Re: net: GPF in eth_header
From: Eric Dumazet <hidden>
Date: 2016-11-28 21:19:18
Also in:
lkml
Subsystem:
networking [general], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
On Mon, 2016-11-28 at 13:05 -0800, Eric Dumazet wrote:
quoted hunk ↗ jump to hunk
On Mon, 2016-11-28 at 11:47 -0800, Eric Dumazet wrote:quoted
On Mon, 2016-11-28 at 20:34 +0100, Dmitry Vyukov wrote:quoted
On Mon, Nov 28, 2016 at 8:04 PM, 'Andrey Konovalov' via syzkallerquoted
quoted
Hi Eric, As far as I can see, skb_network_offset() becomes negative after pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data) in nf_ct_frag6_queue(). At least I'm able to detect that with a BUG_ON(). Also it seems that the issue is only reproducible (at least with the poc I provided) for a short time after boot.Eric, Is it enough to debug? Or maybe Andrey can trace some values for you.Well, now we are talking, if you tell me how many modules you load, it might help ;) nf_ct_frag6_queue is nowhere to be seen in my kernels, that might explain why I could not reproduce the bug. Let me try ;)Might be a bug added in commit daaa7d647f81f3 ("netfilter: ipv6: avoid nf_iterate recursion") Florian, what do you think of dropping a packet that presumably was mangled badly by nf_ct_frag6_queue() ? (Like about 48 byte pulled :(, and/or skb->csum changed )diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index f7aab5ab93a5..31aa947332d8 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c@@ -65,8 +65,8 @@ static unsigned int ipv6_defrag(void *priv, err = nf_ct_frag6_gather(state->net, skb, nf_ct6_defrag_user(state->hook, skb)); - /* queued */ - if (err == -EINPROGRESS) + /* queued or mangled ... */ + if (err) return NF_STOLEN;
Or more exactly , returning NF_DROP so that skb is really freed ;)
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
index f7aab5ab93a5..508739a3ca2a 100644
--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
+++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c@@ -65,9 +65,9 @@ static unsigned int ipv6_defrag(void *priv, err = nf_ct_frag6_gather(state->net, skb, nf_ct6_defrag_user(state->hook, skb)); - /* queued */ - if (err == -EINPROGRESS) - return NF_STOLEN; + /* queued or mangled ... */ + if (err) + return (err == -EINPROGRESS) ? NF_STOLEN : NF_DROP; return NF_ACCEPT; }