netdev - Re: [PATCH ipsec] xfrm: do pskb_pull properly in __xfrm_transport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200420103642.GF13121@gauss3.secunet.de>
Date:   Mon, 20 Apr 2020 12:36:42 +0200
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Xin Long <lucien.xin@...il.com>
CC:     <netdev@...r.kernel.org>, Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>,
        Sabrina Dubroca <sd@...asysnail.net>
Subject: Re: [PATCH ipsec] xfrm: do pskb_pull properly in
 __xfrm_transport_prep

On Fri, Apr 10, 2020 at 05:06:31PM +0800, Xin Long wrote:
> For transport mode, when ipv6 nexthdr is set, the packet format might
> be like:
> 
>     ----------------------------------------------------
>     |        | dest |     |     |      |  ESP    | ESP |
>     | IP6 hdr| opts.| ESP | TCP | Data | Trailer | ICV |
>     ----------------------------------------------------
> 
> and in __xfrm_transport_prep():
> 
>   pskb_pull(skb, skb->mac_len + sizeof(ip6hdr) + x->props.header_len);
> 
> it will pull the data pointer to the wrong position, as it missed the
> nexthdrs/dest opts.
> 
> This patch is to fix it by using:
> 
>   pskb_pull(skb, skb_transport_offset(skb) + x->props.header_len);
> 
> as we can be sure transport_header points to ESP header at that moment.
> 
> It also fixes a panic when packets with ipv6 nexthdr are sent over
> esp6 transport mode:
> 
>   [  100.473845] kernel BUG at net/core/skbuff.c:4325!
>   [  100.478517] RIP: 0010:__skb_to_sgvec+0x252/0x260
>   [  100.494355] Call Trace:
>   [  100.494829]  skb_to_sgvec+0x11/0x40
>   [  100.495492]  esp6_output_tail+0x12e/0x550 [esp6]
>   [  100.496358]  esp6_xmit+0x1d5/0x260 [esp6_offload]
>   [  100.498029]  validate_xmit_xfrm+0x22f/0x2e0
>   [  100.499604]  __dev_queue_xmit+0x589/0x910
>   [  100.502928]  ip6_finish_output2+0x2a5/0x5a0
>   [  100.503718]  ip6_output+0x6c/0x120
>   [  100.505198]  xfrm_output_resume+0x4bf/0x530
>   [  100.508683]  xfrm6_output+0x3a/0xc0
>   [  100.513446]  inet6_csk_xmit+0xa1/0xf0
>   [  100.517335]  tcp_sendmsg+0x27/0x40
>   [  100.517977]  sock_sendmsg+0x3e/0x60
>   [  100.518648]  __sys_sendto+0xee/0x160
> 
> Fixes: c35fe4106b92 ("xfrm: Add mode handlers for IPsec on layer 2")
> Signed-off-by: Xin Long <lucien.xin@...il.com>

Applied, thanks!