Eric Dumazet 6513fd0adb bonding/alb: properly access headers in bond_alb_xmit() ... [ Upstream commit 38f88c4540 ] syzbot managed to send an IPX packet through bond_alb_xmit() and af_packet and triggered a use-after-free. First, bond_alb_xmit() was using ipx_hdr() helper to reach the IPX header, but ipx_hdr() was using the transport offset instead of the network offset. In the particular syzbot report transport offset was 0xFFFF This patch removes ipx_hdr() since it was only (mis)used from bonding. Then we need to make sure IPv4/IPv6/IPX headers are pulled in skb->head before dereferencing anything. BUG: KASAN: use-after-free in bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452 Read of size 2 at addr ffff8801ce56dfff by task syz-executor.2/18108 (if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) ...) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: [<ffffffff8441fc42>] __dump_stack lib/dump_stack.c:17 [inline] [<ffffffff8441fc42>] dump_stack+0x14d/0x20b lib/dump_stack.c:53 [<ffffffff81a7dec4>] print_address_description+0x6f/0x20b mm/kasan/report.c:282 [<ffffffff81a7e0ec>] kasan_report_error mm/kasan/report.c:380 [inline] [<ffffffff81a7e0ec>] kasan_report mm/kasan/report.c:438 [inline] [<ffffffff81a7e0ec>] kasan_report.cold+0x8c/0x2a0 mm/kasan/report.c:422 [<ffffffff81a7dc4f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:469 [<ffffffff82c8c00a>] bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452 [<ffffffff82c60c74>] __bond_start_xmit drivers/net/bonding/bond_main.c:4199 [inline] [<ffffffff82c60c74>] bond_start_xmit+0x4f4/0x1570 drivers/net/bonding/bond_main.c:4224 [<ffffffff83baa558>] __netdev_start_xmit include/linux/netdevice.h:4525 [inline] [<ffffffff83baa558>] netdev_start_xmit include/linux/netdevice.h:4539 [inline] [<ffffffff83baa558>] xmit_one net/core/dev.c:3611 [inline] [<ffffffff83baa558>] dev_hard_start_xmit+0x168/0x910 net/core/dev.c:3627 [<ffffffff83bacf35>] __dev_queue_xmit+0x1f55/0x33b0 net/core/dev.c:4238 [<ffffffff83bae3a8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:4278 [<ffffffff84339189>] packet_snd net/packet/af_packet.c:3226 [inline] [<ffffffff84339189>] packet_sendmsg+0x4919/0x70b0 net/packet/af_packet.c:3252 [<ffffffff83b1ac0c>] sock_sendmsg_nosec net/socket.c:673 [inline] [<ffffffff83b1ac0c>] sock_sendmsg+0x12c/0x160 net/socket.c:684 [<ffffffff83b1f5a2>] __sys_sendto+0x262/0x380 net/socket.c:1996 [<ffffffff83b1f700>] SYSC_sendto net/socket.c:2008 [inline] [<ffffffff83b1f700>] SyS_sendto+0x40/0x60 net/socket.c:2004 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Jay Vosburgh <j.vosburgh@gmail.com> Cc: Veaceslav Falico <vfalico@gmail.com> Cc: Andy Gospodarek <andy@greyhouse.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-02-11 04:34:14 -08:00
..
acpi	ACPICA: ACPI 6.3: PPTT add additional fields in Processor Structure Flags	2019-10-17 13:45:33 -07:00
asm-generic	asm-generic: fix -Wtype-limits compiler warnings	2019-08-25 10:47:58 +02:00
clocksource
crypto	crypto: chacha20 - Fix chacha20_block() keystream alignment (again)	2019-11-20 18:47:11 +01:00
drm	drm/panel: make drm_panel.h self-contained	2020-01-27 14:51:01 +01:00
dt-bindings	dt-bindings: reset: meson8b: fix duplicate reset IDs	2020-01-23 08:21:26 +01:00
keys	keys: Fix dependency loop between construction record and auth key	2019-03-23 20:09:48 +01:00
kvm	KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about to block	2019-08-25 10:47:59 +02:00
linux	percpu: Separate decrypted varaibles anytime encryption can be enabled	2020-02-11 04:34:11 -08:00
math-emu	math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning	2019-12-13 08:51:34 +01:00
media	media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments	2020-02-11 04:33:57 -08:00
memory
misc
net	bonding/alb: properly access headers in bond_alb_xmit()	2020-02-11 04:34:14 -08:00
pcmcia
ras
rdma	IB/mlx4: Avoid implicit enumerated type conversion	2019-11-24 08:20:04 +01:00
scsi	scsi: target: iscsi: Wait for all commands to finish before freeing a session	2020-01-04 19:13:06 +01:00
soc	soc/tegra: pmc: Fix pad voltage configuration for Tegra186	2019-11-20 18:45:24 +01:00
sound	ASoC: wm97xx: fix uninitialized regmap pointer problem	2020-01-27 14:50:01 +01:00
target	scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough	2019-01-26 09:32:38 +01:00
trace	tracing: xen: Ordered comparison of function pointers	2020-01-29 16:43:21 +01:00
uapi	bpf: fix BTF limits	2020-01-27 14:51:14 +01:00
video	udlfb: introduce a rendering mutex	2019-05-25 18:23:30 +02:00
xen	xen/events: fix binding user event channels to cpus	2019-07-26 09:14:25 +02:00