Dong Chenchen
28a57fb2c5
net: iptunnel: fix stale transport header during tunnel decapsulation
...
Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale
transport_header offset after tunnel decapsulation.
BUG: unable to handle page fault for address: ffffed102091a42e
Oops: Oops: 0000 [#1 ] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__asan_load2
<IRQ>
qdisc_pkt_len_segs_init (net/core/dev.c:4145)
__dev_queue_xmit (net/core/dev.c:4787)
br_dev_queue_push_xmit (net/bridge/br_forward.c:53)
br_handle_frame_finish (net/bridge/br_input.c:229)
br_handle_frame (net/bridge/br_input.c:315)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6099)
__netif_receive_skb_list_core (net/core/dev.c:6287)
netif_receive_skb_list_internal (net/core/dev.c:6445)
napi_complete_done (net/core/dev.c:6813)
gro_cell_poll (net/core/gro_cells.c:74)
__napi_poll (net/core/dev.c:7735)
net_rx_action (net/core/dev.c:7798 net/core/dev.c:7955)
handle_softirqs (kernel/softirq.c:622)
do_softirq (kernel/softirq.c:523 kernel/softirq.c:510 )
__local_bh_enable_ip (kernel/softirq.c:450)
tun_get_user (drivers/net/tun.c:1986 (discriminator 1))
tun_chr_write_iter (drivers/net/tun.c:2032)
The issue is completely latent until qdisc read transport header in
commit 7fb4c19670 ("net: pull headers in qdisc_pkt_len_segs_init()").
The crash requires four conditions to line up:
1. The incoming packet is encapsulated and carries GSO metadata. The outer
transport header offset is stored in skb->transport_header while the
packet is still in the outer tunnel context.
2. The tunnel receiver strips the outer headers. skb->data is advanced to
the inner frame, but skb->transport_header is left pointing to the
now-removed outer L4 header, so it becomes a negative offset relative to
the new data.
3. The inner frame is not delivered to the local IP stack. Instead, it
is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and
the transport header is not reset to the inner L4 offset.
4. The forwarding path calls __dev_queue_xmit(), which enters
qdisc_pkt_len_segs_init(). That function computes the GSO header length
from skb_transport_offset(skb). Because the offset is negative, the
unsigned cast overflows and pskb_may_pull(skb, hdr_len +
sizeof(struct tcphdr)) reads past the end of the skb, triggering a
KASAN fault or page fault.
The issue specifically requires GSO packets (shinfo->gso_size != 0), which
are processed/aggregated through gro_cells. Fix this by clearing
transport_header to the ~0U sentinel in gro_cell for all tunnnel driver.
GTP does not support GRO/GSO, drop the evil GSO packets in GTP directly.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+83181a31faf9455499c5@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69de2bee.a00a0220.475f0.0041.GAE@google.com/T/
Suggested-by: Eric Dumazet <edumazet@google.com >
Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com >
Reviewed-by: Eric Dumazet <edumazet@google.com >
Link: https://patch.msgid.link/20260825123909.1463121-1-dongchenchen2@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org >
2026-08-28 15:53:46 -07:00
..
2026-07-03 07:38:16 +02:00
2026-07-17 12:46:24 +02:00
2026-07-23 10:24:12 -07:00
2026-08-07 14:18:13 -03:00
2026-07-16 09:12:24 +02:00
2026-07-03 07:38:16 +02:00
2026-08-20 16:51:33 -07:00
2026-07-03 07:38:14 +02:00
2026-08-21 11:23:20 -07:00
2026-08-24 12:21:15 -07:00
2026-08-25 14:03:31 -07:00
2026-08-17 19:04:16 -07:00
2026-08-20 08:16:04 -07:00
2026-07-30 11:05:07 +02:00
2026-07-17 16:14:13 +02:00
2026-08-23 13:28:57 -07:00
2026-08-26 14:21:30 -07:00
2026-08-09 14:48:47 -07:00
2026-08-17 17:02:10 +02:00
2026-08-20 10:23:53 +02:00
2026-08-03 21:53:54 +03:00
2026-08-10 09:54:35 -04:00
2026-08-27 10:45:08 -07:00
2026-07-17 15:50:48 +02:00
2026-08-27 13:53:43 -07:00
2026-07-27 16:03:40 -07:00
2026-07-17 17:47:41 +02:00
2026-08-12 13:56:51 -07:00
2026-08-06 11:53:47 -07:00
2026-08-05 17:59:29 -07:00
2026-07-21 21:40:35 +00:00
2026-08-27 10:45:08 -07:00
2026-07-27 20:32:38 +02:00
2026-08-26 10:05:45 +02:00
2026-07-03 07:38:16 +02:00
2026-08-22 16:29:20 -07:00
2026-08-25 14:03:31 -07:00
2026-08-24 12:16:16 -07:00
2026-08-10 18:00:47 +01:00
2026-07-17 12:46:24 +02:00
2026-08-21 11:48:54 -07:00
2026-07-03 07:38:16 +02:00
2026-07-03 07:38:16 +02:00
2026-08-25 10:44:46 -07:00
2026-07-09 15:30:19 +02:00
2026-07-21 23:04:13 +02:00
2026-08-18 08:47:09 -07:00
2026-07-30 19:40:44 -07:00
2026-08-24 10:16:35 -07:00
2026-07-15 12:13:30 +02:00
2026-08-02 09:21:06 +00:00
2026-06-17 11:21:40 -07:00
2026-08-19 12:31:50 -07:00
2026-07-29 17:54:58 -07:00
2026-07-03 07:38:16 +02:00
2026-08-04 19:18:48 -07:00
2026-08-03 23:36:18 +02:00
2026-08-03 19:15:44 +02:00
2026-08-04 07:22:27 -06:00
2026-08-15 17:09:32 -06:00
2026-07-22 15:38:38 -04:00
2026-07-22 15:38:36 -04:00
2026-08-04 06:57:05 -06:00
2026-08-20 13:55:16 -07:00
2026-08-15 17:15:08 -06:00
2026-07-20 10:39:26 -07:00
2026-08-20 13:55:16 -07:00
2026-07-02 21:15:45 +09:00
2026-08-15 23:36:18 +02:00
2026-06-30 16:31:56 +02:00
2026-08-17 10:06:42 +02:00
2026-08-15 11:11:16 -07:00
2026-08-20 07:36:20 -07:00
2026-07-27 16:25:34 +02:00
2026-08-06 06:47:33 -06:00
2026-08-06 23:38:03 +02:00
2026-07-26 03:11:00 -04:00
2026-06-24 11:09:22 -10:00
2026-08-21 08:41:00 -07:00
2026-08-20 16:51:47 -07:00
2026-07-28 11:25:30 -04:00
2026-06-15 13:51:27 +05:30
2026-08-24 18:43:12 -07:00
2026-08-06 18:57:24 -07:00
2026-06-15 14:21:14 +05:30
2026-06-15 14:21:14 +05:30
2026-06-15 05:01:15 +05:30
2026-07-15 07:15:26 +02:00
2026-06-22 12:20:21 -07:00
2026-07-15 17:44:59 +02:00
2026-07-15 15:06:34 +02:00
2026-07-22 15:38:37 -04:00
2026-08-22 16:40:23 -07:00
2026-06-30 18:49:06 +03:00
2026-06-30 18:49:06 +03:00
2026-07-07 15:10:48 -04:00
2026-08-06 18:57:22 -07:00
2026-07-15 15:04:55 +02:00
2026-06-29 00:59:24 +02:00
2026-07-03 07:38:16 +02:00
2026-08-05 17:41:38 -07:00
2026-07-27 23:09:28 +02:00
2026-07-31 08:40:59 +02:00
2026-07-02 09:27:51 +02:00
2026-07-01 16:52:48 +02:00
2026-07-31 08:40:58 +02:00
2026-07-31 08:40:58 +02:00
2026-07-17 18:00:34 +05:30
2026-08-10 10:04:07 +02:00
2026-07-03 07:38:16 +02:00
2026-06-13 13:24:34 -07:00
2026-08-20 14:49:39 +03:00
2026-07-03 07:38:16 +02:00
2026-07-20 20:38:40 +02:00
2026-08-20 13:04:44 -07:00
2026-07-27 18:23:07 -07:00
2026-08-24 18:43:09 -07:00
2026-06-22 19:52:36 +00:00
2026-06-09 16:00:11 +02:00
2026-06-15 03:59:45 +05:30
2026-08-13 04:36:30 +02:00
2026-07-03 07:38:16 +02:00
2026-08-02 19:25:47 -07:00
2026-08-21 09:49:54 -07:00
2026-06-18 16:39:31 -07:00
2026-06-29 10:44:05 +02:00
2026-08-27 09:17:06 -07:00
2026-07-20 10:39:26 -07:00
2026-06-15 02:50:44 +05:30
2026-08-16 00:16:32 +02:00
2026-07-30 16:16:01 +02:00
2026-07-30 19:40:44 -07:00
2026-08-06 18:57:11 -07:00
2026-07-07 10:42:28 -04:00
2026-07-03 13:01:52 +02:00
2026-07-24 20:12:40 +02:00
2026-08-06 16:58:54 +05:30
2026-08-10 10:50:19 +02:00
2026-07-20 12:17:57 -07:00
2026-06-29 23:24:46 +01:00
2026-08-19 09:27:26 +02:00
2026-08-04 19:18:54 -07:00
2026-08-11 18:11:20 +02:00
2026-07-07 23:43:45 +02:00
2026-07-07 23:43:45 +02:00
2026-08-06 18:57:16 -07:00
2026-07-28 21:11:48 -07:00
2026-08-04 19:19:06 -07:00
2026-08-10 08:59:43 -07:00
2026-07-31 16:32:38 +02:00
2026-08-24 00:35:41 +00:00
2026-07-29 20:51:16 +02:00
2026-06-17 00:15:09 +02:00
2026-07-03 07:38:16 +02:00
2026-07-27 16:03:40 -07:00
2026-07-21 19:18:52 +02:00
2026-07-07 10:16:31 +02:00
2026-08-07 17:29:15 -07:00
2026-07-08 14:41:01 +02:00
2026-06-29 10:44:05 +02:00
2026-08-05 23:01:44 -07:00
2026-06-15 02:13:01 +03:00
2026-07-03 07:38:16 +02:00
2026-08-10 10:50:18 +02:00
2026-08-25 07:59:44 -07:00
2026-08-20 13:55:16 -07:00
2026-07-26 13:16:21 -03:00
2026-06-23 12:08:51 -05:00
2026-07-03 07:38:16 +02:00
2026-07-12 12:38:01 +02:00
2026-07-07 21:36:18 +02:00
2026-07-03 07:38:16 +02:00
2026-07-22 23:47:23 -04:00
2026-07-31 10:32:24 +02:00
2026-06-15 16:33:40 +02:00
2026-08-10 10:50:19 +02:00
2026-08-04 09:25:55 +03:00
2026-07-01 13:02:31 +03:00
2026-08-04 09:22:36 +03:00
2026-07-11 20:38:01 +02:00
2026-06-30 00:15:52 +01:00
2026-08-18 13:41:51 +02:00
2026-08-17 10:17:13 +02:00
2026-08-04 19:18:36 -07:00
2026-06-17 11:28:52 +01:00
2026-07-23 14:08:22 +01:00
2026-08-19 12:31:50 -07:00
2026-08-19 06:38:45 -04:00
2026-06-08 18:21:24 -07:00
2026-08-23 08:07:11 -07:00
2026-07-25 15:26:30 +03:00
2026-08-05 11:20:13 -07:00
2026-08-24 18:43:28 -07:00
2026-08-24 18:43:28 -07:00
2026-07-31 10:09:12 +02:00
2026-08-04 12:35:02 -04:00
2026-08-24 18:43:32 -07:00
2026-06-30 00:15:52 +01:00
2026-07-03 07:38:16 +02:00
2026-07-17 15:43:32 +02:00
2026-07-03 07:38:16 +02:00
2026-08-04 09:29:03 +03:00
2026-08-27 09:17:06 -07:00
2026-08-06 18:57:01 -07:00
2026-08-06 18:56:59 -07:00
2026-08-06 18:56:58 -07:00
2026-07-30 07:19:51 +02:00
2026-08-07 16:13:17 +02:00
2026-07-28 21:11:50 -07:00
2026-07-28 21:11:50 -07:00
2026-08-06 18:57:20 -07:00
2026-08-24 18:43:11 -07:00
2026-08-24 18:42:50 -07:00
2026-08-24 18:40:27 -07:00
2026-08-24 18:43:06 -07:00
2026-07-16 22:40:17 -04:00
2026-08-06 13:29:03 +02:00
2026-07-31 14:19:04 +02:00
2026-06-11 15:17:30 -07:00
2026-07-23 15:42:48 +02:00
2026-07-30 15:42:58 -07:00
2026-08-20 08:16:04 -07:00
2026-06-12 16:43:10 -07:00
2026-08-17 10:27:48 -07:00
2026-07-02 12:17:14 +02:00
2026-08-12 16:24:26 +02:00
2026-07-30 12:14:39 +02:00
2026-08-26 15:09:21 -07:00
2026-08-27 09:17:06 -07:00
2026-08-20 15:18:20 -07:00
2026-08-23 08:07:11 -07:00
2026-07-22 15:38:37 -04:00
2026-06-26 22:18:34 -04:00
2026-07-06 11:13:43 -07:00
2026-07-31 11:00:13 +02:00
2026-07-21 10:53:24 +02:00
2026-08-07 18:27:18 +02:00
2026-08-07 18:27:18 +02:00
2026-08-11 18:54:17 -05:00
2026-07-03 07:38:16 +02:00
2026-08-11 16:54:37 -05:00
2026-07-03 07:38:16 +02:00
2026-07-28 21:12:04 -07:00
2026-08-24 18:43:03 -07:00
2026-07-28 21:11:50 -07:00
2026-07-09 15:48:56 -07:00
2026-07-28 21:11:47 -07:00
2026-08-24 18:42:50 -07:00
2026-08-23 12:44:10 -07:00
2026-07-20 14:59:56 +02:00
2026-07-03 07:38:16 +02:00
2026-08-23 12:44:10 -07:00
2026-08-23 12:44:10 -07:00
2026-08-24 18:43:24 -07:00
2026-07-28 21:11:55 -07:00
2026-06-11 13:41:25 +02:00
2026-06-16 08:44:43 +05:30
2026-07-28 21:11:46 -07:00
2026-08-04 19:18:36 -07:00
2026-06-09 10:13:04 -07:00
2026-07-31 18:22:48 -07:00
2026-08-13 18:21:31 -07:00
2026-06-10 11:08:23 +02:00
2026-08-12 11:36:41 +02:00
2026-08-10 01:20:05 +02:00
2026-07-03 07:38:16 +02:00
2026-07-20 16:05:42 +02:00
2026-08-11 18:11:19 +02:00
2026-08-07 02:43:11 +02:00
2026-08-03 21:10:10 -07:00
2026-08-10 10:50:19 +02:00
2026-07-23 23:08:04 +02:00
2026-07-15 05:00:53 -10:00
2026-07-05 13:25:36 +08:00
2026-08-07 17:29:16 -07:00
2026-07-12 12:38:02 +02:00
2026-07-28 21:12:01 -07:00
2026-07-12 12:38:00 +02:00
2026-08-05 11:20:12 -07:00
2026-08-05 11:20:12 -07:00
2026-07-24 16:54:07 -07:00
2026-08-14 15:43:51 -07:00
2026-07-23 10:46:09 -07:00
2026-08-24 10:58:57 -07:00
2026-07-23 10:46:09 -07:00
2026-07-23 10:46:09 -07:00
2026-07-23 19:21:13 +01:00
2026-08-04 17:32:02 -05:00
2026-07-23 13:10:52 -07:00
2026-07-28 15:59:03 +02:00
2026-06-15 03:05:50 +05:30
2026-07-05 13:19:51 +08:00
2026-07-03 07:38:16 +02:00
2026-08-24 18:42:54 -07:00
2026-07-28 15:42:31 +02:00
2026-07-03 07:38:16 +02:00
2026-08-04 17:32:02 -05:00
2026-08-10 09:37:54 +02:00
2026-06-23 00:13:21 +02:00
2026-07-11 12:57:49 +02:00
2026-07-13 13:15:02 +02:00
2026-08-27 09:17:06 -07:00
2026-07-12 12:38:02 +02:00
2026-07-31 10:09:14 +02:00
2026-08-03 16:51:57 +02:00
2026-08-03 16:51:57 +02:00
2026-06-29 12:06:07 +02:00
2026-07-03 07:38:16 +02:00
2026-08-24 18:43:14 -07:00
2026-08-28 15:53:46 -07:00
2026-07-15 11:10:14 +02:00
2026-08-24 15:01:27 +02:00
2026-07-03 07:38:16 +02:00
2026-07-16 09:24:55 +02:00
2026-08-15 23:36:18 +02:00
2026-08-10 10:50:18 +02:00
2026-08-10 10:50:18 +02:00
2026-08-10 10:50:18 +02:00
2026-08-10 10:50:18 +02:00
2026-08-23 18:00:22 -07:00
2026-07-15 15:34:25 -07:00
2026-07-15 15:34:25 -07:00
2026-08-05 11:20:13 -07:00
2026-08-12 11:36:39 +02:00
2026-07-31 10:32:24 +02:00
2026-07-31 12:35:26 +02:00
2026-06-18 16:39:31 -07:00
2026-08-24 18:43:20 -07:00
2026-08-24 18:43:20 -07:00
2026-08-24 18:43:26 -07:00
2026-08-24 11:35:46 -07:00
2026-07-27 22:02:57 +02:00
2026-07-08 10:22:00 +02:00
2026-07-08 10:22:00 +02:00
2026-07-27 17:18:00 +02:00
2026-08-05 15:28:23 +02:00
2026-06-12 14:03:41 +02:00
2026-08-03 21:10:11 -07:00
2026-08-12 18:24:31 -07:00
2026-07-03 07:38:16 +02:00
2026-08-19 10:01:59 +02:00
2026-08-23 10:26:44 -07:00
2026-08-11 18:11:20 +02:00
2026-08-11 18:11:20 +02:00
2026-07-15 15:04:55 +02:00
2026-07-28 07:18:48 -04:00
2026-07-07 10:42:29 -04:00
2026-08-24 10:58:57 -07:00
2026-06-21 13:20:19 -07:00
2026-07-22 13:47:02 +02:00
2026-07-31 08:10:49 -06:00
2026-07-31 16:22:52 -04:00
2026-08-03 10:09:08 +02:00
2026-07-13 07:09:28 +02:00
2026-08-03 23:36:18 +02:00
2026-08-06 18:57:25 -07:00
2026-08-05 15:28:23 +02:00
2026-07-15 10:49:03 +02:00
2026-06-29 13:46:50 -06:00
2026-07-14 12:05:01 -03:00
2026-08-19 06:38:45 -04:00
2026-08-27 15:47:17 +02:00
2026-08-19 06:38:44 -04:00
2026-08-24 18:43:15 -07:00
2026-08-24 18:43:00 -07:00
2026-07-30 19:40:28 -07:00
2026-08-24 18:42:56 -07:00
2026-06-15 16:33:40 +02:00
2026-08-20 18:26:42 +02:00
2026-08-20 18:26:42 +02:00
2026-07-03 07:38:16 +02:00
2026-08-17 09:02:07 -07:00
2026-07-28 21:11:55 -07:00
2026-07-03 07:38:16 +02:00