ip_gre: set dev->hard_header_len and dev->needed_headroom properly (fdafed45) · Commits · 戴 / test

GRE tunnel has its own header_ops, ipgre_header_ops, and sets it conditionally. When it is set, it assumes the outer IP header is already created before ipgre_xmit(). This is not true when we send packets through a raw packet socket, where L2 headers are supposed to be constructed by user. Packet socket calls dev_validate_header() to validate the header. But GRE tunnel does not set dev->hard_header_len, so that check can be simply bypassed, therefore uninit memory could be passed down to ipgre_xmit(). Similar for dev->needed_headroom. dev->hard_header_len is supposed to be the length of the header created by dev->header_ops->create(), so it should be used whenever header_ops is set, and dev->needed_headroom should be used when it is not set. Reported-and-tested-by:

<syzbot+4a2c52677a8a1aa283cb@syzkaller.appspotmail.com> Cc: William Tu <u9012063@gmail.com> Acked-by:

Willem de Bruijn <willemb@google.com> Signed-off-by:

Cong Wang <xiyou.wangcong@gmail.com> Acked-by:

Xie He <xie.he.0141@gmail.com> Signed-off-by:

Jakub Kicinski <kuba@kernel.org>

net/ipv4/ip_gre.c

+11 −4

Original line number	Diff line number	Diff line
		@@ -625,9 +625,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
		}

		if (dev->header_ops) {
		/* Need space for new headers */
		if (skb_cow_head(skb, dev->needed_headroom -
		(tunnel->hlen + sizeof(struct iphdr))))
		if (skb_cow_head(skb, 0))
		goto free_skb;

		tnl_params = (const struct iphdr *)skb->data;
		@@ -748,7 +746,11 @@ static void ipgre_link_update(struct net_device *dev, bool set_mtu)
		len = tunnel->tun_hlen - len;
		tunnel->hlen = tunnel->hlen + len;

		dev->needed_headroom = dev->needed_headroom + len;
		if (dev->header_ops)
		dev->hard_header_len += len;
		else
		dev->needed_headroom += len;

		if (set_mtu)
		dev->mtu = max_t(int, dev->mtu - len, 68);

		@@ -944,6 +946,7 @@ static void __gre_tunnel_init(struct net_device *dev)
		tunnel->parms.iph.protocol = IPPROTO_GRE;

		tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
		dev->needed_headroom = tunnel->hlen + sizeof(tunnel->parms.iph);

		dev->features \|= GRE_FEATURES;
		dev->hw_features \|= GRE_FEATURES;
		@@ -987,10 +990,14 @@ static int ipgre_tunnel_init(struct net_device *dev)
		return -EINVAL;
		dev->flags = IFF_BROADCAST;
		dev->header_ops = &ipgre_header_ops;
		dev->hard_header_len = tunnel->hlen + sizeof(*iph);
		dev->needed_headroom = 0;
		}
		#endif
		} else if (!tunnel->collect_md) {
		dev->header_ops = &ipgre_header_ops;
		dev->hard_header_len = tunnel->hlen + sizeof(*iph);
		dev->needed_headroom = 0;
		}

		return ip_tunnel_init(dev);

Admin message