Commit 8d933670 authored Jan 04, 2019 by Eric Dumazet Committed by David S. Miller Jan 04, 2019

ipv6: make icmp6_send() robust against null skb->dev



syzbot was able to crash one host with the following stack trace :

kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8625 Comm: syz-executor4 Not tainted 4.20.0+ #8
RIP: 0010:dev_net include/linux/netdevice.h:2169 [inline]
RIP: 0010:icmp6_send+0x116/0x2d30 net/ipv6/icmp.c:426
 icmpv6_send
 smack_socket_sock_rcv_skb
 security_sock_rcv_skb
 sk_filter_trim_cap
 __sk_receive_skb
 dccp_v6_do_rcv
 release_sock

This is because a RX packet found socket owned by user and
was stored into socket backlog. Before leaving RCU protected section,
skb->dev was cleared in __sk_receive_skb(). When socket backlog
was finally handled at release_sock() time, skb was fed to
smack_socket_sock_rcv_skb() then icmp6_send()

We could fix the bug in smack_socket_sock_rcv_skb(), or simply
make icmp6_send() more robust against such possibility.

In the future we might provide to icmp6_send() the net pointer
instead of infering it.

Fixes: d66a8acb ("Smack: Inform peer that IPv6 traffic has been blocked")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Piotr Sawicki <p.sawicki2@partner.samsung.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 3271a482

net/ipv6/icmp.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -423,10 +423,10 @@ static int icmp6_iif(const struct sk_buff *skb)
		static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
		const struct in6_addr *force_saddr)
		{
		struct net *net = dev_net(skb->dev);
		struct inet6_dev *idev = NULL;
		struct ipv6hdr *hdr = ipv6_hdr(skb);
		struct sock *sk;
		struct net *net;
		struct ipv6_pinfo *np;
		const struct in6_addr *saddr = NULL;
		struct dst_entry *dst;
		@@ -437,12 +437,16 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
		int iif = 0;
		int addr_type = 0;
		int len;
		u32 mark = IP6_REPLY_MARK(net, skb->mark);
		u32 mark;

		if ((u8 *)hdr < skb->head \|\|
		(skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
		return;

		if (!skb->dev)
		return;
		net = dev_net(skb->dev);
		mark = IP6_REPLY_MARK(net, skb->mark);
		/*
		* Make sure we respect the rules
		* i.e. RFC 1885 2.4(e)

Admin message