From: Greg Kroah-Hartman Date: Tue, 2 Jul 2019 07:11:57 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.1.16~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d9621b38461642eeccc067d5a098504b113d18d8;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: tipc-pass-tunnel-dev-as-null-to-udp_tunnel-6-_xmit_skb.patch --- diff --git a/queue-4.14/series b/queue-4.14/series index 362b6ed9eb4..55842ac7ce2 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -40,3 +40,4 @@ bpf-udp-ipv6-avoid-running-reuseport-s-bpf_prog-from-__udp6_lib_err.patch arm64-futex-avoid-copying-out-uninitialised-stack-in-failed-cmpxchg.patch bpf-arm64-use-more-scalable-stadd-over-ldxr-stxr-loop-in-xadd.patch futex-update-comments-and-docs-about-return-values-of-arch-futex-code.patch +tipc-pass-tunnel-dev-as-null-to-udp_tunnel-6-_xmit_skb.patch diff --git a/queue-4.14/tipc-pass-tunnel-dev-as-null-to-udp_tunnel-6-_xmit_skb.patch b/queue-4.14/tipc-pass-tunnel-dev-as-null-to-udp_tunnel-6-_xmit_skb.patch new file mode 100644 index 00000000000..ddad2167948 --- /dev/null +++ b/queue-4.14/tipc-pass-tunnel-dev-as-null-to-udp_tunnel-6-_xmit_skb.patch @@ -0,0 +1,90 @@ +From c3bcde026684c62d7a2b6f626dc7cf763833875c Mon Sep 17 00:00:00 2001 +From: Xin Long +Date: Mon, 17 Jun 2019 21:34:15 +0800 +Subject: tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb + +From: Xin Long + +commit c3bcde026684c62d7a2b6f626dc7cf763833875c upstream. + +udp_tunnel(6)_xmit_skb() called by tipc_udp_xmit() expects a tunnel device +to count packets on dev->tstats, a perpcu variable. However, TIPC is using +udp tunnel with no tunnel device, and pass the lower dev, like veth device +that only initializes dev->lstats(a perpcu variable) when creating it. + +Later iptunnel_xmit_stats() called by ip(6)tunnel_xmit() thinks the dev as +a tunnel device, and uses dev->tstats instead of dev->lstats. tstats' each +pointer points to a bigger struct than lstats, so when tstats->tx_bytes is +increased, other percpu variable's members could be overwritten. + +syzbot has reported quite a few crashes due to fib_nh_common percpu member +'nhc_pcpu_rth_output' overwritten, call traces are like: + + BUG: KASAN: slab-out-of-bounds in rt_cache_valid+0x158/0x190 + net/ipv4/route.c:1556 + rt_cache_valid+0x158/0x190 net/ipv4/route.c:1556 + __mkroute_output net/ipv4/route.c:2332 [inline] + ip_route_output_key_hash_rcu+0x819/0x2d50 net/ipv4/route.c:2564 + ip_route_output_key_hash+0x1ef/0x360 net/ipv4/route.c:2393 + __ip_route_output_key include/net/route.h:125 [inline] + ip_route_output_flow+0x28/0xc0 net/ipv4/route.c:2651 + ip_route_output_key include/net/route.h:135 [inline] + ... + +or: + + kasan: GPF could be caused by NULL-ptr deref or user memory access + RIP: 0010:dst_dev_put+0x24/0x290 net/core/dst.c:168 + + rt_fibinfo_free_cpus net/ipv4/fib_semantics.c:200 [inline] + free_fib_info_rcu+0x2e1/0x490 net/ipv4/fib_semantics.c:217 + __rcu_reclaim kernel/rcu/rcu.h:240 [inline] + rcu_do_batch kernel/rcu/tree.c:2437 [inline] + invoke_rcu_callbacks kernel/rcu/tree.c:2716 [inline] + rcu_process_callbacks+0x100a/0x1ac0 kernel/rcu/tree.c:2697 + ... + +The issue exists since tunnel stats update is moved to iptunnel_xmit by +Commit 039f50629b7f ("ip_tunnel: Move stats update to iptunnel_xmit()"), +and here to fix it by passing a NULL tunnel dev to udp_tunnel(6)_xmit_skb +so that the packets counting won't happen on dev->tstats. + +Reported-by: syzbot+9d4c12bfd45a58738d0a@syzkaller.appspotmail.com +Reported-by: syzbot+a9e23ea2aa21044c2798@syzkaller.appspotmail.com +Reported-by: syzbot+c4c4b2bb358bb936ad7e@syzkaller.appspotmail.com +Reported-by: syzbot+0290d2290a607e035ba1@syzkaller.appspotmail.com +Reported-by: syzbot+a43d8d4e7e8a7a9e149e@syzkaller.appspotmail.com +Reported-by: syzbot+a47c5f4c6c00fc1ed16e@syzkaller.appspotmail.com +Fixes: 039f50629b7f ("ip_tunnel: Move stats update to iptunnel_xmit()") +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/tipc/udp_media.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/net/tipc/udp_media.c ++++ b/net/tipc/udp_media.c +@@ -174,7 +174,6 @@ static int tipc_udp_xmit(struct net *net + goto tx_error; + } + +- skb->dev = rt->dst.dev; + ttl = ip4_dst_hoplimit(&rt->dst); + udp_tunnel_xmit_skb(rt, ub->ubsock->sk, skb, src->ipv4.s_addr, + dst->ipv4.s_addr, 0, ttl, 0, src->port, +@@ -193,10 +192,9 @@ static int tipc_udp_xmit(struct net *net + if (err) + goto tx_error; + ttl = ip6_dst_hoplimit(ndst); +- err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, +- ndst->dev, &src->ipv6, +- &dst->ipv6, 0, ttl, 0, src->port, +- dst->port, false); ++ err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, NULL, ++ &src->ipv6, &dst->ipv6, 0, ttl, 0, ++ src->port, dst->port, false); + #endif + } + return err;