Toshiaki Makita ae4745730c net: Fix untag for vlan packets without ethernet header ... In some situation vlan packets do not have ethernet headers. One example is packets from tun devices. Users can specify vlan protocol in tun_pi field instead of IP protocol, and skb_vlan_untag() attempts to untag such packets. skb_vlan_untag() (more precisely, skb_reorder_vlan_header() called by it) however did not expect packets without ethernet headers, so in such a case size argument for memmove() underflowed and triggered crash. ==== BUG: unable to handle kernel paging request at ffff8801cccb8000 IP: __memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43 PGD 9cee067 P4D 9cee067 PUD 1d9401063 PMD 1cccb7063 PTE 2810100028101 Oops: 000b [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 17663 Comm: syz-executor2 Not tainted 4.16.0-rc7+ #368 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43 RSP: 0018:ffff8801cc046e28 EFLAGS: 00010287 RAX: ffff8801ccc244c4 RBX: fffffffffffffffe RCX: fffffffffff6c4c2 RDX: fffffffffffffffe RSI: ffff8801cccb7ffc RDI: ffff8801cccb8000 RBP: ffff8801cc046e48 R08: ffff8801ccc244be R09: ffffed0039984899 R10: 0000000000000001 R11: ffffed0039984898 R12: ffff8801ccc244c4 R13: ffff8801ccc244c0 R14: ffff8801d96b7c06 R15: ffff8801d96b7b40 FS: 00007febd562d700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8801cccb8000 CR3: 00000001ccb2f006 CR4: 00000000001606e0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: memmove include/linux/string.h:360 [inline] skb_reorder_vlan_header net/core/skbuff.c:5031 [inline] skb_vlan_untag+0x470/0xc40 net/core/skbuff.c:5061 __netif_receive_skb_core+0x119c/0x3460 net/core/dev.c:4460 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4627 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4701 netif_receive_skb+0xae/0x390 net/core/dev.c:4725 tun_rx_batched.isra.50+0x5ee/0x870 drivers/net/tun.c:1555 tun_get_user+0x299e/0x3c20 drivers/net/tun.c:1962 tun_chr_write_iter+0xb9/0x160 drivers/net/tun.c:1990 call_write_iter include/linux/fs.h:1782 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x684/0x970 fs/read_write.c:482 vfs_write+0x189/0x510 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xef/0x220 fs/read_write.c:581 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x454879 RSP: 002b:00007febd562cc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007febd562d6d4 RCX: 0000000000454879 RDX: 0000000000000157 RSI: 0000000020000180 RDI: 0000000000000014 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000006b0 R14: 00000000006fc120 R15: 0000000000000000 Code: 90 90 90 90 90 90 90 48 89 f8 48 83 fa 20 0f 82 03 01 00 00 48 39 fe 7d 0f 49 89 f0 49 01 d0 49 39 f8 0f 8f 9f 00 00 00 48 89 d1 <f3> a4 c3 48 81 fa a8 02 00 00 72 05 40 38 fe 74 3b 48 83 ea 20 RIP: __memmove+0x24/0x1a0 arch/x86/lib/memmove_64.S:43 RSP: ffff8801cc046e28 CR2: ffff8801cccb8000 ==== We don't need to copy headers for packets which do not have preceding headers of vlan headers, so skip memmove() in that case. Fixes: 4bbb3e0e82 ("net: Fix vlan untag for bridge and vlan_dev with reorder_hdr off") Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-03-30 12:36:27 -04:00
..
Makefile	xdp: base API for new XDP rx-queue info concept	2018-01-05 15:21:20 -08:00
datagram.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
dev.c	net: fix possible out-of-bound read in skb_network_protocol()	2018-03-27 10:53:27 -04:00
dev_addr_lists.c	net: fix spelling for synchronized	2014-11-18 15:26:32 -05:00
dev_ioctl.c	net: don't unnecessarily load kernel modules in dev_ioctl()	2018-03-07 15:12:58 -05:00
devlink.c	devlink: Remove redundant free on error path	2018-03-20 10:59:29 -04:00
drop_monitor.c	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
dst.c	net: Remove dst->next	2017-11-30 09:54:27 -05:00
dst_cache.c	net: dst_cache_per_cpu_dst_set() can be static	2016-03-18 17:45:08 -04:00
ethtool.c	net: ethtool: don't ignore return from driver get_fecparam method	2018-03-01 21:41:06 -05:00
fib_notifier.c	net: Protect iterations over net::fib_notifier_ops in fib_seq_sum()	2017-11-15 14:01:30 +09:00
fib_rules.c	fib_rules: exit_net cleanup check added	2017-11-14 15:45:53 +09:00
filter.c	bpf: fix bpf_skb_adjust_net/bpf_skb_proto_xlat to deal with gso sctp skbs	2018-03-03 13:01:11 -08:00
flow_dissector.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-01-19 22:59:33 -05:00
gen_estimator.c	net_sched: gen_estimator: fix broken estimators based on percpu stats	2018-02-23 12:35:46 -05:00
gen_stats.c	net: sched: add support for TCQ_F_NOLOCK subqueues to sch_mq	2017-12-08 13:32:26 -05:00
gro_cells.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
hwbm.c	net: hwbm: Fix unbalanced spinlock in error case	2016-05-25 12:35:09 -07:00
link_watch.c	net: link_watch: mark bonding link events urgent	2018-01-23 19:43:30 -05:00
lwt_bpf.c	bpf: rename bpf_compute_data_end into bpf_compute_data_pointers	2017-09-26 13:36:44 -07:00
lwtunnel.c	ipv6: sr: define core operations for seg6local lightweight tunnel	2017-08-07 14:16:22 -07:00
neighbour.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-01-17 00:10:42 -05:00
net-procfs.c	net: delete /proc THIS_MODULE references	2018-01-16 15:01:33 -05:00
net-sysfs.c	net: introduce helper dev_change_tx_queue_len()	2018-01-29 12:42:15 -05:00
net-sysfs.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
net-traces.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
net_namespace.c	net: Move net:netns_ids destruction out of rtnl_lock() and document locking scheme	2018-01-25 11:15:35 -05:00
netclassid_cgroup.c	cgroup: add @flags to css_task_iter_start() and implement CSS_TASK_ITER_PROCS	2017-07-21 11:14:51 -04:00
netevent.c	netevent: remove automatic variable in register_netevent_notifier()	2015-05-31 00:03:21 -07:00
netpoll.c	netpoll: Use lockdep to assert IRQs are disabled/enabled	2017-11-08 11:13:54 +01:00
netprio_cgroup.c	net: remove duplicate includes	2017-12-13 13:18:46 -05:00
pktgen.c	pktgen: Clean read user supplied flag mess	2018-01-24 15:03:36 -05:00
ptp_classifier.c	ptp: Change ptp_class to a proper bitmask	2015-11-03 11:08:22 -05:00
request_sock.c	ipv4: Namespaceify tcp_max_syn_backlog knob	2016-12-29 11:38:31 -05:00
rtnetlink.c	rtnetlink: require unique netns identifier	2018-02-08 14:33:20 -05:00
scm.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/user.h>	2017-03-02 08:42:29 +01:00
secure_seq.c	tcp: Namespaceify sysctl_tcp_timestamps	2017-06-08 10:53:29 -04:00
skbuff.c	net: Fix untag for vlan packets without ethernet header	2018-03-30 12:36:27 -04:00
sock.c	sock_diag: request _diag module only when the family or proto has been registered	2018-03-12 11:03:42 -04:00
sock_diag.c	sock_diag: request _diag module only when the family or proto has been registered	2018-03-12 11:03:42 -04:00
sock_reuseport.c	soreuseport: fix mem leak in reuseport_add_sock()	2018-02-02 19:47:03 -05:00
stream.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
sysctl_net_core.c	bpf: restrict access to core bpf sysctls	2018-01-19 18:37:00 -08:00
timestamping.c	net: skb_defer_rx_timestamp should check for phydev before setting up classify	2015-07-09 14:17:15 -07:00
tso.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
utils.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-05-02 16:40:27 -07:00
xdp.c	xdp/qede: setup xdp_rxq_info and intro xdp_rxq_info_is_reg	2018-01-05 15:21:21 -08:00