• Eric Dumazet's avatar
    ipv6: flowlabel: do not leave opt->tot_len with garbage · 864e2a1f
    Eric Dumazet authored
    When syzkaller team brought us a C repro for the crash [1] that
    had been reported many times in the past, I finally could find
    the root cause.
    
    If FlowLabel info is merged by fl6_merge_options(), we leave
    part of the opt_space storage provided by udp/raw/l2tp with random value
    in opt_space.tot_len, unless a control message was provided at sendmsg()
    time.
    
    Then ip6_setup_cork() would use this random value to perform a kzalloc()
    call. Undefined behavior and crashes.
    
    Fix is to properly set tot_len in fl6_merge_options()
    
    At the same time, we can also avoid consuming memory and cpu cycles
    to clear it, if every option is copied via a kmemdup(). This is the
    change in ip6_setup_cork().
    
    [1]
    kasan: CONFIG_KASAN_INLINE enabled
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] SMP KASAN
    Dumping ftrace buffer:
       (ftrace buffer empty)
    Modules linked in:
    CPU: 0 PID: 6613 Comm: syz-executor0 Not tainted 4.14.0-rc4+ #127
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    task: ffff8801cb64a100 task.stack: ffff8801cc350000
    RIP: 0010:ip6_setup_cork+0x274/0x15c0 net/ipv6/ip6_output.c:1168
    RSP: 0018:ffff8801cc357550 EFLAGS: 00010203
    RAX: dffffc0000000000 RBX: ffff8801cc357748 RCX: 0000000000000010
    RDX: 0000000000000002 RSI: ffffffff842bd1d9 RDI: 0000000000000014
    RBP: ffff8801cc357620 R08: ffff8801cb17f380 R09: ffff8801cc357b10
    R10: ffff8801cb64a100 R11: 0000000000000000 R12: ffff8801cc357ab0
    R13: ffff8801cc357b10 R14: 0000000000000000 R15: ffff8801c3bbf0c0
    FS:  00007f9c5c459700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000020324000 CR3: 00000001d1cf2000 CR4: 00000000001406f0
    DR0: 0000000020001010 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
    Call Trace:
     ip6_make_skb+0x282/0x530 net/ipv6/ip6_output.c:1729
     udpv6_sendmsg+0x2769/0x3380 net/ipv6/udp.c:1340
     inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:762
     sock_sendmsg_nosec net/socket.c:633 [inline]
     sock_sendmsg+0xca/0x110 net/socket.c:643
     SYSC_sendto+0x358/0x5a0 net/socket.c:1750
     SyS_sendto+0x40/0x50 net/socket.c:1718
     entry_SYSCALL_64_fastpath+0x1f/0xbe
    RIP: 0033:0x4520a9
    RSP: 002b:00007f9c5c458c08 EFLAGS: 00000216 ORIG_RAX: 000000000000002c
    RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 00000000004520a9
    RDX: 0000000000000001 RSI: 0000000020fd1000 RDI: 0000000000000016
    RBP: 0000000000000086 R08: 0000000020e0afe4 R09: 000000000000001c
    R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004bb1ee
    R13: 00000000ffffffff R14: 0000000000000016 R15: 0000000000000029
    Code: e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ea 0f 00 00 48 8d 79 04 48 b8 00 00 00 00 00 fc ff df 45 8b 74 24 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
    RIP: ip6_setup_cork+0x274/0x15c0 net/ipv6/ip6_output.c:1168 RSP: ffff8801cc357550
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    864e2a1f
Name
Last commit
Last update
Documentation Loading commit data...
arch Loading commit data...
block Loading commit data...
certs Loading commit data...
crypto Loading commit data...
drivers Loading commit data...
firmware Loading commit data...
fs Loading commit data...
include Loading commit data...
init Loading commit data...
ipc Loading commit data...
kernel Loading commit data...
lib Loading commit data...
mm Loading commit data...
net Loading commit data...
samples Loading commit data...
scripts Loading commit data...
security Loading commit data...
sound Loading commit data...
tools Loading commit data...
usr Loading commit data...
virt Loading commit data...
.cocciconfig Loading commit data...
.get_maintainer.ignore Loading commit data...
.gitattributes Loading commit data...
.gitignore Loading commit data...
.mailmap Loading commit data...
COPYING Loading commit data...
CREDITS Loading commit data...
Kbuild Loading commit data...
Kconfig Loading commit data...
MAINTAINERS Loading commit data...
Makefile Loading commit data...
README Loading commit data...