Jason A. Donenfeld
0c5bdc2104
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending ...
commit ee576c47db60432c37e54b1e2b43a8ca6d3a8dca upstream.
The icmp{,v6}_send functions make all sorts of use of skb->cb, casting
it with IPCB or IP6CB, assuming the skb to have come directly from the
inet layer. But when the packet comes from the ndo layer, especially
when forwarded, there's no telling what might be in skb->cb at that
point. As a result, the icmp sending code risks reading bogus memory
contents, which can result in nasty stack overflows such as this one
reported by a user:
panic+0x108/0x2ea
__stack_chk_fail+0x14/0x20
__icmp_send+0x5bd/0x5c0
icmp_ndo_send+0x148/0x160
In icmp_send, skb->cb is cast with IPCB and an ip_options struct is read
from it. The optlen parameter there is of particular note, as it can
induce writes beyond bounds. There are quite a few ways that can happen
in __ip_options_echo. For example:
// sptr/skb are attacker-controlled skb bytes
sptr = skb_network_header(skb);
// dptr/dopt points to stack memory allocated by __icmp_send
dptr = dopt->__data;
// sopt is the corrupt skb->cb in question
if (sopt->rr) {
optlen = sptr[sopt->rr+1]; // corrupt skb->cb + skb->data
soffset = sptr[sopt->rr+2]; // corrupt skb->cb + skb->data
// this now writes potentially attacker-controlled data, over
// flowing the stack:
memcpy(dptr, sptr+sopt->rr, optlen);
}
In the icmpv6_send case, the story is similar, but not as dire, as only
IP6CB(skb)->iif and IP6CB(skb)->dsthao are used. The dsthao case is
worse than the iif case, but it is passed to ipv6_find_tlv, which does
a bit of bounds checking on the value.
This is easy to simulate by doing a `memset(skb->cb, 0x41,
sizeof(skb->cb));` before calling icmp{,v6}_ndo_send, and it's only by
good fortune and the rarity of icmp sending from that context that we've
avoided reports like this until now. For example, in KASAN:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xa0e/0x12b0
Write of size 38 at addr ffff888006f1f80e by task ping/89
CPU: 2 PID: 89 Comm: ping Not tainted 5.10.0-rc7-debug+ #5
Call Trace:
dump_stack+0x9a/0xcc
print_address_description.constprop.0+0x1a/0x160
__kasan_report.cold+0x20/0x38
kasan_report+0x32/0x40
check_memory_region+0x145/0x1a0
memcpy+0x39/0x60
__ip_options_echo+0xa0e/0x12b0
__icmp_send+0x744/0x1700
Actually, out of the 4 drivers that do this, only gtp zeroed the cb for
the v4 case, while the rest did not. So this commit actually removes the
gtp-specific zeroing, while putting the code where it belongs in the
shared infrastructure of icmp{,v6}_ndo_send.
This commit fixes the issue by passing an empty IPCB or IP6CB along to
the functions that actually do the work. For the icmp_send, this was
already trivial, thanks to __icmp_send providing the plumbing function.
For icmpv6_send, this required a tiny bit of refactoring to make it
behave like the v4 case, after which it was straight forward.
Fixes: a2b78e9b2chttps://lore.kernel.org/netdev/CAF=yD-LOF116aHub6RMe8vB8ZpnrrnoTdqhobEx+bvoA8AsP0w@mail.gmail.com/T/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20210223131858.72082-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-03 17:44:46 +01:00
Bluetooth: Disconnect if E0 is used for Level 4
2020-10-17 11:02:19 +02:00
caif: reduce stack size with KASAN
2019-05-08 07:19:07 +02:00
s390/iucv: do not use arrays as argument
2015-09-21 16:03:04 -07:00
netfilter: nf_tables: fix destination register zeroing
2020-09-12 11:47:33 +02:00
inet: switch IP ID generator to siphash
2019-08-25 10:51:42 +02:00
NFC: Fix the number of pipes
2018-09-29 03:07:30 -07:00
phonet: fix building with clang
2019-03-23 13:19:44 +01:00
sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
2020-06-30 15:38:39 -04:00
net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used
2018-08-24 13:12:37 +02:00
6lowpan: add 802.15.4 short addr slaac
2016-06-15 20:41:22 -07:00
net sched: fix reporting the first-time use timestamp
2020-06-03 08:16:25 +02:00
ipv6: fix memory leaks on IPV6_ADDRFORM path
2020-08-21 11:01:55 +02:00
ieee802154: af_ieee802154: fix typo in comment.
2015-09-17 13:20:05 +02:00
rxrpc: Rewrite the data and ack handling code
2016-09-08 11:10:12 +01:00
af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock'
2016-09-04 13:29:29 -07:00
vsock: split dwork to avoid reinitializations
2018-08-22 07:47:13 +02:00
ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
2019-06-11 12:22:49 +02:00
ax25: fix possible use-after-free
2019-02-23 09:05:59 +01:00
bonding: 3ad: apply ad_actor settings changes immediately
2016-02-09 04:45:49 -05:00
bonding: convert num_grat_arp to the new bonding option API
2015-07-27 01:05:24 -07:00
bonding: wait for sysfs kobject destruction before freeing struct slave
2020-12-11 13:37:57 +01:00
net: un-inline sk_busy_loop()
2015-11-18 16:17:38 -05:00
calipso: Add a label cache.
2016-06-27 15:06:17 -04:00
cfg80211/mac80211: make ieee80211_send_layer2_update a public function
2020-01-23 08:19:34 +01:00
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
csum: Update csum_block_add to use rotate instead of byteswap
2016-03-13 15:01:00 -04:00
netlabel: out of bound access in cipso_v4_validate()
2017-02-18 15:11:41 +01:00
cls_cgroup: get sk_classid only from full sockets
2016-04-19 20:09:25 -04:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
net_sched: fq_codel: cache skb->truesize into skb->cb
2016-06-25 12:19:35 -04:00
packet: compat support for sock_fprog
2016-06-09 23:41:03 -07:00
devlink: remove unused priv_size
2016-08-26 11:55:18 -07:00
netfilter: Pass net into okfn
2015-09-17 17:18:37 -07:00
net: dsa: add port fast ageing
2016-09-23 08:38:50 -04:00
net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
2020-07-22 09:10:48 +02:00
net: add dst_cache support
2016-02-16 20:21:48 -05:00
net/dst: Utility functions to build dst_metadata without supplying an skb
2016-09-10 20:53:55 -07:00
ipv4, ipv6: Pass net into __ip_local_out and __ip6_local_out
2015-10-08 04:27:02 -07:00
net/ethoc: support big-endian register layout
2015-09-23 15:33:15 -07:00
fib: add missing attribute validation for tun_id
2020-03-20 09:07:39 +01:00
net: flow: Remove FLOWI_FLAG_L3MDEV_SRC flag
2016-09-10 23:12:53 -07:00
net: sched: correct flower port blocking
2020-03-11 07:53:05 +01:00
fou: Add encap ops for IPv6 tunnels
2016-05-20 18:03:16 -04:00
net/flow_dissector: switch to siphash
2019-11-10 11:23:31 +01:00
net/flow_dissector: switch to siphash
2019-11-10 11:23:31 +01:00
net: sched: do not acquire qdisc spinlock in qdisc/class stats dump
2016-06-07 16:37:14 -07:00
genetlink: remove genl_bind
2020-07-22 09:10:48 +02:00
net: Remove deprecated tunnel specific UDP offload functions
2016-06-17 20:23:32 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-08-18 01:17:32 -04:00
gro_cells: make sure device is up in gro_cells_receive()
2019-03-19 13:14:10 +01:00
gtp: #define #define _GTP_H_ and not #define _GTP_H
2016-07-25 17:55:43 -07:00
net: add a hardware buffer management helper API
2016-03-14 12:19:46 -04:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-03 17:44:46 +01:00
mac80211: add support for radiotap timestamp field
2016-09-12 11:45:45 +02:00
mac802154: constify ieee802154_llsec_ops structure
2016-01-04 20:40:41 +01:00
IPv6: fix DESYNC_FACTOR
2016-10-14 10:59:15 -04:00
ila: Add generic ILA translation facility
2015-12-15 23:25:20 -05:00
ipv6: remove unused in6_addr struct
2016-03-22 15:45:44 -04:00
tcp/dccp: do not touch listener sk_refcnt under synflood
2016-04-04 22:11:20 -04:00
ip4ip6: Support for GSO/GRO
2016-05-20 18:03:17 -04:00
net: refactor bind_bucket fastreuse into helper
2020-09-12 11:47:38 +02:00
vlan: consolidate VLAN parsing code and limit max parsing depth
2020-12-11 13:37:58 +01:00
net: IP defrag: encapsulate rbtree defrag code into callable functions
2019-05-02 09:32:06 +02:00
tcp/dccp: fix possible race __inet_lookup_established()
2020-01-04 13:41:12 +01:00
inet: make sure to grab rcu_read_lock before using ireq->ireq_opt
2018-10-18 09:13:23 +02:00
soreuseport: initialise timewait reuseport field
2018-05-16 10:08:41 +02:00
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-23 09:05:59 +01:00
net/ipv4: always honour route mtu during forwarding
2020-10-29 09:05:31 +01:00
ipv6: Pass proto to csum_ipv6_magic as __u8 instead of unsigned short
2016-03-13 23:55:13 -04:00
ipv6: fix sparse warning on rt6i_node
2017-09-20 08:19:53 +02:00
net: ipv6: do not consider routes via gateways for anycast address check
2020-04-24 07:59:02 +02:00
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-07-21 09:05:57 +02:00
net: ipv4: Fix memory leak in network namespace dismantle
2019-01-31 08:12:33 +01:00
ip_tunnel: add collect_md mode to IPIP tunnel
2016-09-17 10:13:07 -04:00
ipvs: move old_secure_tcp into struct netns_ipvs
2019-11-12 19:15:57 +01:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-05-20 08:15:30 +02:00
ip6: fix skb leak in ip6frag_expire_frag_queue()
2019-09-16 08:19:33 +02:00
wext: handle NULL extra data in iwe_stream_add_point better
2017-08-11 08:49:34 -07:00
kcm: Use stream parser
2016-08-17 19:36:23 -04:00
ipvlan, l3mdev: fix broken l3s mode wrt local routes
2019-02-06 17:33:27 +01:00
llc: avoid blocking in llc_sap_close()
2019-11-25 09:52:18 +01:00
llc: fix sk_buff leak in llc_conn_service()
2019-11-06 12:18:24 +01:00
lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled
2017-02-18 15:11:42 +01:00
mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4
2018-05-30 07:50:28 +02:00
ieee802154: cleanup WARN_ON for fc fetch
2016-07-08 13:23:12 +02:00
openvswitch: use mpls_hdr
2016-10-03 02:00:22 -04:00
mpls: multipath route support
2015-10-23 06:26:42 -07:00
net/ncsi: Introduce ncsi_stop_dev()
2016-10-04 02:11:51 -04:00
6lowpan: introduce 6lowpan-nd
2016-06-15 20:41:23 -07:00
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
netns: provide pure entropy for net_hash_mix()
2019-04-17 08:36:46 +02:00
neigh: Send a notification when DELAY_PROBE_TIME changes
2016-07-05 09:06:29 -07:00
netlabel: Implement CALIPSO config functions for SMACK.
2016-06-27 15:06:18 -04:00
netlink: fix nla_put_{u8,u16,u32} for KASAN
2017-10-12 11:51:25 +02:00
net: wrap sock->sk_cgrp_prioidx and ->sk_classid inside a struct
2015-12-08 22:02:33 -05:00
net: fix rtnh_ok()
2018-05-16 10:08:41 +02:00
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
net: ping: make ping_v6_sendmsg static
2016-03-23 22:09:58 -04:00
net/sched: pkt_cls: change tc actions order to be as the user sets
2016-09-28 05:02:44 -04:00
net: sched: convert qdisc linked list to hashtable
2016-08-10 17:19:02 -07:00
pptp: Refactor the struct and macros of PPTP codes
2016-08-15 10:55:53 -07:00
udp: Remove udp_offloads
2016-04-07 16:53:30 -04:00
sock: struct proto hash function may error
2016-02-11 03:54:14 -05:00
net: sched: prevent invalid Scell_log shift count
2021-01-12 19:49:02 +01:00
regulatory: add NUL to request alpha2
2018-05-30 07:50:30 +02:00
inet: reqsk_alloc() needs to take care of dead listeners
2016-04-04 22:11:19 -04:00
ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu
2018-05-30 07:50:36 +02:00
net: rtnetlink: add support for the IFLA_STATS_LINK_XSTATS_SLAVE attribute
2016-06-30 06:15:04 -04:00
sch_netem: fix rcu splat in netem_enqueue()
2019-11-06 12:18:25 +01:00
unix: correctly track in-flight fds in sending process user_struct
2016-02-08 10:30:42 -05:00
slip: Check if rstate is initialized before uncompressing
2018-04-20 08:21:07 +02:00
net: snmp: fix 64bit stats on 32bit arches
2016-04-28 11:49:45 -04:00
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 11:02:08 +02:00
soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind
2016-01-19 14:44:23 -05:00
kcm: Remove TCP specific references from kcm and strparser
2016-08-28 23:32:41 -04:00
switchdev: remove FIB offload infrastructure
2016-09-28 04:48:00 -04:00
tcp: cache line align MAX_TCP_HEADER
2020-05-02 17:23:08 +02:00
ipv6: add new struct ipcm6_cookie
2016-05-03 16:08:14 -04:00
net: tso: add support for IPv6
2015-10-26 22:24:22 -07:00
udp: must lock the socket in udp_disconnect()
2016-10-20 14:45:52 -04:00
vxlan: Add new UDP encapsulation offload type for VXLAN-GPE
2016-06-17 20:23:32 -07:00
udplite: fix partial checksum initialization
2018-03-11 16:21:32 +01:00
vxlan: fix hlist corruption
2017-07-21 07:42:18 +02:00
net: x25: fix one potential use-after-free issue
2018-04-13 19:48:00 +02:00
xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate
2020-10-14 09:48:16 +02:00
0c5bdc2104