Re: [PATCH net] ipv6: Fix dangling pointer when ipv6 fragment
From: Eric Dumazet <hidden>
Date: 2019-03-30 07:48:15
Also in:
lkml
On 03/30/2019 12:29 AM, hujunwei wrote:
From: Junwei Hu <redacted>
At the beginning of ip6_fragment func, the prevhdr pointer is
obtained in the ip6_find_1stfragopt func.
However, all the pointers pointing into skb header may change
when calling skb_checksum_help func with
skb->ip_summed = CHECKSUM_PARTIAL condition.
The prevhdr pointe will be dangling if it is not reloaded after
calling __skb_linearize func in skb_checksum_help func.
Here, I add a variable, nexthdr_offset, to evaluate the offset,
which does not changes even after calling __skb_linearize func.
Fixes: 405c92f7a541 ("ipv6: add defensive check for CHECKSUM_PARTIAL skbs in ip_fragment")
Signed-off-by: Junwei Hu <redacted>
Reported-by: Wenhao Zhang <redacted>
Reviewed-by: Zhiqiang Liu <redacted>Interesting. We got a syzbot report yesterday about this issue. (email thread : BUG: unable to handle kernel paging request in ip6_fragment) <quote> syzbot found the following crash on: HEAD commit: 8c838f53 dpaa2-eth: fix race condition with bql frame acco.. git tree: net console output: https://syzkaller.appspot.com/x/log.txt?x=12b83a9b200000 kernel config: https://syzkaller.appspot.com/x/.config?x=f05902bca21d8935 dashboard link: https://syzkaller.appspot.com/bug?extid=e8ce541d095e486074fc compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+e8ce541d095e486074fc@syzkaller.appspotmail.com </quote>
quoted hunk ↗ jump to hunk
--- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+)diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index edbd12067170..6db3c60b3b66 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c@@ -606,12 +606,14 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,__be32 frag_id; int ptr, offset = 0, err = 0; u8 *prevhdr, nexthdr = 0; + u8 nexthdr_offset; err = ip6_find_1stfragopt(skb, &prevhdr); if (err < 0) goto fail; hlen = err; nexthdr = *prevhdr; + nexthdr_offset = prevhdr - skb_network_header(skb); mtu = ip6_skb_dst_mtu(skb);@@ -646,6 +648,8 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,(err = skb_checksum_help(skb))) goto fail; + prevhdr = skb_network_header(skb) + nexthdr_offset; + hroom = LL_RESERVED_SPACE(rt->dst.dev); if (skb_has_frag_list(skb)) { unsigned int first_len = skb_pagelen(skb);