
Denis ArefevandGreg Kroah-Hartman
5b1997487a
net: missing check virtio
[ Upstream commit e269d79c7d ]
Two missing check in virtio_net_hdr_to_skb() allowed syzbot
to crash kernels again
1. After the skb_segment function the buffer may become non-linear
(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere
the __skb_linearize function will not be executed, then the buffer will
remain non-linear. Then the condition (offset >= skb_headlen(skb))
becomes true, which causes WARN_ON_ONCE in skb_checksum_help.
2. The struct sk_buff and struct virtio_net_hdr members must be
mathematically related.
(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE.
(remainder) must be greater than (needed) otherwise WARN_ON_ONCE.
(remainder) may be 0 if division is without remainder.
offset+2 (4191) > skb_headlen() (1116)
WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303
Modules linked in:
CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0
Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303
Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef
RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209
RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001
RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c
R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d
FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777
ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584
ip_finish_output_gso net/ipv4/ip_output.c:286 [inline]
__ip_finish_output net/ipv4/ip_output.c:308 [inline]
__ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295
ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433
dst_output include/net/dst.h:451 [inline]
ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129
iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82
ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline]
sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076
__netdev_start_xmit include/linux/netdevice.h:4940 [inline]
netdev_start_xmit include/linux/netdevice.h:4954 [inline]
xmit_one net/core/dev.c:3545 [inline]
dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561
__dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346
dev_queue_xmit include/linux/netdevice.h:3134 [inline]
packet_xmit+0x257/0x380 net/packet/af_packet.c:276
packet_snd net/packet/af_packet.c:3087 [inline]
packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
__sys_sendto+0x255/0x340 net/socket.c:2190
__do_sys_sendto net/socket.c:2202 [inline]
__se_sys_sendto net/socket.c:2198 [inline]
__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Found by Linux Verification Center (linuxtesting.org) with Syzkaller
Fixes: 0f6925b3e8 ("virtio_net: Do not pull payload in skb->head")
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Message-Id: <20240613095448.27118-1-arefev@swemel.ru>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-08-03 08:49:21 +02:00
..
2024-03-15 10:48:13 -04:00
2024-03-06 14:45:14 +00:00
2024-06-12 11:03:39 +02:00
2024-02-23 09:12:40 +01:00
2023-11-20 11:52:08 +01:00
2024-08-03 08:49:20 +02:00
2024-06-16 13:41:35 +02:00
2024-02-23 09:12:49 +01:00
2024-04-03 15:19:33 +02:00
2024-05-17 11:55:54 +02:00
2024-06-21 14:35:51 +02:00
2024-05-17 11:55:56 +02:00
2024-02-23 09:12:51 +01:00
2024-05-17 11:56:10 +02:00
2024-05-17 11:55:54 +02:00
2024-04-27 17:07:12 +02:00
2023-09-23 11:11:00 +02:00
2024-06-12 11:03:08 +02:00
2024-01-31 16:17:00 -08:00
2024-01-25 15:27:42 -08:00
2024-06-12 11:03:08 +02:00
2024-01-25 15:27:30 -08:00
2024-04-27 17:07:17 +02:00
2024-07-18 13:18:34 +02:00
2024-08-03 08:49:09 +02:00
2024-07-18 13:18:34 +02:00
2023-10-06 14:57:04 +02:00
2024-03-06 14:45:19 +00:00
2024-02-23 09:12:51 +01:00
2024-01-25 15:27:37 -08:00
2024-07-05 09:31:59 +02:00
2024-07-18 13:18:31 +02:00
2024-05-17 11:56:20 +02:00
2024-02-23 09:12:51 +01:00
2024-02-23 09:12:28 +01:00
2024-06-12 11:03:34 +02:00
2024-03-15 10:48:21 -04:00
2024-04-03 15:19:28 +02:00
2023-12-13 18:39:03 +01:00
2023-12-20 17:00:20 +01:00
2024-01-01 12:39:08 +00:00
2024-06-12 11:03:21 +02:00
2024-04-10 16:28:32 +02:00
2024-01-01 12:39:05 +00:00
2024-03-26 18:21:02 -04:00
2023-09-23 11:11:08 +02:00
2024-05-17 11:56:16 +02:00
2024-02-16 19:06:24 +01:00
2024-07-05 09:32:00 +02:00
2024-05-02 16:29:29 +02:00
2023-11-28 17:07:18 +00:00
2024-01-05 15:18:38 +01:00
2024-03-26 18:20:23 -04:00
2024-01-10 17:10:30 +01:00
2024-02-23 09:12:51 +01:00
2024-07-05 09:31:47 +02:00
2023-10-25 12:03:12 +02:00
2024-03-06 14:45:16 +00:00
2024-07-25 09:49:20 +02:00
2024-07-11 12:47:14 +02:00
2023-11-28 17:06:54 +00:00
2024-05-17 11:56:07 +02:00
2024-04-03 15:19:42 +02:00
2024-01-10 17:10:33 +01:00
2023-12-03 07:32:07 +01:00
2024-01-25 15:27:22 -08:00
2024-02-16 19:06:30 +01:00
2024-05-17 11:55:52 +02:00
2024-05-17 11:55:52 +02:00
2023-11-20 11:52:04 +01:00
2024-05-17 11:56:08 +02:00
2024-06-21 14:35:40 +02:00
2023-11-20 11:52:16 +01:00
2024-07-05 09:31:48 +02:00
2023-10-06 14:56:41 +02:00
2023-12-20 17:00:16 +01:00
2024-02-23 09:12:38 +01:00
2023-09-23 11:11:09 +02:00
2023-10-06 14:57:03 +02:00
2024-03-26 18:20:22 -04:00
2024-03-26 18:20:22 -04:00
2024-05-25 16:21:31 +02:00
2023-12-13 18:39:17 +01:00
2023-10-10 22:00:37 +02:00
2024-02-05 20:12:49 +00:00
2023-12-08 08:51:20 +01:00
2024-04-17 11:18:28 +02:00
2024-01-20 11:50:06 +01:00
2024-08-03 08:49:05 +02:00
2023-10-25 12:03:16 +02:00
2024-01-01 12:38:52 +00:00
2024-06-27 13:46:22 +02:00
2024-01-01 12:38:58 +00:00
2023-12-13 18:39:17 +01:00
2024-04-03 15:19:51 +02:00
2024-07-11 12:47:16 +02:00
2024-01-31 16:17:01 -08:00
2023-10-19 23:08:56 +02:00
2024-03-01 13:26:36 +01:00
2023-10-06 14:57:03 +02:00
2023-09-19 12:28:02 +02:00
2024-07-25 09:49:07 +02:00
2023-12-20 17:00:26 +01:00
2024-05-17 11:55:51 +02:00
2023-10-10 22:00:35 +02:00
2024-07-18 13:18:31 +02:00
2024-06-27 13:46:23 +02:00
2024-01-05 15:18:40 +01:00
2024-03-26 18:20:52 -04:00
2024-07-11 12:47:04 +02:00
2024-01-05 15:18:29 +01:00
2024-01-10 17:10:27 +01:00
2023-11-20 11:51:55 +01:00
2024-01-25 15:27:51 -08:00
2024-03-06 14:45:08 +00:00
2024-03-06 14:45:17 +00:00
2023-10-06 14:56:31 +02:00
2024-04-03 15:19:34 +02:00
2023-10-15 18:32:41 +02:00
2024-06-12 11:03:17 +02:00
2024-07-05 09:31:50 +02:00
2024-08-03 08:49:05 +02:00
2024-01-25 15:27:20 -08:00
2024-01-10 17:10:32 +01:00
2024-05-17 11:56:23 +02:00
2024-04-27 17:07:18 +02:00
2024-02-23 09:12:51 +01:00
2023-10-25 12:03:15 +02:00
2024-01-31 16:17:09 -08:00
2024-03-26 18:20:28 -04:00
2023-11-08 14:11:02 +01:00
2024-02-23 09:12:51 +01:00
2024-06-12 11:03:21 +02:00
2024-01-05 15:18:40 +01:00
2023-11-28 17:07:03 +00:00
2023-10-19 23:08:50 +02:00
2023-10-19 23:08:50 +02:00
2024-04-13 13:05:25 +02:00
2024-04-13 13:05:07 +02:00
2023-10-06 14:57:03 +02:00
2023-12-13 18:39:17 +01:00
2024-04-03 15:19:35 +02:00
2024-01-31 16:17:02 -08:00
2024-02-23 09:12:51 +01:00
2024-04-10 16:28:34 +02:00
2024-07-11 12:47:16 +02:00
2023-10-06 14:56:41 +02:00
2024-06-21 14:36:00 +02:00
2024-06-12 11:03:32 +02:00
2024-05-17 11:55:56 +02:00
2024-05-17 11:56:19 +02:00
2024-06-16 13:41:42 +02:00
2024-03-01 13:26:36 +01:00
2024-02-23 09:12:51 +01:00
2024-01-10 17:10:27 +01:00
2024-02-23 09:12:51 +01:00
2023-12-13 18:39:08 +01:00
2023-11-28 17:06:57 +00:00
2024-03-01 13:26:32 +01:00
2024-05-17 11:56:24 +02:00
2024-04-27 17:07:10 +02:00
2024-07-05 09:31:59 +02:00
2023-11-28 17:07:08 +00:00
2024-05-17 11:56:13 +02:00
2023-11-28 17:07:23 +00:00
2024-06-27 13:46:17 +02:00
2024-04-17 11:18:23 +02:00
2024-04-10 16:28:27 +02:00
2023-11-20 11:52:04 +01:00
2024-04-03 15:19:46 +02:00
2024-08-03 08:49:21 +02:00
2023-11-20 11:52:17 +01:00
2023-11-28 17:06:55 +00:00