android_kernel_msm-6.1_noth.../net
Paolo Abeni b548c046c7 UPSTREAM: net: prevent skb corruption on frag list segmentation
[ Upstream commit c329b261afe71197d9da83c1f18eb45a7e97e089 ]

Ian reported several skb corruptions triggered by rx-gro-list,
collecting different oops alike:

[   62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0
[   62.631083] #PF: supervisor read access in kernel mode
[   62.636312] #PF: error_code(0x0000) - not-present page
[   62.641541] PGD 0 P4D 0
[   62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI
[   62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364
[   62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022
[   62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858
./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261
net/ipv4/udp_offload.c:277)
[   62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246
[   62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000
[   62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4
[   62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9
[   62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2
[   62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9
[   62.728654] FS:  0000000000000000(0000) GS:ffffa127efa40000(0000)
knlGS:0000000000000000
[   62.736852] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0
[   62.749948] Call Trace:
[   62.752498]  <TASK>
[   62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)
[   62.787605] skb_mac_gso_segment (net/core/gro.c:141)
[   62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))
[   62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862
net/core/dev.c:3659)
[   62.804695] validate_xmit_skb_list (net/core/dev.c:3710)
[   62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)
[   62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)
net/netfilter/core.c:626)
[   62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)
[   62.825652] maybe_deliver (net/bridge/br_forward.c:193)
[   62.829420] br_flood (net/bridge/br_forward.c:233)
[   62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)
[   62.837403] br_handle_frame (net/bridge/br_input.c:298
net/bridge/br_input.c:416)
[   62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)
[   62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)
[   62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638
net/core/dev.c:5727)
[   62.876795] napi_complete_done (./include/linux/list.h:37
./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)
[   62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)
[   62.893534] __napi_poll (net/core/dev.c:6498)
[   62.897133] napi_threaded_poll (./include/linux/netpoll.h:89
net/core/dev.c:6640)
[   62.905276] kthread (kernel/kthread.c:379)
[   62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)
[   62.917119]  </TASK>

In the critical scenario, rx-gro-list GRO-ed packets are fed, via a
bridge, both to the local input path and to an egress device (tun).

The segmentation of such packets unsafely writes to the cloned skbs
with shared heads.

This change addresses the issue by uncloning as needed the
to-be-segmented skbs.

Reported-by: Ian Kumlien <ian.kumlien@gmail.com>
Tested-by: Ian Kumlien <ian.kumlien@gmail.com>
Fixes: 3a1296a38d ("net: Support GRO/GSO fraglist chaining.")
Change-Id: I6e79a4d19751becd42ec486233f1a8de4a0f3f7e
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-26 00:04:05 +00:00
..
6lowpan
9p 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition 2023-04-20 12:35:08 +02:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2022-12-31 13:33:02 +01:00
8021q
appletalk
atm net/atm: fix proc_mpc_write incorrect return value 2022-10-15 11:08:36 +01:00
ax25
batman-adv ANDROID: always add the struct wireless_dev * to struct net_device 2023-05-12 15:37:37 +00:00
bluetooth UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb 2023-08-24 08:29:01 +00:00
bpf Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES" 2023-03-17 08:50:32 +01:00
bpfilter
bridge net: bridge: switchdev: don't notify FDB entries with "master dynamic" 2023-04-26 14:28:35 +02:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:50:24 +01:00
can UPSTREAM: can: isotp: isotp_sendmsg(): fix return error fix on TX path 2023-07-26 09:56:38 +00:00
ceph use less confusing names for iov_iter direction initializers 2023-02-09 11:28:04 +01:00
core UPSTREAM: net: prevent skb corruption on frag list segmentation 2023-09-26 00:04:05 +00:00
dcb
dccp UPSTREAM: dccp: Call inet6_destroy_sock() via sk->sk_destruct(). 2023-05-16 17:26:14 +00:00
dns_resolver
dsa net: dsa: tag_brcm: legacy: fix daisy-chained switches 2023-03-30 12:49:09 +02:00
ethernet
ethtool ethtool: reset #lanes when lanes is omitted 2023-04-13 16:55:24 +02:00
hsr hsr: ratelimit only when errors are printed 2023-04-06 12:10:58 +02:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-10-07 09:29:17 +02:00
ife
ipv4 UPSTREAM: tcp: deny tcp_disconnect() when threads are waiting 2023-06-14 23:02:42 +00:00
ipv6 UPSTREAM: ipv{4,6}/raw: fix output xfrm lookup wrt protocol 2023-06-07 14:24:50 +00:00
iucv net/iucv: Fix size of interrupt data 2023-03-22 13:33:50 +01:00
kcm kcm: close race conditions on sk_receive_queue 2022-11-15 12:42:26 +01:00
key xfrm: Fix oops in __xfrm_state_delete() 2022-11-22 07:14:55 +01:00
l2tp UPSTREAM: inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). 2023-05-16 14:09:57 +00:00
l3mdev
lapb
llc
mac80211 Merge 6.1.24 into android14-6.1 2023-04-22 08:52:25 +00:00
mac802154 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 2022-12-05 09:53:08 +01:00
mctp net: mctp: purge receive queues on sk destruction 2023-02-06 08:06:34 +01:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:59:53 +01:00
mptcp UPSTREAM: inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). 2023-05-16 14:09:57 +00:00
ncsi
netfilter UPSTREAM: netfilter: nf_tables: prevent OOB access in nft_byteorder_eval 2023-09-20 14:37:55 +00:00
netlabel
netlink netlink: annotate lockless accesses to nlk->max_recvmsg_len 2023-04-13 16:55:24 +02:00
netrom netrom: Fix use-after-free caused by accept on already connected socket 2023-02-09 11:28:06 +01:00
nfc UPSTREAM: net: nfc: Fix use-after-free caused by nfc_llcp_find_local 2023-09-04 12:09:23 +01:00
nsh
openvswitch net: openvswitch: fix race on port output 2023-04-20 12:35:09 +02:00
packet packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE 2022-11-29 08:30:18 -08:00
phonet
psample
qrtr net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() 2023-04-20 12:35:09 +02:00
rds rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 2023-03-10 09:33:02 +01:00
rfkill
rose net/rose: Fix to not accept on connected socket 2023-02-22 12:59:42 +01:00
rxrpc rxrpc: Fix missing unlock in rxrpc_do_sendmsg() 2022-12-31 13:32:55 +01:00
sched UPSTREAM: net/sched: sch_hfsc: Ensure inner classes have fsc curve 2023-09-18 17:02:00 +01:00
sctp UPSTREAM: inet: Add IP_LOCAL_PORT_RANGE socket option 2023-06-07 14:24:50 +00:00
smc net/smc: fix deadlock triggered by cancel_delayed_work_syn() 2023-03-22 13:33:47 +01:00
strparser
sunrpc sunrpc: only free unix grouplist after RCU settles 2023-04-13 16:55:23 +02:00
switchdev
tipc UPSTREAM: tipc: check the bearer min mtu properly when setting it by netlink 2023-06-14 16:40:59 +00:00
tls net: tls: fix device-offloaded sendpage straddling records 2023-03-17 08:50:26 +01:00
unix UPSTREAM: af_unix: Fix null-ptr-deref in unix_stream_sendpage(). 2023-09-12 15:01:22 +01:00
vmw_vsock This is the 6.1.2 stable release 2023-01-18 18:44:34 +00:00
wireless FROMGIT: wifi: nl80211: Add support for randomizing TA of auth and deauth frames 2023-05-11 05:22:29 +00:00
x25 net/x25: Fix to not accept on connected socket 2023-02-09 11:28:13 +01:00
xdp xsk: Add missing overflow check in xdp_umem_reg 2023-03-30 12:49:02 +02:00
xfrm FROMGIT: xfrm: Check if_id in inbound policy/secpath match 2023-05-12 16:23:38 +00:00
compat.c use less confusing names for iov_iter direction initializers 2023-02-09 11:28:04 +01:00
devres.c
Kconfig
Kconfig.debug
Makefile
socket.c net: avoid double iput when sock_alloc_file fails 2023-03-10 09:34:34 +01:00
sysctl_net.c
TEST_MAPPING