Willem de Bruijn b228c9b058 net: expand textsearch ts_state to fit skb_seq_state ... The referenced commit expands the skb_seq_state used by skb_find_text with a 4B frag_off field, growing it to 48B. This exceeds container ts_state->cb, causing a stack corruption: [ 73.238353] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: skb_find_text+0xc5/0xd0 [ 73.247384] CPU: 1 PID: 376 Comm: nping Not tainted 5.11.0+ #4 [ 73.252613] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 73.260078] Call Trace: [ 73.264677] dump_stack+0x57/0x6a [ 73.267866] panic+0xf6/0x2b7 [ 73.270578] ? skb_find_text+0xc5/0xd0 [ 73.273964] __stack_chk_fail+0x10/0x10 [ 73.277491] skb_find_text+0xc5/0xd0 [ 73.280727] string_mt+0x1f/0x30 [ 73.283639] ipt_do_table+0x214/0x410 The struct is passed between skb_find_text and its callbacks skb_prepare_seq_read, skb_seq_read and skb_abort_seq read through the textsearch interface using TS_SKB_CB. I assumed that this mapped to skb->cb like other .._SKB_CB wrappers. skb->cb is 48B. But it maps to ts_state->cb, which is only 40B. skb->cb was increased from 40B to 48B after ts_state was introduced, in commit 3e3850e989 ("[NETFILTER]: Fix xfrm lookup in ip_route_me_harder/ip6_route_me_harder"). Increase ts_state.cb[] to 48 to fit the struct. Also add a BUILD_BUG_ON to avoid a repeat. The alternative is to directly add a dependency from textsearch onto linux/skbuff.h, but I think the intent is textsearch to have no such dependencies on its callers. Link: https://bugzilla.kernel.org/show_bug.cgi?id=211911 Fixes: 97550f6fa5 ("net: compound page support in skb_seq_read") Reported-by: Kris Karas <bugs-a17@moonlit-rail.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2021-03-01 15:25:24 -08:00
..
bpf_sk_storage.c	bpf: Expose bpf_sk_storage_* to iterator programs	2020-12-04 22:32:40 +01:00
datagram.c	udp: fix skb_copy_and_csum_datagram with odd segment sizes	2021-02-04 18:56:56 -08:00
datagram.h
dev_addr_lists.c	net: core: add nested_level variable in net_device	2020-09-28 15:00:15 -07:00
dev_ioctl.c	net: fix dev_ifsioc_locked() race condition	2021-02-11 18:14:19 -08:00
dev.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-02-16 13:14:06 -08:00
devlink.c	mlx5 subfunction support	2021-01-28 16:57:19 -08:00
drop_monitor.c	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
dst_cache.c
dst.c	net: Correct the comment of dst_dev_put()	2020-09-10 13:28:57 -07:00
failover.c
fib_notifier.c
fib_rules.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
filter.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-02-16 13:14:06 -08:00
flow_dissector.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-02-16 17:51:13 -08:00
flow_offload.c	net: flow_offload: Fix memory leak for indirect flow block	2020-12-09 16:08:33 -08:00
gen_estimator.c	net_sched: gen_estimator: support large ewma log	2021-01-15 18:11:06 -08:00
gen_stats.c
gro_cells.c	gro_cells: reduce number of synchronize_net() calls	2020-11-25 11:28:12 -08:00
hwbm.c
link_watch.c
lwt_bpf.c	lwt_bpf: Replace preempt_disable() with migrate_disable()	2020-12-07 11:53:40 -08:00
lwtunnel.c
Makefile
neighbour.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-02-02 14:21:31 -08:00
net_namespace.c	net: initialize net->net_cookie at netns setup	2021-02-11 14:10:07 -08:00
net-procfs.c	net-sysfs: add backlog len and CPU id to softnet data	2020-09-21 13:56:37 -07:00
net-sysfs.c	net: add sysfs attribute to control napi threaded mode	2021-02-09 15:27:28 -08:00
net-sysfs.h
net-traces.c
netclassid_cgroup.c	net: Remove the err argument from sock_from_file	2020-12-04 22:32:40 +01:00
netevent.c
netpoll.c	Revert "net: Have netpoll bring-up DSA management interface"	2021-02-06 14:42:57 -08:00
netprio_cgroup.c	net: Remove the err argument from sock_from_file	2020-12-04 22:32:40 +01:00
page_pool.c	net: page_pool: simplify page recycling condition tests	2021-02-04 18:20:14 -08:00
pktgen.c	pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()	2021-01-27 16:46:37 -08:00
ptp_classifier.c
request_sock.c
rtnetlink.c	net: fix dev_ifsioc_locked() race condition	2021-02-11 18:14:19 -08:00
scm.c
secure_seq.c
skbuff.c	net: expand textsearch ts_state to fit skb_seq_state	2021-03-01 15:25:24 -08:00
skmsg.c	skmsg: Make sk_psock_destroy() static	2021-01-28 00:35:03 +01:00
sock_diag.c	bpf, net: Rework cookie generator as per-cpu one	2020-09-30 11:50:35 -07:00
sock_map.c	bpf: Replace fput with sockfd_put in sock map	2021-01-08 13:39:24 -08:00
sock_reuseport.c	udp: Prevent reuseport_select_sock from reading uninitialized socks	2021-01-08 19:15:40 -08:00
sock.c	net: indirect call helpers for ipv4/ipv6 dst_check functions	2021-02-03 14:51:40 -08:00
stream.c
sysctl_net_core.c	net: sysctl: remove redundant #ifdef CONFIG_NET	2021-01-27 17:02:43 -08:00
timestamping.c
tso.c
utils.c
xdp.c	net, veth: Alloc skb in bulk for ndo_xdp_xmit	2021-02-04 01:00:07 +01:00