releases/4.19.35/net-ip6_gre-fix-possible-use-after-free-in-ip6erspan.patch

   1 From de445ff9266171b0d83876e3bfd12070a859f92b Mon Sep 17 00:00:00 2001
   2 From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
   3 Date: Sat, 6 Apr 2019 17:16:53 +0200
   4 Subject: net: ip6_gre: fix possible use-after-free in ip6erspan_rcv
   5
   6 [ Upstream commit 2a3cabae4536edbcb21d344e7aa8be7a584d2afb ]
   7
   8 erspan_v6 tunnels run __iptunnel_pull_header on received skbs to remove
   9 erspan header. This can determine a possible use-after-free accessing
  10 pkt_md pointer in ip6erspan_rcv since the packet will be 'uncloned'
  11 running pskb_expand_head if it is a cloned gso skb (e.g if the packet has
  12 been sent though a veth device). Fix it resetting pkt_md pointer after
  13 __iptunnel_pull_header
  14
  15 Fixes: 1d7e2ed22f8d ("net: erspan: refactor existing erspan code")
  16 Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
  17 Signed-off-by: David S. Miller <davem@davemloft.net>
  18 Signed-off-by: Sasha Levin <sashal@kernel.org>
  19 ---
  20  net/ipv6/ip6_gre.c | 21 +++++++++++++--------
  21  1 file changed, 13 insertions(+), 8 deletions(-)
  22
  23 diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
  24 index faed98dab913..c4a7db62658e 100644
  25 --- a/net/ipv6/ip6_gre.c
  26 +++ b/net/ipv6/ip6_gre.c
  27 @@ -540,11 +540,10 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
  28         return PACKET_REJECT;
  29  }
  30
  31 -static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
  32 -                        struct tnl_ptk_info *tpi)
  33 +static int ip6erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
  34 +                        int gre_hdr_len)
  35  {
  36         struct erspan_base_hdr *ershdr;
  37 -       struct erspan_metadata *pkt_md;
  38         const struct ipv6hdr *ipv6h;
  39         struct erspan_md2 *md2;
  40         struct ip6_tnl *tunnel;
  41 @@ -563,18 +562,16 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
  42                 if (unlikely(!pskb_may_pull(skb, len)))
  43                         return PACKET_REJECT;
  44
  45 -               ershdr = (struct erspan_base_hdr *)skb->data;
  46 -               pkt_md = (struct erspan_metadata *)(ershdr + 1);
  47 -
  48                 if (__iptunnel_pull_header(skb, len,
  49                                            htons(ETH_P_TEB),
  50                                            false, false) < 0)
  51                         return PACKET_REJECT;
  52
  53                 if (tunnel->parms.collect_md) {
  54 +                       struct erspan_metadata *pkt_md, *md;
  55                         struct metadata_dst *tun_dst;
  56                         struct ip_tunnel_info *info;
  57 -                       struct erspan_metadata *md;
  58 +                       unsigned char *gh;
  59                         __be64 tun_id;
  60                         __be16 flags;
  61
  62 @@ -587,6 +584,14 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
  63                         if (!tun_dst)
  64                                 return PACKET_REJECT;
  65
  66 +                       /* skb can be uncloned in __iptunnel_pull_header, so
  67 +                        * old pkt_md is no longer valid and we need to reset
  68 +                        * it
  69 +                        */
  70 +                       gh = skb_network_header(skb) +
  71 +                            skb_network_header_len(skb);
  72 +                       pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
  73 +                                                           sizeof(*ershdr));
  74                         info = &tun_dst->u.tun_info;
  75                         md = ip_tunnel_info_opts(info);
  76                         md->version = ver;
  77 @@ -623,7 +628,7 @@ static int gre_rcv(struct sk_buff *skb)
  78
  79         if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) ||
  80                      tpi.proto == htons(ETH_P_ERSPAN2))) {
  81 -               if (ip6erspan_rcv(skb, hdr_len, &tpi) == PACKET_RCVD)
  82 +               if (ip6erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
  83                         return 0;
  84                 goto out;
  85         }
  86 --
  87 2.19.1
  88