netdev - Re: [PATCH net] net: ip6_gre: set dev->hard_header_len when using header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20201202111657.197327df@kicinski-fedora-pc1c0hjn.DHCP.thefacebook.com>
Date:   Wed, 2 Dec 2020 11:16:57 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Antoine Tenart <atenart@...nel.org>
Cc:     netdev@...r.kernel.org, davem@...emloft.net, kuznet@....inr.ac.ru,
        yoshfuji@...ux-ipv6.org, Maria Pasechnik <mariap@...lanox.com>
Subject: Re: [PATCH net] net: ip6_gre: set dev->hard_header_len when using
 header_ops

On Mon, 30 Nov 2020 17:19:11 +0100 Antoine Tenart wrote:
> syzkaller managed to crash the kernel using an NBMA ip6gre interface. I
> could reproduce it creating an NBMA ip6gre interface and forwarding
> traffic to it:
> 
>   skbuff: skb_under_panic: text:ffffffff8250e927 len:148 put:44 head:ffff8c03c7a33
>   ------------[ cut here ]------------
>   kernel BUG at net/core/skbuff.c:109!
>   Call Trace:
>   skb_push+0x10/0x10
>   ip6gre_header+0x47/0x1b0
>   neigh_connected_output+0xae/0xf0
> 
> ip6gre tunnel provides its own header_ops->create, and sets it
> conditionally when initializing the tunnel in NBMA mode. When
> header_ops->create is used, dev->hard_header_len should reflect the
> length of the header created. Otherwise, when not used,
> dev->needed_headroom should be used.
> 
> Fixes: eb95f52fc72d ("net: ipv6_gre: Fix GRO to work on IPv6 over GRE tap")
> Cc: Maria Pasechnik <mariap@...lanox.com>
> Signed-off-by: Antoine Tenart <atenart@...nel.org>

Applied, thank you!