lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20210524212938.jaepbj5qdl3esd4i@skbuf>
Date:   Tue, 25 May 2021 00:29:38 +0300
From:   Vladimir Oltean <olteanv@...il.com>
To:     George McCollister <george.mccollister@...il.com>
Cc:     netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Murali Karicheri <m-karicheri2@...com>,
        Taehee Yoo <ap420073@...il.com>,
        Kurt Kanzenbach <kurt@...utronix.de>,
        Luc Van Oostenryck <luc.vanoostenryck@...il.com>,
        Wang Hai <wanghai38@...wei.com>,
        Phillip Potter <phil@...lpotter.co.uk>,
        Andreas Oetken <andreas.oetken@...mens.com>,
        Marco Wenzel <marco.wenzel@...berle.de>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net: hsr: fix mac_len checks

Hi George,

On Mon, May 24, 2021 at 01:50:54PM -0500, George McCollister wrote:
> Commit 2e9f60932a2c ("net: hsr: check skb can contain struct hsr_ethhdr
> in fill_frame_info") added the following which resulted in -EINVAL
> always being returned:
> 	if (skb->mac_len < sizeof(struct hsr_ethhdr))
> 		return -EINVAL;
> 
> mac_len was not being set correctly so this check completely broke
> HSR/PRP since it was always 14, not 20.
> 
> Set mac_len correctly and modify the mac_len checks to test in the
> correct places since sometimes it is legitimately 14.
> 
> Fixes: 2e9f60932a2c ("net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info")
> Signed-off-by: George McCollister <george.mccollister@...il.com>
> ---

Tested-by: Vladimir Oltean <olteanv@...il.com>

pinging works properly now.

>  net/hsr/hsr_device.c  |  2 ++
>  net/hsr/hsr_forward.c | 30 +++++++++++++++++++++---------
>  net/hsr/hsr_forward.h |  8 ++++----
>  net/hsr/hsr_main.h    |  4 ++--
>  net/hsr/hsr_slave.c   | 11 +++++------
>  5 files changed, 34 insertions(+), 21 deletions(-)
> 
> diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
> index bfcdc75fc01e..26c32407f029 100644
> --- a/net/hsr/hsr_device.c
> +++ b/net/hsr/hsr_device.c
> @@ -218,6 +218,7 @@ static netdev_tx_t hsr_dev_xmit(struct sk_buff *skb, struct net_device *dev)
>  	if (master) {
>  		skb->dev = master->dev;
>  		skb_reset_mac_header(skb);
> +		skb_reset_mac_len(skb);
>  		hsr_forward_skb(skb, master);
>  	} else {
>  		atomic_long_inc(&dev->tx_dropped);
> @@ -259,6 +260,7 @@ static struct sk_buff *hsr_init_skb(struct hsr_port *master)
>  		goto out;
>  
>  	skb_reset_mac_header(skb);
> +	skb_reset_mac_len(skb);
>  	skb_reset_network_header(skb);
>  	skb_reset_transport_header(skb);
>  
> diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
> index 6852e9bccf5b..ceb8afb2a62f 100644
> --- a/net/hsr/hsr_forward.c
> +++ b/net/hsr/hsr_forward.c
> @@ -474,8 +474,8 @@ static void handle_std_frame(struct sk_buff *skb,
>  	}
>  }
>  
> -void hsr_fill_frame_info(__be16 proto, struct sk_buff *skb,
> -			 struct hsr_frame_info *frame)
> +int hsr_fill_frame_info(__be16 proto, struct sk_buff *skb,
> +			struct hsr_frame_info *frame)
>  {
>  	struct hsr_port *port = frame->port_rcv;
>  	struct hsr_priv *hsr = port->hsr;
> @@ -483,20 +483,26 @@ void hsr_fill_frame_info(__be16 proto, struct sk_buff *skb,
>  	/* HSRv0 supervisory frames double as a tag so treat them as tagged. */
>  	if ((!hsr->prot_version && proto == htons(ETH_P_PRP)) ||
>  	    proto == htons(ETH_P_HSR)) {
> +		/* Check if skb contains hsr_ethhdr */
> +		if (skb->mac_len < sizeof(struct hsr_ethhdr))
> +			return -EINVAL;
> +
>  		/* HSR tagged frame :- Data or Supervision */
>  		frame->skb_std = NULL;
>  		frame->skb_prp = NULL;
>  		frame->skb_hsr = skb;
>  		frame->sequence_nr = hsr_get_skb_sequence_nr(skb);
> -		return;
> +		return 0;
>  	}
>  
>  	/* Standard frame or PRP from master port */
>  	handle_std_frame(skb, frame);
> +
> +	return 0;
>  }
>  
> -void prp_fill_frame_info(__be16 proto, struct sk_buff *skb,
> -			 struct hsr_frame_info *frame)
> +int prp_fill_frame_info(__be16 proto, struct sk_buff *skb,
> +			struct hsr_frame_info *frame)
>  {
>  	/* Supervision frame */
>  	struct prp_rct *rct = skb_get_PRP_rct(skb);
> @@ -507,9 +513,11 @@ void prp_fill_frame_info(__be16 proto, struct sk_buff *skb,
>  		frame->skb_std = NULL;
>  		frame->skb_prp = skb;
>  		frame->sequence_nr = prp_get_skb_sequence_nr(rct);
> -		return;
> +		return 0;
>  	}
>  	handle_std_frame(skb, frame);
> +
> +	return 0;
>  }
>  
>  static int fill_frame_info(struct hsr_frame_info *frame,
> @@ -519,9 +527,10 @@ static int fill_frame_info(struct hsr_frame_info *frame,
>  	struct hsr_vlan_ethhdr *vlan_hdr;
>  	struct ethhdr *ethhdr;
>  	__be16 proto;
> +	int ret;
>  
> -	/* Check if skb contains hsr_ethhdr */
> -	if (skb->mac_len < sizeof(struct hsr_ethhdr))
> +	/* Check if skb contains ethhdr */
> +	if (skb->mac_len < sizeof(struct ethhdr))
>  		return -EINVAL;
>  
>  	memset(frame, 0, sizeof(*frame));
> @@ -548,7 +557,10 @@ static int fill_frame_info(struct hsr_frame_info *frame,
>  
>  	frame->is_from_san = false;
>  	frame->port_rcv = port;
> -	hsr->proto_ops->fill_frame_info(proto, skb, frame);
> +	ret = hsr->proto_ops->fill_frame_info(proto, skb, frame);

Nitpick: hsr uses "res", not "ret".

> +	if (ret)
> +		return ret;
> +
>  	check_local_dest(port->hsr, skb, frame);
>  
>  	return 0;
> diff --git a/net/hsr/hsr_forward.h b/net/hsr/hsr_forward.h
> index b6acaafa83fc..206636750b30 100644
> --- a/net/hsr/hsr_forward.h
> +++ b/net/hsr/hsr_forward.h
> @@ -24,8 +24,8 @@ struct sk_buff *prp_get_untagged_frame(struct hsr_frame_info *frame,
>  				       struct hsr_port *port);
>  bool prp_drop_frame(struct hsr_frame_info *frame, struct hsr_port *port);
>  bool hsr_drop_frame(struct hsr_frame_info *frame, struct hsr_port *port);
> -void prp_fill_frame_info(__be16 proto, struct sk_buff *skb,
> -			 struct hsr_frame_info *frame);
> -void hsr_fill_frame_info(__be16 proto, struct sk_buff *skb,
> -			 struct hsr_frame_info *frame);
> +int prp_fill_frame_info(__be16 proto, struct sk_buff *skb,
> +			struct hsr_frame_info *frame);
> +int hsr_fill_frame_info(__be16 proto, struct sk_buff *skb,
> +			struct hsr_frame_info *frame);
>  #endif /* __HSR_FORWARD_H */
> diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h
> index 8f264672b70b..53d1f7a82463 100644
> --- a/net/hsr/hsr_main.h
> +++ b/net/hsr/hsr_main.h
> @@ -186,8 +186,8 @@ struct hsr_proto_ops {
>  					       struct hsr_port *port);
>  	struct sk_buff * (*create_tagged_frame)(struct hsr_frame_info *frame,
>  						struct hsr_port *port);
> -	void (*fill_frame_info)(__be16 proto, struct sk_buff *skb,
> -				struct hsr_frame_info *frame);
> +	int (*fill_frame_info)(__be16 proto, struct sk_buff *skb,
> +			       struct hsr_frame_info *frame);
>  	bool (*invalid_dan_ingress_frame)(__be16 protocol);
>  	void (*update_san_info)(struct hsr_node *node, bool is_sup);
>  };
> diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
> index c5227d42faf5..b70e6bbf6021 100644
> --- a/net/hsr/hsr_slave.c
> +++ b/net/hsr/hsr_slave.c
> @@ -60,12 +60,11 @@ static rx_handler_result_t hsr_handle_frame(struct sk_buff **pskb)
>  		goto finish_pass;
>  
>  	skb_push(skb, ETH_HLEN);
> -
> -	if (skb_mac_header(skb) != skb->data) {
> -		WARN_ONCE(1, "%s:%d: Malformed frame at source port %s)\n",
> -			  __func__, __LINE__, port->dev->name);
> -		goto finish_consume;
> -	}
> +	skb_reset_mac_header(skb);
> +	if ((!hsr->prot_version && protocol == htons(ETH_P_PRP)) ||
> +	    protocol == htons(ETH_P_HSR))
> +		skb_set_network_header(skb, ETH_HLEN + HSR_HLEN);
> +	skb_reset_mac_len(skb);
>  
>  	hsr_forward_skb(skb, port);
>  
> -- 
> 2.11.0
> 

I admit that I went through both patches and I still don't understand
what is the code path that the original commit 2e9f60932a2c ("net: hsr:
check skb can contain struct hsr_ethhdr in fill_frame_info") is
protecting against. I ran the C reproducer linked by syzbot too and I
did not reproduce it (I did not compile with the linked clang though).

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ