Commit 121d57af authored by Willem de Bruijn's avatar Willem de Bruijn Committed by David S. Miller
Browse files

gso: validate gso_type in GSO handlers 

Validate gso_type during segmentation as SKB_GSO_DODGY sources
may pass packets where the gso_type does not match the contents.

Syzkaller was able to enter the SCTP gso handler with a packet of
gso_type SKB_GSO_TCPV4.

On entry of transport layer gso handlers, verify that the gso_type
matches the transport protocol.

Fixes: 90017acc ("sctp: Add GSO support")
Link: http://lkml.kernel.org/r/<001a1137452496ffc305617e5fe0@google.com

>
Reported-by: default avatar <syzbot+fee64147a25aecd48055@syzkaller.appspotmail.com>
Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Reviewed-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7c68d1a6

net/ipv4/esp4_offload.c

+3 −0
Original line number Diff line number Diff line
@@ -122,6 +122,9 @@ static struct sk_buff *esp4_gso_segment(struct sk_buff *skb, 
	if (!xo)

		goto out;



	if (!(skb_shinfo(skb)->gso_type & SKB_GSO_ESP))

		goto out;



	seq = xo->seq.low;



	x = skb->sp->xvec[skb->sp->len - 1];

net/ipv4/tcp_offload.c

+3 −0
Original line number Diff line number Diff line
@@ -32,6 +32,9 @@ static void tcp_gso_tstamp(struct sk_buff *skb, unsigned int ts_seq, 
static struct sk_buff *tcp4_gso_segment(struct sk_buff *skb,

					netdev_features_t features)

{

	if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4))

		return ERR_PTR(-EINVAL);



	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))

		return ERR_PTR(-EINVAL);

net/ipv4/udp_offload.c

+3 −0
Original line number Diff line number Diff line
@@ -203,6 +203,9 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, 
		goto out;

	}



	if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP))

		goto out;



	if (!pskb_may_pull(skb, sizeof(struct udphdr)))

		goto out;

net/ipv6/esp6_offload.c

+3 −0
Original line number Diff line number Diff line
@@ -149,6 +149,9 @@ static struct sk_buff *esp6_gso_segment(struct sk_buff *skb, 
	if (!xo)

		goto out;



	if (!(skb_shinfo(skb)->gso_type & SKB_GSO_ESP))

		goto out;



	seq = xo->seq.low;



	x = skb->sp->xvec[skb->sp->len - 1];

net/ipv6/tcpv6_offload.c

+3 −0
Original line number Diff line number Diff line
@@ -46,6 +46,9 @@ static struct sk_buff *tcp6_gso_segment(struct sk_buff *skb, 
{

	struct tcphdr *th;



	if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))

		return ERR_PTR(-EINVAL);



	if (!pskb_may_pull(skb, sizeof(*th)))

		return ERR_PTR(-EINVAL);

CRA Git | Maintained and supported by SUSTech CRA and CCSE