Eric Dumazet
6978e2935c
bonding/alb: properly access headers in bond_alb_xmit() ...
[ Upstream commit 38f88c45404293bbc027b956def6c10cbd45c616 ]
syzbot managed to send an IPX packet through bond_alb_xmit()
and af_packet and triggered a use-after-free.
First, bond_alb_xmit() was using ipx_hdr() helper to reach
the IPX header, but ipx_hdr() was using the transport offset
instead of the network offset. In the particular syzbot
report transport offset was 0xFFFF
This patch removes ipx_hdr() since it was only (mis)used from bonding.
Then we need to make sure IPv4/IPv6/IPX headers are pulled
in skb->head before dereferencing anything.
BUG: KASAN: use-after-free in bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
Read of size 2 at addr ffff8801ce56dfff by task syz-executor.2/18108
(if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) ...)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
[<ffffffff8441fc42>] __dump_stack lib/dump_stack.c:17 [inline]
[<ffffffff8441fc42>] dump_stack+0x14d/0x20b lib/dump_stack.c:53
[<ffffffff81a7dec4>] print_address_description+0x6f/0x20b mm/kasan/report.c:282
[<ffffffff81a7e0ec>] kasan_report_error mm/kasan/report.c:380 [inline]
[<ffffffff81a7e0ec>] kasan_report mm/kasan/report.c:438 [inline]
[<ffffffff81a7e0ec>] kasan_report.cold+0x8c/0x2a0 mm/kasan/report.c:422
[<ffffffff81a7dc4f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:469
[<ffffffff82c8c00a>] bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
[<ffffffff82c60c74>] __bond_start_xmit drivers/net/bonding/bond_main.c:4199 [inline]
[<ffffffff82c60c74>] bond_start_xmit+0x4f4/0x1570 drivers/net/bonding/bond_main.c:4224
[<ffffffff83baa558>] __netdev_start_xmit include/linux/netdevice.h:4525 [inline]
[<ffffffff83baa558>] netdev_start_xmit include/linux/netdevice.h:4539 [inline]
[<ffffffff83baa558>] xmit_one net/core/dev.c:3611 [inline]
[<ffffffff83baa558>] dev_hard_start_xmit+0x168/0x910 net/core/dev.c:3627
[<ffffffff83bacf35>] __dev_queue_xmit+0x1f55/0x33b0 net/core/dev.c:4238
[<ffffffff83bae3a8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:4278
[<ffffffff84339189>] packet_snd net/packet/af_packet.c:3226 [inline]
[<ffffffff84339189>] packet_sendmsg+0x4919/0x70b0 net/packet/af_packet.c:3252
[<ffffffff83b1ac0c>] sock_sendmsg_nosec net/socket.c:673 [inline]
[<ffffffff83b1ac0c>] sock_sendmsg+0x12c/0x160 net/socket.c:684
[<ffffffff83b1f5a2>] __sys_sendto+0x262/0x380 net/socket.c:1996
[<ffffffff83b1f700>] SYSC_sendto net/socket.c:2008 [inline]
[<ffffffff83b1f700>] SyS_sendto+0x40/0x60 net/socket.c:2004
Fixes: 1da177e4c3
2020-02-11 04:35:48 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 188
2019-05-30 11:29:21 -07:00
Bluetooth: Add support for utilizing Fast Advertising Interval
2019-09-05 17:27:21 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 194
2019-05-30 11:29:22 -07:00
net/af_iucv: locate IUCV header via skb_network_header()
2018-09-26 09:56:07 -07:00
netfilter: nf_tables: Align nft_expr private data to 64-bit
2019-11-04 20:58:32 +01:00
netfilter: nf_tables: autoload modules from the abort path
2020-01-29 16:45:33 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234
2019-06-19 17:09:07 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
sctp: cache netns in sctp_ep_common
2019-12-04 22:30:57 +01:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
net: sched: use get_dev() action API in flow_action infra
2019-09-16 09:18:03 +02:00
ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets
2019-08-19 17:19:46 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: split out functions related to registering inflight socket files
2019-02-28 08:24:23 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
net: avoid potential false sharing in neighbor related code
2019-12-31 16:45:03 +01:00
ax25: fix possible use-after-free
2019-01-23 11:18:00 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 90
2019-05-24 17:37:53 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 5
2019-05-21 11:28:40 +02:00
bonding: add an option to specify a delay between peer notifications
2019-07-04 12:30:48 -07:00
bonding: fix state transition issue in link monitoring
2019-11-05 17:40:16 -08:00
bpf: support cloning sk storage on accept()
2019-08-17 23:18:54 +02:00
net: annotate lockless accesses to sk->sk_napi_id
2019-10-30 17:34:35 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
cfg80211: Fix radar event during another phy CAC
2020-02-05 21:22:46 +00:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: rework SIOCGSTAMP ioctl handling
2019-04-19 14:07:40 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
devlink: disallow reload operation during device cleanup
2019-11-09 19:38:36 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
drop_monitor: Add basic infrastructure for hardware drops
2019-08-17 12:40:08 -07:00
net: dsa: Pass ndo_setup_tc slave callback to drivers
2019-09-16 21:32:57 +02:00
net/dst: do not confirm neighbor for vxlan and geneve pmtu update
2020-01-04 19:19:05 +01:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
net: fib: drop include of module.h from fib_notifier.h
2019-04-22 21:50:53 -07:00
net: fib_rules: do not flow dissect local packets
2019-07-11 14:22:53 -07:00
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
cls_flower: Fix the behavior using port ranges with hw-offload
2019-12-18 16:08:49 +01:00
net: core: rename indirect block ingress cb function
2019-12-18 16:08:47 +01:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net/fq_impl: Switch to kvmalloc() for memory allocation
2019-11-08 09:11:49 +01:00
net: align gnet_stats_basic_cpu struct
2018-11-17 21:37:29 -08:00
genetlink: optionally validate strictly/dumps
2019-04-27 17:07:22 -04:00
net: Move the definition of the default Geneve udp port to public header file
2019-03-22 12:09:31 -07:00
net: Add netif_is_gretap()/netif_is_ip6gretap()
2018-12-10 15:53:04 -08:00
net:gue.h:Fix shifting signed 32-bit value by 31 bits problem
2019-07-01 10:58:23 -07:00
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
wireless-drivers-next patches for 5.1
2019-02-22 12:56:24 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
ipv6: shrink struct ipv6_mc_socklist
2019-08-28 14:43:03 -07:00
net: ife: drop include of module.h from net/ife.h
2019-04-22 21:50:53 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
inet: factor out inet_send_prepare()
2019-07-03 13:51:54 -07:00
net/tls: use RCU protection on icsk->icsk_ulp_data
2019-08-31 23:44:28 -07:00
inet: Refactor INET_ECN_decapsulate()
2018-10-17 17:45:07 -07:00
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
tcp/dccp: fix possible race __inet_lookup_established()
2020-01-04 19:19:13 +01:00
ip: support SO_MARK cmsg
2019-09-13 21:44:19 +02:00
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-08 21:50:15 -08:00
inet: protect against too small mtu values.
2019-12-18 16:08:17 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ipv6: Dump route exceptions if requested
2019-06-24 10:18:49 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-06-27 21:06:39 -07:00
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-06-18 20:48:45 -04:00
net: Properly update v4 routes with v6 nexthop
2019-09-05 12:35:58 +02:00
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
ipvs: move old_secure_tcp into struct netns_ipvs
2019-10-24 11:56:02 +02:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2019-12-18 16:08:40 +01:00
inet: fix various use-after-free in defrags units
2019-06-19 11:37:47 -04:00
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2019-12-18 16:08:42 +01:00
bonding/alb: properly access headers in bond_alb_xmit()
2020-02-11 04:35:48 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
llc: avoid blocking in llc_sap_close()
2018-09-13 09:04:58 -07:00
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
lwtunnel: Pass encap and encap type attributes to lwtunnel_fill_encap
2019-04-23 19:42:29 -07:00
mac80211: allow drivers to set max MTU
2019-09-11 09:33:29 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
net: avoid potential false sharing in neighbor related code
2019-12-31 16:45:03 +01:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:20:06 +01:00
netns: fix GFP flags in rtnl_net_notifyid()
2019-10-25 20:14:42 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
netlink: Fix nlmsg_parse as a wrapper for strict message parsing
2019-08-13 20:37:16 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: netrom: Fix error cleanup path of nr_proto_init
2019-04-11 13:59:49 -07:00
net: Properly update v4 routes with v6 nexthop
2019-09-05 12:35:58 +02:00
page_pool: do not release pool until inflight == 0.
2019-12-18 16:09:07 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net_sched: fix ops->bind_class() implementations
2020-02-01 09:34:38 +00:00
Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net
2019-09-17 23:51:10 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
cfg80211: make wmm_rule part of the reg_rule structure
2018-08-28 11:11:47 +02:00
net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
2019-10-09 21:34:31 -07:00
ipv4: Revert removal of rt_uses_gateway
2019-09-20 18:23:33 -07:00
net: Add extack argument to rtnl_create_link
2018-11-06 15:00:45 -08:00
net: Rename net/nexthop.h net/rtnh.h
2019-04-22 21:47:25 -07:00
net_sched: fix ops->bind_class() implementations
2020-02-01 09:34:38 +00:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net/smc: add smcd support to the pnet table
2019-02-21 10:34:37 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: annotate lockless accesses to sk->sk_pacing_shift
2020-01-09 10:20:07 +01:00
udp: correct reuseport selection with connected sockets
2019-09-16 09:02:18 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
bpf: Sockmap/tls, push write_space updates through ulp updates
2020-01-23 08:22:45 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net/tls: use sg_next() to walk sg entries
2019-12-04 22:31:02 +01:00
udp: segment looped gso packets correctly
2020-02-01 09:34:39 +00:00
ipv6: Move ipv6 stubs to a separate header file
2019-03-29 10:53:45 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
vxlan: add adjacent link to limit depth level
2019-10-24 14:53:49 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268
2019-06-05 17:30:29 +02:00
xdp: page_pool related fix to cpumap
2019-06-19 11:23:13 -04:00
page_pool: do not release pool until inflight == 0.
2019-12-18 16:09:07 +01:00
xsk: add support to allow unaligned chunk placement
2019-08-31 01:08:26 +02:00
xfrm interface: fix management of phydev
2019-07-17 10:03:54 +02:00
6978e2935c