| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 29 Nov 2023 11:04:42 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: syzbot <syzbot+2cb7b1bd08dc77ae7f89@...kaller.appspotmail.com>,
Shigeru Yoshida <syoshida@...hat.com>
Cc: davem@...emloft.net, dsahern@...nel.org, kuba@...nel.org,
linux-kernel@...r.kernel.org, netdev@...r.kernel.org, pabeni@...hat.com,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] KMSAN: uninit-value in ipgre_xmit
On Wed, Nov 29, 2023 at 11:00 AM syzbot
<syzbot+2cb7b1bd08dc77ae7f89@...kaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 18d46e76d7c2 Merge tag 'for-6.7-rc3-tag' of git://git.kern..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1412e7e8e80000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f711bc2a7eb1db25
> dashboard link: https://syzkaller.appspot.com/bug?extid=2cb7b1bd08dc77ae7f89
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: i386
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/cb96093de792/disk-18d46e76.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/630ca4e2d778/vmlinux-18d46e76.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/65573a727973/bzImage-18d46e76.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2cb7b1bd08dc77ae7f89@...kaller.appspotmail.com
>
> =====================================================
> BUG: KMSAN: uninit-value in __gre_xmit net/ipv4/ip_gre.c:469 [inline]
> BUG: KMSAN: uninit-value in ipgre_xmit+0xdc2/0xe20 net/ipv4/ip_gre.c:662
> __gre_xmit net/ipv4/ip_gre.c:469 [inline]
> ipgre_xmit+0xdc2/0xe20 net/ipv4/ip_gre.c:662
> __netdev_start_xmit include/linux/netdevice.h:4940 [inline]
> netdev_start_xmit include/linux/netdevice.h:4954 [inline]
> xmit_one net/core/dev.c:3545 [inline]
> dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3561
> __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4346
> dev_queue_xmit include/linux/netdevice.h:3134 [inline]
> __bpf_tx_skb net/core/filter.c:2133 [inline]
> __bpf_redirect_no_mac net/core/filter.c:2163 [inline]
> __bpf_redirect+0xdd7/0x1600 net/core/filter.c:2186
> ____bpf_clone_redirect net/core/filter.c:2457 [inline]
> bpf_clone_redirect+0x328/0x470 net/core/filter.c:2429
> ___bpf_prog_run+0x2180/0xdb80 kernel/bpf/core.c:1958
> __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2199
> bpf_dispatcher_nop_func include/linux/bpf.h:1196 [inline]
> __bpf_prog_run include/linux/filter.h:651 [inline]
> bpf_prog_run include/linux/filter.h:658 [inline]
> bpf_test_run+0x482/0xb00 net/bpf/test_run.c:423
> bpf_prog_test_run_skb+0x14e5/0x1f20 net/bpf/test_run.c:1045
> bpf_prog_test_run+0x6af/0xac0 kernel/bpf/syscall.c:4040
> __sys_bpf+0x649/0xd60 kernel/bpf/syscall.c:5401
> __do_sys_bpf kernel/bpf/syscall.c:5487 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5485 [inline]
> __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5485
> do_syscall_32_irqs_on arch/x86/entry/common.c:164 [inline]
> __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:230
> do_fast_syscall_32+0x37/0x70 arch/x86/entry/common.c:255
> do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:293
> entry_SYSENTER_compat_after_hwframe+0x70/0x7a
>
> Uninit was created at:
> slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
> slab_alloc_node mm/slub.c:3478 [inline]
> kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523
> kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560
> pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098
> skb_ensure_writable+0x3d3/0x460 net/core/skbuff.c:5958
> __bpf_try_make_writable net/core/filter.c:1662 [inline]
> bpf_try_make_writable net/core/filter.c:1668 [inline]
> bpf_try_make_head_writable net/core/filter.c:1676 [inline]
> ____bpf_clone_redirect net/core/filter.c:2451 [inline]
> bpf_clone_redirect+0x17f/0x470 net/core/filter.c:2429
> ___bpf_prog_run+0x2180/0xdb80 kernel/bpf/core.c:1958
> __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2199
> bpf_dispatcher_nop_func include/linux/bpf.h:1196 [inline]
> __bpf_prog_run include/linux/filter.h:651 [inline]
> bpf_prog_run include/linux/filter.h:658 [inline]
> bpf_test_run+0x482/0xb00 net/bpf/test_run.c:423
> bpf_prog_test_run_skb+0x14e5/0x1f20 net/bpf/test_run.c:1045
> bpf_prog_test_run+0x6af/0xac0 kernel/bpf/syscall.c:4040
> __sys_bpf+0x649/0xd60 kernel/bpf/syscall.c:5401
> __do_sys_bpf kernel/bpf/syscall.c:5487 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5485 [inline]
> __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5485
> do_syscall_32_irqs_on arch/x86/entry/common.c:164 [inline]
> __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:230
> do_fast_syscall_32+0x37/0x70 arch/x86/entry/common.c:255
> do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:293
> entry_SYSENTER_compat_after_hwframe+0x70/0x7a
>
> CPU: 1 PID: 8859 Comm: syz-executor.2 Not tainted 6.7.0-rc3-syzkaller-00024-g18d46e76d7c2 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
> =====================================================
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@...glegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
Fix under discussion would be:
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 22a26d1d29a09d234f18ce3b0f329e5047c0c046..5169c3c72cffe49cef613e69889d139db867ff74
100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -635,15 +635,18 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
}
if (dev->header_ops) {
+ int pull_len = tunnel->hlen + sizeof(struct iphdr);
+
if (skb_cow_head(skb, 0))
goto free_skb;
tnl_params = (const struct iphdr *)skb->data;
- /* Pull skb since ip_tunnel_xmit() needs skb->data pointing
- * to gre header.
- */
- skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
+ if (!pskb_network_may_pull(skb, pull_len))
+ goto free_skb;
+
+ /* ip_tunnel_xmit() needs skb->data pointing to gre header. */
+ skb_pull(skb, pull_len);
skb_reset_mac_header(skb);
if (skb->ip_summed == CHECKSUM_PARTIAL &&
Powered by blists - more mailing lists