Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity
android_kernel_samsung_msm8976/net
History
Paolo Abeni 3d7d919e11 ip6_tunnel: be careful when accessing the inner header 
[ Upstream commit 76c0ddd8c3a683f6e2c6e60e11dc1a1558caf4bc ]

the ip6 tunnel xmit ndo assumes that the processed skb always
contains an ip[v6] header, but syzbot has found a way to send
frames that fall short of this assumption, leading to the following splat:

BUG: KMSAN: uninit-value in ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1307
[inline]
BUG: KMSAN: uninit-value in ip6_tnl_start_xmit+0x7d2/0x1ef0
net/ipv6/ip6_tunnel.c:1390
CPU: 0 PID: 4504 Comm: syz-executor558 Not tainted 4.16.0+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x185/0x1d0 lib/dump_stack.c:53
  kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
  __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
  ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1307 [inline]
  ip6_tnl_start_xmit+0x7d2/0x1ef0 net/ipv6/ip6_tunnel.c:1390
  __netdev_start_xmit include/linux/netdevice.h:4066 [inline]
  netdev_start_xmit include/linux/netdevice.h:4075 [inline]
  xmit_one net/core/dev.c:3026 [inline]
  dev_hard_start_xmit+0x5f1/0xc70 net/core/dev.c:3042
  __dev_queue_xmit+0x27ee/0x3520 net/core/dev.c:3557
  dev_queue_xmit+0x4b/0x60 net/core/dev.c:3590
  packet_snd net/packet/af_packet.c:2944 [inline]
  packet_sendmsg+0x7c70/0x8a30 net/packet/af_packet.c:2969
  sock_sendmsg_nosec net/socket.c:630 [inline]
  sock_sendmsg net/socket.c:640 [inline]
  ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046
  __sys_sendmmsg+0x42d/0x800 net/socket.c:2136
  SYSC_sendmmsg+0xc4/0x110 net/socket.c:2167
  SyS_sendmmsg+0x63/0x90 net/socket.c:2162
  do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x441819
RSP: 002b:00007ffe58ee8268 EFLAGS: 00000213 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441819
RDX: 0000000000000002 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00000000006cd018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000402510
R13: 00000000004025a0 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
  kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
  kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
  kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
  kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321
  slab_post_alloc_hook mm/slab.h:445 [inline]
  slab_alloc_node mm/slub.c:2737 [inline]
  __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369
  __kmalloc_reserve net/core/skbuff.c:138 [inline]
  __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206
  alloc_skb include/linux/skbuff.h:984 [inline]
  alloc_skb_with_frags+0x1d4/0xb20 net/core/skbuff.c:5234
  sock_alloc_send_pskb+0xb56/0x1190 net/core/sock.c:2085
  packet_alloc_skb net/packet/af_packet.c:2803 [inline]
  packet_snd net/packet/af_packet.c:2894 [inline]
  packet_sendmsg+0x6454/0x8a30 net/packet/af_packet.c:2969
  sock_sendmsg_nosec net/socket.c:630 [inline]
  sock_sendmsg net/socket.c:640 [inline]
  ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046
  __sys_sendmmsg+0x42d/0x800 net/socket.c:2136
  SYSC_sendmmsg+0xc4/0x110 net/socket.c:2167
  SyS_sendmmsg+0x63/0x90 net/socket.c:2162
  do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2

This change addresses the issue adding the needed check before
accessing the inner header.

The ipv4 side of the issue is apparently there since the ipv4 over ipv6
initial support, and the ipv6 side predates git history.

Fixes: c4d3efafcc ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.")
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+3fde91d4d394747d6db4@syzkaller.appspotmail.com
Tested-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2019-07-27 21:52:36 +02:00
..
9p 9p: forgetting to cancel request on interrupted zero-copy RPC 2015-08-03 09:29:47 -07:00
802
…
8021q
…
appletalk
…
atm
…
ax25 Import latest Samsung release 2017-04-18 03:43:52 +02:00
batman-adv batman-adv: Fix broadcast/ogm queue limit on a removed interface 2016-06-07 10:42:53 +02:00
bluetooth Bluetooth: hidp: Fix handling of strncpy for hid->name information 2019-07-27 21:51:39 +02:00
bridge netfilter: ebtables: handle string from userspace with care 2019-07-27 21:52:09 +02:00
caif net/unix: sk_socket can disappear when state is unlocked 2015-09-16 18:20:18 +05:30
can can: add missing initialisations in CAN related skbuffs 2015-03-26 15:00:58 +01:00
ceph libceph: introduce ceph_crypt() for in-place en/decryption 2017-04-22 23:02:50 +02:00
core rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096 2019-07-27 21:52:36 +02:00
dcb
…
dccp dccp: check sk for closed state in dccp_sendmsg() 2019-07-27 21:49:52 +02:00
decnet Import latest Samsung release 2017-04-18 03:43:52 +02:00
dns_resolver KEYS: DNS: limit the length of option strings 2019-07-27 21:52:16 +02:00
dsa
…
ethernet
…
ieee802154
…
ipc_router net: ipc_router: Fix buffer overflow during memcpy 2019-07-27 21:51:21 +02:00
ipv4 ip_tunnel: be careful when accessing the inner header 2019-07-27 21:52:35 +02:00
ipv6 ip6_tunnel: be careful when accessing the inner header 2019-07-27 21:52:36 +02:00
ipx ipx: call ipxitf_put() in ioctl error path 2018-01-21 21:05:49 -08:00
irda irda: Fix lockdep annotations in hashbin_delete(). 2017-04-22 23:02:49 +02:00
iucv
…
key af_key: fix buffer overread in parse_exthdrs() 2019-07-27 21:46:23 +02:00
l2tp l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache 2019-07-27 21:51:14 +02:00
lapb
…
llc llc: better deal with too small mtu 2019-07-27 21:52:24 +02:00
mac80211 mac80211: use constant time comparison with keys 2019-07-27 21:45:47 +02:00
mac802154
…
netfilter BACKPORT: ANDROID: Use sk_uid to replace uid get from socket file 2019-07-27 21:51:34 +02:00
netlabel netlabel: add address family checks to netlbl_{sock,req}_delattr() 2019-07-27 21:41:59 +02:00
netlink BACKPORT: netlink: add a start callback for starting a netlink dump 2019-07-27 21:51:36 +02:00
netrom
…
nfc NFC: llcp: Limit size of SDP URI 2019-07-27 21:51:24 +02:00
openvswitch
…
packet packet: fix bitfield update race 2019-07-27 21:52:20 +02:00
phonet This is the 3.10.96 stable release 2017-04-18 17:16:02 +02:00
rds This is the 3.10.99 stable release 2017-04-18 17:17:46 +02:00
rfkill net: rfkill: Do not ignore errors from regulator_enable() 2019-07-27 21:42:01 +02:00
rmnet_data net: rmnet_data: Change the log level for unknown IOCTL's 2019-07-27 21:51:01 +02:00
rose
…
rxrpc rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2019-07-27 21:44:13 +02:00
sched sch_fq_codel: avoid double free on init failure 2019-07-27 21:45:13 +02:00
sctp sctp: fix a type cast warnings that causes a_rwnd gets the wrong value 2019-07-27 21:45:39 +02:00
sunrpc kernel: make groups_sort calling a responsibility group_info allocators 2019-07-27 21:46:18 +02:00
tipc net/tipc: initialize security state for new connection socket 2015-10-01 12:07:35 +02:00
unix net/unix: don't show information about sockets from other namespaces 2019-07-27 21:45:50 +02:00
vmw_vsock VSOCK: do not disconnect socket when peer has shutdown SEND only 2016-06-07 10:42:54 +02:00
wimax
…
wireless cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE 2019-07-27 21:51:54 +02:00
x25 net: fix a kernel infoleak in x25 module 2016-06-07 10:42:54 +02:00
xfrm xfrm: fix 'passing zero to ERR_PTR()' warning 2019-07-27 21:51:39 +02:00
Kconfig
…
Makefile
…
activity_stats.c
…
compat.c net: support compat 64-bit time in {s,g}etsockopt 2019-07-27 21:49:09 +02:00
nonet.c
…
socket.c UPSTREAM: net: socket: Make unnecessarily global sockfs_setattr() static 2019-07-27 21:51:01 +02:00
sysctl_net.c
…