Lorenzo Bianconi bb9bd814eb ipv6: sit: reset ip header pointer in ipip6_rcv ... ipip6 tunnels run iptunnel_pull_header on received skbs. This can determine the following use-after-free accessing iph pointer since the packet will be 'uncloned' running pskb_expand_head if it is a cloned gso skb (e.g if the packet has been sent though a veth device) [ 706.369655] BUG: KASAN: use-after-free in ipip6_rcv+0x1678/0x16e0 [sit] [ 706.449056] Read of size 1 at addr ffffe01b6bd855f5 by task ksoftirqd/1/= [ 706.669494] Hardware name: HPE ProLiant m400 Server/ProLiant m400 Server, BIOS U02 08/19/2016 [ 706.771839] Call trace: [ 706.801159] dump_backtrace+0x0/0x2f8 [ 706.845079] show_stack+0x24/0x30 [ 706.884833] dump_stack+0xe0/0x11c [ 706.925629] print_address_description+0x68/0x260 [ 706.982070] kasan_report+0x178/0x340 [ 707.025995] __asan_report_load1_noabort+0x30/0x40 [ 707.083481] ipip6_rcv+0x1678/0x16e0 [sit] [ 707.132623] tunnel64_rcv+0xd4/0x200 [tunnel4] [ 707.185940] ip_local_deliver_finish+0x3b8/0x988 [ 707.241338] ip_local_deliver+0x144/0x470 [ 707.289436] ip_rcv_finish+0x43c/0x14b0 [ 707.335447] ip_rcv+0x628/0x1138 [ 707.374151] __netif_receive_skb_core+0x1670/0x2600 [ 707.432680] __netif_receive_skb+0x28/0x190 [ 707.482859] process_backlog+0x1d0/0x610 [ 707.529913] net_rx_action+0x37c/0xf68 [ 707.574882] __do_softirq+0x288/0x1018 [ 707.619852] run_ksoftirqd+0x70/0xa8 [ 707.662734] smpboot_thread_fn+0x3a4/0x9e8 [ 707.711875] kthread+0x2c8/0x350 [ 707.750583] ret_from_fork+0x10/0x18 [ 707.811302] Allocated by task 16982: [ 707.854182] kasan_kmalloc.part.1+0x40/0x108 [ 707.905405] kasan_kmalloc+0xb4/0xc8 [ 707.948291] kasan_slab_alloc+0x14/0x20 [ 707.994309] __kmalloc_node_track_caller+0x158/0x5e0 [ 708.053902] __kmalloc_reserve.isra.8+0x54/0xe0 [ 708.108280] __alloc_skb+0xd8/0x400 [ 708.150139] sk_stream_alloc_skb+0xa4/0x638 [ 708.200346] tcp_sendmsg_locked+0x818/0x2b90 [ 708.251581] tcp_sendmsg+0x40/0x60 [ 708.292376] inet_sendmsg+0xf0/0x520 [ 708.335259] sock_sendmsg+0xac/0xf8 [ 708.377096] sock_write_iter+0x1c0/0x2c0 [ 708.424154] new_sync_write+0x358/0x4a8 [ 708.470162] __vfs_write+0xc4/0xf8 [ 708.510950] vfs_write+0x12c/0x3d0 [ 708.551739] ksys_write+0xcc/0x178 [ 708.592533] __arm64_sys_write+0x70/0xa0 [ 708.639593] el0_svc_handler+0x13c/0x298 [ 708.686646] el0_svc+0x8/0xc [ 708.739019] Freed by task 17: [ 708.774597] __kasan_slab_free+0x114/0x228 [ 708.823736] kasan_slab_free+0x10/0x18 [ 708.868703] kfree+0x100/0x3d8 [ 708.905320] skb_free_head+0x7c/0x98 [ 708.948204] skb_release_data+0x320/0x490 [ 708.996301] pskb_expand_head+0x60c/0x970 [ 709.044399] __iptunnel_pull_header+0x3b8/0x5d0 [ 709.098770] ipip6_rcv+0x41c/0x16e0 [sit] [ 709.146873] tunnel64_rcv+0xd4/0x200 [tunnel4] [ 709.200195] ip_local_deliver_finish+0x3b8/0x988 [ 709.255596] ip_local_deliver+0x144/0x470 [ 709.303692] ip_rcv_finish+0x43c/0x14b0 [ 709.349705] ip_rcv+0x628/0x1138 [ 709.388413] __netif_receive_skb_core+0x1670/0x2600 [ 709.446943] __netif_receive_skb+0x28/0x190 [ 709.497120] process_backlog+0x1d0/0x610 [ 709.544169] net_rx_action+0x37c/0xf68 [ 709.589131] __do_softirq+0x288/0x1018 [ 709.651938] The buggy address belongs to the object at ffffe01b6bd85580 which belongs to the cache kmalloc-1024 of size 1024 [ 709.804356] The buggy address is located 117 bytes inside of 1024-byte region [ffffe01b6bd85580, ffffe01b6bd85980) [ 709.946340] The buggy address belongs to the page: [ 710.003824] page:ffff7ff806daf600 count:1 mapcount:0 mapping:ffffe01c4001f600 index:0x0 [ 710.099914] flags: 0xfffff8000000100(slab) [ 710.149059] raw: 0fffff8000000100 dead000000000100 dead000000000200 ffffe01c4001f600 [ 710.242011] raw: 0000000000000000 0000000000380038 00000001ffffffff 0000000000000000 [ 710.334966] page dumped because: kasan: bad access detected Fix it resetting iph pointer after iptunnel_pull_header Fixes: a09a4c8dd1 ("tunnels: Remove encapsulation offloads on decap") Tested-by: Jianlin Shi <jishi@redhat.com> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-04-04 18:34:23 -07:00
..
6lowpan	6lowpan: fix debugfs_simple_attr.cocci warnings	2019-01-22 09:51:19 +01:00
9p	9p/net: fix memory leak in p9_client_create	2019-03-13 11:50:04 +01:00
802
8021q	vlan: conditional inclusion of FCoE hooks to match netdevice.h and bnx2x	2019-04-04 17:18:34 -07:00
appletalk	appletalk: Fix potential NULL pointer dereference in unregister_snap_client	2019-03-15 11:25:48 -07:00
atm	net: atm: Add another IS_ENABLED(CONFIG_COMPAT) in atm_dev_ioctl	2019-03-07 10:14:50 -08:00
ax25	ax25: fix possible use-after-free	2019-01-23 11:18:00 -08:00
batman-adv	batman-adv: Fix genl notification for throughput_override	2019-03-25 09:31:19 +01:00
bluetooth	Bluetooth: Add quirk for reading BD_ADDR from fwnode property	2019-02-26 10:08:26 +01:00
bpf	bpf: fix warning about using plain integer as NULL	2019-03-08 21:17:07 +01:00
bpfilter	bpfilter: re-add header search paths to tools include to fix build error	2019-02-23 13:34:40 -08:00
bridge	net: bridge: always clear mcast matching struct on reports and leaves	2019-04-04 17:52:40 -07:00
caif	net: caif: use skb helpers instead of open-coding them	2019-02-17 11:01:17 -08:00
can	can: bcm: check timer values before ktime conversion	2019-01-22 11:33:46 +01:00
ceph	libceph: wait for latest osdmap in ceph_monc_blacklist_add()	2019-03-20 16:27:40 +01:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2019-04-04 13:30:55 -07:00
dcb
dccp	dccp: Fix memleak in __feat_register_sp	2019-04-01 18:15:10 -07:00
decnet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-01-29 21:18:54 -08:00
dns_resolver
dsa	net: dsa: Implement flow_dissect callback for tag_qca	2019-03-28 16:57:19 -07:00
ethernet	net/ethernet: Add parse_protocol header_ops support	2019-02-22 12:55:31 -08:00
hsr	net/hsr: fix possible crash in add_timer()	2019-03-07 11:02:08 -08:00
ieee802154	net: remove unused struct inet_frag_queue.fragments field	2019-02-26 08:27:05 -08:00
ife
ipv4	tcp: Ensure DCTCP reacts to losses	2019-04-04 10:51:16 -07:00
ipv6	ipv6: sit: reset ip header pointer in ipip6_rcv	2019-04-04 18:34:23 -07:00
iucv	iucv: Remove SKB list assumptions.	2018-11-10 16:55:11 -08:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-01 14:59:20 -07:00
key	af_key: unconditionally clone on broadcast	2019-02-12 10:36:42 +01:00
l2tp	l2tp: fix infoleak in l2tp_ip6_recvmsg()	2019-03-13 14:19:35 -07:00
l3mdev	l3mdev: add function to retreive upper master	2018-12-03 14:15:26 -08:00
lapb
llc
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-24 12:06:19 -08:00
mac802154
mpls	mpls: Fix 6PE forwarding	2019-03-19 16:00:22 -07:00
ncsi	net: ncsi: fix a missing check for nla_nest_start	2019-03-16 11:44:33 -07:00
netfilter	netfilter: nf_tables: add missing ->release_ops() in error path of newrule()	2019-03-20 08:32:58 +01:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-02-27 21:45:24 -08:00
netlink	genetlink: Fix a memory leak on error path	2019-03-21 09:29:06 -07:00
netrom	netrom: switch to sock timer API	2019-01-27 10:38:04 -08:00
nfc	nfc: Fix to check for kmemdup failure	2019-03-19 13:48:07 -07:00
nsh
openvswitch	openvswitch: fix flow actions reallocation	2019-03-28 17:15:44 -07:00
packet	net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec	2019-03-20 10:46:50 -07:00
phonet	phonet: fix building with clang	2019-02-21 16:23:56 -08:00
psample
qrtr	mm: replace all open encodings for NUMA_NO_NODE	2019-03-05 21:07:14 -08:00
rds	net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().	2019-03-28 17:17:18 -07:00
rfkill	rfkill: gpio: Remove unused include	2018-12-18 13:13:56 +01:00
rose	net: rose: fix a possible stack overflow	2019-03-18 16:53:22 -07:00
rxrpc	rxrpc: avoid clang -Wuninitialized warning	2019-03-23 21:48:30 -04:00
sched	sch_cake: Make sure we can write the IP header before changing DSCP bits	2019-04-04 10:55:59 -07:00
sctp	sctp: initialize _pad of sockaddr_in before copying to user memory	2019-04-01 18:08:19 -07:00
smc	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 13:27:20 -07:00
strparser	net: strparser: fix a missing check for create_singlethread_workqueue	2019-03-15 12:51:56 -07:00
sunrpc	SUNRPC: fix uninitialized variable warning	2019-03-26 13:04:32 -07:00
switchdev	switchdev: Remove unused transaction item queue	2019-03-01 21:35:19 -08:00
tipc	tipc: handle the err returned from cmd header function	2019-03-31 16:45:57 -07:00
tls	net: tls: prevent false connection termination with offload	2019-03-29 13:38:50 -07:00
unix	io_uring-2019-03-06	2019-03-08 14:48:40 -08:00
vmw_vsock	vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock	2019-03-08 15:15:44 -08:00
wimax
wireless	Merge remote-tracking branch 'net-next/master' into mac80211-next	2019-02-22 13:48:13 +01:00
x25	net/x25: reset state in x25_connect()	2019-03-11 15:40:14 -07:00
xdp	xsk: fix umem memory leak on cleanup	2019-03-16 01:27:51 +01:00
xfrm	xfrm: Fix inbound traffic via XFRM interfaces across network namespaces	2019-02-18 10:58:54 +01:00
compat.c	Merge branch 'timers-2038-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-03-05 14:08:26 -08:00
Kconfig	net: devlink: turn devlink into a built-in	2019-02-26 08:49:05 -08:00
Makefile	net: split out functions related to registering inflight socket files	2019-02-28 08:24:23 -07:00
socket.c	net: add documentation to socket.c	2019-03-15 15:29:47 -07:00
sysctl_net.c