The commit is pushed to "branch-rh8-4.18.0-240.1.1.vz8.5.x-ovz" and will appear
at https://src.openvz.org/scm/ovz/vzkernel.git
after rh8-4.18.0-240.1.1.vz8.5.34
------>
commit 284e9e4d6e9fcf2c8acc49b14c541f4ab436f871
Author: Vasily Averin <[email protected]>
Date: Wed Jun 2 19:48:05 2021 +0300
ms/net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of
trimmed packet
syzbot reproduces BUG_ON in skb_checksum_help():
tun creates (bogus) skb with huge partial-checksummed area and
small ip packet inside. Then ip_rcv trims the skb based on size
of internal ip packet, after that csum offset points beyond of
trimmed skb. Then checksum_tg() called via netfilter hook
triggers BUG_ON:
offset = skb_checksum_start_offset(skb);
BUG_ON(offset >= skb_headlen(skb));
To work around the problem this patch forces pskb_trim_rcsum_slow()
to return -EINVAL in described scenario. It allows its callers to
drop such kind of packets.
Link:
https://syzkaller.appspot.com/bug?id=b419a5ca95062664fe1a60b764621eb4526e2cd0
Reported-by: [email protected]
Signed-off-by: Vasily Averin <[email protected]>
Acked-by: Willem de Bruijn <[email protected]>
Link:
https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Taken from vz7 commit dd590cd4c2f3 ("ms/net: drop bogus skb with
CHECKSUM_PARTIAL and offset beyond end of trimmed packet"),
but used upstrem version.
(cherry picked from ms commit 54970a2fbb67 ("net: drop bogus skb with
CHECKSUM_PARTIAL and offset beyond end of trimmed packet"))
https://jira.sw.ru/browse/PSBM-123062
Signed-off-by: Vasily Averin <[email protected]>
---
net/core/skbuff.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5cb45c9226fd..a3bc8b2b1689 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1922,6 +1922,12 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned
int len)
skb->csum = csum_block_sub(skb->csum,
skb_checksum(skb, len, delta, 0),
len);
+ } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
+ int hdlen = (len > skb_headlen(skb)) ? skb_headlen(skb) : len;
+ int offset = skb_checksum_start_offset(skb) + skb->csum_offset;
+
+ if (offset + sizeof(__sum16) > hdlen)
+ return -EINVAL;
}
return __pskb_trim(skb, len);
}
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
