On Mon, Apr 19, 2021 at 8:24 AM Davide Caratti <dcara...@redhat.com> wrote:
>
> when 'act_mirred' tries to fragment IPv4 packets that had been previously
> re-assembled using 'act_ct', splats like the following can be observed on
> kernels built with KASAN:
[...]
> for IPv4 packets, sch_fragment() uses a temporary struct dst_entry. Then,
> in the following call graph:
>
> ip_do_fragment()
> ip_skb_dst_mtu()
> ip_dst_mtu_maybe_forward()
> ip_mtu_locked()
>
> the pointer to struct dst_entry is used as pointer to struct rtable: this
> turns the access to struct members like rt_mtu_locked into an OOB read in
> the stack. Fix this changing the temporary variable used for IPv4 packets
> in sch_fragment(), similarly to what is done for IPv6 few lines below.
>
> Fixes: c129412f74e9 ("net/sched: sch_frag: add generic packet fragment
> support.")
> Cc: <sta...@vger.kernel.org> # 5.11
> Reported-by: Shuang Li <shu...@redhat.com>
> Signed-off-by: Davide Caratti <dcara...@redhat.com>
Acked-by: Cong Wang <cong.w...@bytedance.com>
Thanks.
