Commit 36f6ee22 authored Sep 26, 2017 by Alexey Kodanev Committed by David S. Miller Sep 26, 2017

vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit



When running LTP IPsec tests, KASan might report:

BUG: KASAN: use-after-free in vti_tunnel_xmit+0xeee/0xff0 [ip_vti]
Read of size 4 at addr ffff880dc6ad1980 by task swapper/0/0
...
Call Trace:
  <IRQ>
  dump_stack+0x63/0x89
  print_address_description+0x7c/0x290
  kasan_report+0x28d/0x370
  ? vti_tunnel_xmit+0xeee/0xff0 [ip_vti]
  __asan_report_load4_noabort+0x19/0x20
  vti_tunnel_xmit+0xeee/0xff0 [ip_vti]
  ? vti_init_net+0x190/0x190 [ip_vti]
  ? save_stack_trace+0x1b/0x20
  ? save_stack+0x46/0xd0
  dev_hard_start_xmit+0x147/0x510
  ? icmp_echo.part.24+0x1f0/0x210
  __dev_queue_xmit+0x1394/0x1c60
...
Freed by task 0:
  save_stack_trace+0x1b/0x20
  save_stack+0x46/0xd0
  kasan_slab_free+0x70/0xc0
  kmem_cache_free+0x81/0x1e0
  kfree_skbmem+0xb1/0xe0
  kfree_skb+0x75/0x170
  kfree_skb_list+0x3e/0x60
  __dev_queue_xmit+0x1298/0x1c60
  dev_queue_xmit+0x10/0x20
  neigh_resolve_output+0x3a8/0x740
  ip_finish_output2+0x5c0/0xe70
  ip_finish_output+0x4ba/0x680
  ip_output+0x1c1/0x3a0
  xfrm_output_resume+0xc65/0x13d0
  xfrm_output+0x1e4/0x380
  xfrm4_output_finish+0x5c/0x70

Can be fixed if we get skb->len before dst_output().

Fixes: b9959fd3 ("vti: switch to new ip tunnel code")
Fixes: 22e1b23d ("vti6: Support inter address family tunneling.")
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent b4391db4

net/ipv4/ip_vti.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -168,6 +168,7 @@ static netdev_tx_t vti_xmit(struct sk_buff skb, struct net_device dev,
		struct ip_tunnel_parm *parms = &tunnel->parms;
		struct dst_entry *dst = skb_dst(skb);
		struct net_device tdev; / Device to other host */
		int pkt_len = skb->len;
		int err;
		int mtu;

		@@ -229,7 +230,7 @@ static netdev_tx_t vti_xmit(struct sk_buff skb, struct net_device dev,

		err = dst_output(tunnel->net, skb->sk, skb);
		if (net_xmit_eval(err) == 0)
		err = skb->len;
		err = pkt_len;
		iptunnel_xmit_stats(dev, err);
		return NETDEV_TX_OK;

net/ipv6/ip6_vti.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -445,6 +445,7 @@ vti6_xmit(struct sk_buff skb, struct net_device dev, struct flowi *fl)
		struct dst_entry *dst = skb_dst(skb);
		struct net_device *tdev;
		struct xfrm_state *x;
		int pkt_len = skb->len;
		int err = -1;
		int mtu;

		@@ -502,7 +503,7 @@ vti6_xmit(struct sk_buff skb, struct net_device dev, struct flowi *fl)
		struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);

		u64_stats_update_begin(&tstats->syncp);
		tstats->tx_bytes += skb->len;
		tstats->tx_bytes += pkt_len;
		tstats->tx_packets++;
		u64_stats_update_end(&tstats->syncp);
		} else {

Admin message