10 +02:00
2024-04-30 18:57:07 +02:00
2024-05-07 10:31:42 +09:00
2024-05-13 18:09:56 -04:00
2024-05-05 17:53:45 -07:00
2024-05-19 09:21:03 -07:00
2024-06-13 14:26:50 -04:00
2024-05-02 16:28:15 +02:00
2024-06-24 16:14:48 +02:00
2024-05-13 18:35:02 -07:00
2024-05-03 16:05:53 -07:00
2024-05-19 09:21:03 -07:00
2024-05-19 09:21:03 -07:00
2024-05-19 09:21:03 -07:00
2024-05-13 18:19:19 -06:00
2024-05-04 18:57:21 +02:00
2024-05-13 18:33:10 -07:00
2024-06-06 08:55:20 -07:00
2024-05-21 08:34:51 -07:00
2024-05-07 13:29:28 +02:00
2024-07-01 14:52:12 +02:00
2024-05-17 17:31:24 -07:00
2024-06-04 15:56:45 +02:00
2024-05-06 17:39:09 +02:00
2024-05-28 13:14:23 +03:00
2024-05-01 23:18:48 +09:00
2024-05-04 04:25:37 -04:00
2024-05-04 18:45:11 +02:00
2024-05-06 12:05:00 +02:00
2024-05-15 12:34:46 -07:00
2024-05-04 18:23:03 +02:00
2024-05-31 15:15:51 -06:00
2024-05-31 15:15:51 -06:00
2024-07-04 11:00:31 -04:00
2024-05-19 16:12:38 -07:00
2024-06-07 06:24:16 -10:00
2024-05-05 17:53:51 -07:00
2024-05-19 09:21:03 -07:00