linux/net/ipv6
Xin Long da4f0aed87 net: ipv6: fix listify ip6_rcv_finish in case of forwarding
[ Upstream commit c7a42eb492 ]

We need a similar fix for ipv6 as Commit 0761680d52 ("net: ipv4: fix
listify ip_rcv_finish in case of forwarding") does for ipv4.

This issue can be reprocuded by syzbot since Commit 323ebb61e3 ("net:
use listified RX for handling GRO_NORMAL skbs") on net-next. The call
trace was:

  kernel BUG at include/linux/skbuff.h:2225!
  RIP: 0010:__skb_pull include/linux/skbuff.h:2225 [inline]
  RIP: 0010:skb_pull+0xea/0x110 net/core/skbuff.c:1902
  Call Trace:
    sctp_inq_pop+0x2f1/0xd80 net/sctp/inqueue.c:202
    sctp_endpoint_bh_rcv+0x184/0x8d0 net/sctp/endpointola.c:385
    sctp_inq_push+0x1e4/0x280 net/sctp/inqueue.c:80
    sctp_rcv+0x2807/0x3590 net/sctp/input.c:256
    sctp6_rcv+0x17/0x30 net/sctp/ipv6.c:1049
    ip6_protocol_deliver_rcu+0x2fe/0x1660 net/ipv6/ip6_input.c:397
    ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:438
    NF_HOOK include/linux/netfilter.h:305 [inline]
    NF_HOOK include/linux/netfilter.h:299 [inline]
    ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:447
    dst_input include/net/dst.h:442 [inline]
    ip6_sublist_rcv_finish+0x98/0x1e0 net/ipv6/ip6_input.c:84
    ip6_list_rcv_finish net/ipv6/ip6_input.c:118 [inline]
    ip6_sublist_rcv+0x80c/0xcf0 net/ipv6/ip6_input.c:282
    ipv6_list_rcv+0x373/0x4b0 net/ipv6/ip6_input.c:316
    __netif_receive_skb_list_ptype net/core/dev.c:5049 [inline]
    __netif_receive_skb_list_core+0x5fc/0x9d0 net/core/dev.c:5097
    __netif_receive_skb_list net/core/dev.c:5149 [inline]
    netif_receive_skb_list_internal+0x7eb/0xe60 net/core/dev.c:5244
    gro_normal_list.part.0+0x1e/0xb0 net/core/dev.c:5757
    gro_normal_list net/core/dev.c:5755 [inline]
    gro_normal_one net/core/dev.c:5769 [inline]
    napi_frags_finish net/core/dev.c:5782 [inline]
    napi_gro_frags+0xa6a/0xea0 net/core/dev.c:5855
    tun_get_user+0x2e98/0x3fa0 drivers/net/tun.c:1974
    tun_chr_write_iter+0xbd/0x156 drivers/net/tun.c:2020

Fixes: d8269e2cbf ("net: ipv6: listify ipv6_rcv() and ip6_rcv_finish()")
Fixes: 323ebb61e3 ("net: use listified RX for handling GRO_NORMAL skbs")
Reported-by: syzbot+eb349eeee854e389c36d@syzkaller.appspotmail.com
Reported-by: syzbot+4a0643a653ac375612d1@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-29 09:19:42 +01:00
..
ila ila: Fix rhashtable walker list corruption 2019-04-03 06:26:18 +02:00
netfilter netfilter: Fix rpfilter dropping vrf packets by mistake 2019-08-16 10:12:43 +02:00
addrconf_core.c
addrconf.c ipv6: Handle missing host route in __ipv6_ifa_notify 2019-10-07 18:57:21 +02:00
addrlabel.c
af_inet6.c ipv6: Consider sk_bound_dev_if when binding a socket to an address 2019-02-06 17:30:06 +01:00
ah6.c
anycast.c
calipso.c
datagram.c udp: correct reuseport selection with connected sockets 2019-09-21 07:16:43 +02:00
esp6_offload.c
esp6.c esp: Skip TX bytes accounting when sending from a request socket 2019-03-23 20:09:48 +01:00
exthdrs_core.c
exthdrs_offload.c
exthdrs.c
fib6_notifier.c
fib6_rules.c
fou6.c
icmp.c ipv6: make icmp6_send() robust against null skb->dev 2019-01-22 21:40:35 +01:00
inet6_connection_sock.c
inet6_hashtables.c bpf: Enable BPF_PROG_TYPE_SK_REUSEPORT bpf prog in reuseport selection 2018-08-11 01:58:46 +02:00
ip6_checksum.c net: udp: fix handling of CHECKSUM_COMPLETE packets 2018-11-04 14:50:51 +01:00
ip6_fib.c ipv6: Unlink sibling route in case of failure 2019-07-28 08:29:24 +02:00
ip6_flowlabel.c ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero 2019-06-22 08:15:13 +02:00
ip6_gre.c ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit 2019-09-21 07:16:43 +02:00
ip6_icmp.c
ip6_input.c net: ipv6: fix listify ip6_rcv_finish in case of forwarding 2019-10-29 09:19:42 +01:00
ip6_offload.c gso_segment: Reset skb->mac_len after modifying network header 2018-09-13 12:09:32 -07:00
ip6_offload.h
ip6_output.c ipv6: Fix dangling pointer when ipv6 fragment 2019-04-17 08:38:40 +02:00
ip6_tunnel.c ip6_tunnel: fix possible use-after-free on xmit 2019-08-09 17:52:30 +02:00
ip6_udp_tunnel.c ipv6: explicitly initialize udp6_addr in udp_sock_create6() 2019-01-09 17:38:31 +01:00
ip6_vti.c ip: validate header length on virtual device xmit 2019-01-09 17:38:31 +01:00
ip6mr.c ip6mr: Do not call __IP6_INC_STATS() from preemptible context 2019-03-10 07:17:16 +01:00
ipcomp6.c
ipv6_sockglue.c
Kconfig
Makefile
mcast_snoop.c
mcast.c mld: fix memory leak in mld_del_delrec() 2019-09-10 10:33:38 +01:00
mip6.c
ndisc.c ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called 2018-11-04 14:50:51 +01:00
netfilter.c netfilter: ipv6: Don't preserve original oif for loopback address 2019-02-27 10:09:03 +01:00
output_core.c inet: switch IP ID generator to siphash 2019-06-04 08:02:30 +02:00
ping.c ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' 2019-09-19 09:09:28 +02:00
proc.c
protocol.c
raw.c ipv6: fix EFAULT on sendto with icmpv6 and hdrincl 2019-06-11 12:20:50 +02:00
reassembly.c net: IP6 defrag: use rbtrees for IPv6 defrag 2019-04-27 09:36:33 +02:00
route.c ipv6: Default fib6_type to RTN_UNICAST when not set 2019-09-06 10:22:06 +02:00
seg6_hmac.c
seg6_iptunnel.c ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation 2019-02-06 17:30:06 +01:00
seg6_local.c
seg6.c ipv6: propagate genlmsg_reply return code 2019-02-27 10:08:58 +01:00
sit.c vrf: sit mtu should not be updated when vrf netdev is the link 2019-05-16 19:41:30 +02:00
syncookies.c
sysctl_net_ipv6.c
tcp_ipv6.c tcp: do not use ipv6 header for ipv4 flow 2019-04-03 06:26:18 +02:00
tcpv6_offload.c
tunnel6.c
udp_impl.h
udp_offload.c
udp.c udp: only do GSO if # of segs > 1 2019-10-07 18:57:24 +02:00
udplite.c
xfrm6_input.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-09-04 10:26:30 +02:00
xfrm6_mode_beet.c
xfrm6_mode_ro.c
xfrm6_mode_transport.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-09-04 10:26:30 +02:00
xfrm6_mode_tunnel.c
xfrm6_output.c xfrm6: call kfree_skb when skb is toobig 2018-09-03 07:37:57 +02:00
xfrm6_policy.c net/xfrm: fix out-of-bounds packet access 2018-10-11 13:24:46 +02:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c xfrm: clean up xfrm protocol checks 2019-05-25 18:23:41 +02:00