Files
linux/include/linux
Eric Dumazet 61431a5907 net: ensure mac header is set in virtio_net_hdr_to_skb()
Commit 924a9bc362 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct")
added a call to dev_parse_header_protocol() but mac_header is not yet set.

This means that eth_hdr() reads complete garbage, and syzbot complained about it [1]

This patch resets mac_header earlier, to get more coverage about this change.

Audit of virtio_net_hdr_to_skb() callers shows that this change should be safe.

[1]

BUG: KASAN: use-after-free in eth_header_parse_protocol+0xdc/0xe0 net/ethernet/eth.c:282
Read of size 2 at addr ffff888017a6200b by task syz-executor313/8409

CPU: 1 PID: 8409 Comm: syz-executor313 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
 eth_header_parse_protocol+0xdc/0xe0 net/ethernet/eth.c:282
 dev_parse_header_protocol include/linux/netdevice.h:3177 [inline]
 virtio_net_hdr_to_skb.constprop.0+0x99d/0xcd0 include/linux/virtio_net.h:83
 packet_snd net/packet/af_packet.c:2994 [inline]
 packet_sendmsg+0x2325/0x52b0 net/packet/af_packet.c:3031
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 sock_no_sendpage+0xf3/0x130 net/core/sock.c:2860
 kernel_sendpage.part.0+0x1ab/0x350 net/socket.c:3631
 kernel_sendpage net/socket.c:3628 [inline]
 sock_sendpage+0xe5/0x140 net/socket.c:947
 pipe_to_sendpage+0x2ad/0x380 fs/splice.c:364
 splice_from_pipe_feed fs/splice.c:418 [inline]
 __splice_from_pipe+0x43e/0x8a0 fs/splice.c:562
 splice_from_pipe fs/splice.c:597 [inline]
 generic_splice_sendpage+0xd4/0x140 fs/splice.c:746
 do_splice_from fs/splice.c:767 [inline]
 do_splice+0xb7e/0x1940 fs/splice.c:1079
 __do_splice+0x134/0x250 fs/splice.c:1144
 __do_sys_splice fs/splice.c:1350 [inline]
 __se_sys_splice fs/splice.c:1332 [inline]
 __x64_sys_splice+0x198/0x250 fs/splice.c:1332
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46

Fixes: 924a9bc362 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Balazs Nemeth <bnemeth@redhat.com>
Cc: Willem de Bruijn <willemb@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-03-30 17:40:46 -07:00
..
2021-02-02 00:16:57 +01:00
2020-12-09 19:26:02 -06:00
2020-06-25 22:25:13 -07:00
2020-06-16 14:19:57 +02:00
2021-01-23 14:57:21 +01:00
2020-07-08 10:48:35 -07:00
2020-11-06 08:08:37 -08:00
2021-03-18 00:22:51 +01:00
2020-09-21 15:00:40 -07:00
2020-12-02 09:46:55 -07:00
2021-01-24 14:27:17 +01:00
2021-02-26 09:41:03 -08:00
2021-02-17 14:07:48 +01:00
2020-12-19 11:18:38 -08:00
2021-01-21 14:06:00 -07:00
2020-10-16 17:21:51 +02:00
2021-01-16 15:12:06 -05:00
2021-01-18 14:26:51 +01:00
2021-02-08 12:28:07 +01:00
2020-08-12 20:42:08 +02:00
2020-12-10 12:42:59 -06:00
2020-11-16 16:31:41 +01:00
2020-11-16 15:20:01 +01:00
2020-07-24 17:12:41 -07:00
2020-11-16 08:14:30 -07:00
2021-02-11 13:24:44 -08:00
2020-08-04 21:02:38 -04:00
2020-12-02 22:10:35 -08:00
2020-11-23 14:16:55 +00:00
2021-01-27 12:27:36 +01:00
2020-09-16 08:54:53 -05:00
2020-11-24 16:47:48 +01:00
2020-12-15 16:19:31 +01:00
2021-02-26 09:41:03 -08:00
2020-12-15 16:19:31 +01:00
2021-02-17 14:12:42 +01:00
2021-01-21 16:16:10 +00:00
2021-02-26 09:41:02 -08:00
2021-02-26 09:41:03 -08:00
2020-09-04 09:25:20 -07:00
2021-01-22 15:09:42 +01:00
2021-01-14 11:20:17 +01:00
2021-02-26 09:41:03 -08:00
2021-03-13 11:27:30 -08:00
2020-09-04 12:46:07 +01:00
2021-01-04 11:42:21 -05:00
2021-02-16 16:11:14 -05:00
2021-02-02 10:26:12 +01:00
2020-07-01 10:49:02 +02:00
2021-02-17 13:17:49 -08:00
2020-07-23 17:34:18 +10:00
2021-02-26 09:40:59 -08:00
2021-01-21 14:06:00 -07:00
2021-02-03 19:05:50 +01:00
2020-08-31 12:52:33 -07:00
2020-10-18 09:27:10 -07:00
2021-01-24 14:27:17 +01:00
2021-01-24 14:27:20 +01:00
2021-02-26 09:41:03 -08:00
2020-12-03 11:20:52 +01:00
2020-08-18 17:06:15 +02:00
2021-01-16 23:19:26 +01:00
2020-12-07 17:12:49 -07:00
2020-11-06 10:05:18 -08:00
2020-12-10 16:17:15 +01:00
2021-01-28 00:35:03 +01:00
2020-11-24 16:47:49 +01:00
2020-12-10 10:45:36 +01:00
2020-09-26 22:55:05 -04:00
2021-03-02 17:25:46 -07:00
2021-02-20 10:13:32 -05:00
2020-10-30 21:57:04 +01:00
2021-01-06 16:24:59 -08:00
2021-02-09 12:27:29 -05:00
2020-12-04 16:54:35 +01:00
2021-02-13 17:17:53 +01:00
2020-11-09 18:39:36 +01:00
2020-07-04 09:35:36 -05:00
2020-09-10 14:03:31 -07:00
2020-08-19 14:13:20 +02:00
2021-01-21 16:16:10 +00:00
2021-02-01 13:20:07 -07:00
2021-01-18 10:52:41 +01:00
2021-02-09 12:15:07 +01:00
2021-01-21 14:06:00 -07:00
2021-01-24 14:27:17 +01:00
2021-02-08 22:58:55 +01:00