xfrm: Check for underflow in xfrm_state_mtu

Leo Lin reported OOB write issue in esp component:

  xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned
  modulo-2^32 space using an attacker-influenced "header_len + authsize +
  net_adj" subtracted from a small "mtu" argument. A nobody user can
  install an IPv4 ESP tunnel SA with a large authentication key
  (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),
  configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a
  large value. When a single UDP datagram is then sent through the
  tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and
  esp_output() consumes it as a signed int via:

        padto      = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))
        esp.tfclen = padto - skb->len   (assigned to int)

  esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t
  when passed to memset() inside esp_output_fill_trailer(), producing a
  ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as
  "Write of size 18446744073709551537 at addr ffff888...".

Check for underflow and return 1. This causes the sendmsg attempt to
fail with ENETUNREACH.

Fixes: c5c252389374 ("[XFRM]: Optimize MTU calculation")
Reported-by: Leo Lin <leo@depthfirst.com>
Assisted-by: Codex:26.506.31004
Signed-off-by: David Ahern <dahern@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 395d82411a87d29e7844773b7eec3d86ea2445d9..589c3b6e4679132e3710f8a9777e2a99183c20dc 100644 (file)
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -3114,10 +3114,14 @@ u32 xfrm_state_mtu(struct xfrm_state *x, int mtu)
        const struct xfrm_type *type = READ_ONCE(x->type);
        struct crypto_aead *aead;
        u32 blksize, net_adj = 0;
+       u32 overhead, payload_mtu;
 
        if (x->km.state != XFRM_STATE_VALID ||
-           !type || type->proto != IPPROTO_ESP)
+           !type || type->proto != IPPROTO_ESP) {
+               if (mtu <= x->props.header_len)
+                       return 1;
                return mtu - x->props.header_len;
+       }
 
        aead = x->data;
        blksize = ALIGN(crypto_aead_blocksize(aead), 4);
@@ -3140,8 +3144,17 @@ u32 xfrm_state_mtu(struct xfrm_state *x, int mtu)
                break;
        }
 
-       return ((mtu - x->props.header_len - crypto_aead_authsize(aead) -
-                net_adj) & ~(blksize - 1)) + net_adj - 2;
+       overhead = x->props.header_len + crypto_aead_authsize(aead) + net_adj;
+       if (mtu <= overhead)
+               return 1;
+
+       payload_mtu = mtu - overhead;
+       payload_mtu &= ~(blksize - 1);
+       if (payload_mtu <= 2)
+               return 1;
+
+       return payload_mtu + net_adj - 2;
+
 }
 EXPORT_SYMBOL_GPL(xfrm_state_mtu);