netdev - Re: [PATCH net 1/2] tunnels: fix kasan splat when generating ipv4 pmtu error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZM31Mnl3yhYLMouc@vergenet.net>
Date: Sat, 5 Aug 2023 09:07:30 +0200
From: Simon Horman <horms@...nel.org>
To: Florian Westphal <fw@...len.de>
Cc: netdev@...r.kernel.org, sbrivio@...hat.com,
	"David S. Miller" <davem@...emloft.net>, dsahern@...nel.org,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	shuah@...nel.org
Subject: Re: [PATCH net 1/2] tunnels: fix kasan splat when generating ipv4
 pmtu error

On Thu, Aug 03, 2023 at 05:26:49PM +0200, Florian Westphal wrote:
> If we try to emit an icmp error in response to a nonliner skb, we get
> 
> BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220
> Read of size 4 at addr ffff88811c50db00 by task iperf3/1691
> CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309
> [..]
>  kasan_report+0x105/0x140
>  ip_compute_csum+0x134/0x220
>  iptunnel_pmtud_build_icmp+0x554/0x1020
>  skb_tunnel_check_pmtu+0x513/0xb80
>  vxlan_xmit_one+0x139e/0x2ef0
>  vxlan_xmit+0x1867/0x2760
>  dev_hard_start_xmit+0x1ee/0x4f0
>  br_dev_queue_push_xmit+0x4d1/0x660
>  [..]
> 
> ip_compute_csum() cannot deal with nonlinear skbs, so avoid it.
> After this change, splat is gone and iperf3 is no longer stuck.

Hi Florian,

I wonder if there are other cases lurking elsewhere.
Did you happen to take a look at that?

> Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
> Signed-off-by: Florian Westphal <fw@...len.de>
> ---
>  net/ipv4/ip_tunnel_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
> index 92c02c886fe7..586b1b3e35b8 100644
> --- a/net/ipv4/ip_tunnel_core.c
> +++ b/net/ipv4/ip_tunnel_core.c
> @@ -224,7 +224,7 @@ static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu)
>  		.un.frag.__unused	= 0,
>  		.un.frag.mtu		= htons(mtu),
>  	};
> -	icmph->checksum = ip_compute_csum(icmph, len);
> +	icmph->checksum = csum_fold(skb_checksum(skb, 0, len, 0));
>  	skb_reset_transport_header(skb);
>  
>  	niph = skb_push(skb, sizeof(*niph));
> -- 
> 2.41.0
> 
>