Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755257AbcK1VTS (ORCPT ); Mon, 28 Nov 2016 16:19:18 -0500 Received: from mail-pg0-f68.google.com ([74.125.83.68]:34800 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754172AbcK1VTJ (ORCPT ); Mon, 28 Nov 2016 16:19:09 -0500 Message-ID: <1480367886.18162.88.camel@edumazet-glaptop3.roam.corp.google.com> Subject: Re: net: GPF in eth_header From: Eric Dumazet To: Dmitry Vyukov Cc: Florian Westphal , syzkaller , Hannes Frederic Sowa , David Miller , Tom Herbert , Alexander Duyck , Jiri Benc , Sabrina Dubroca , netdev , LKML Date: Mon, 28 Nov 2016 13:18:06 -0800 In-Reply-To: <1480367152.18162.86.camel@edumazet-glaptop3.roam.corp.google.com> References: <1480359019.18162.79.camel@edumazet-glaptop3.roam.corp.google.com> <1480362459.18162.83.camel@edumazet-glaptop3.roam.corp.google.com> <1480367152.18162.86.camel@edumazet-glaptop3.roam.corp.google.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2420 Lines: 71 On Mon, 2016-11-28 at 13:05 -0800, Eric Dumazet wrote: > On Mon, 2016-11-28 at 11:47 -0800, Eric Dumazet wrote: > > On Mon, 2016-11-28 at 20:34 +0100, Dmitry Vyukov wrote: > > > On Mon, Nov 28, 2016 at 8:04 PM, 'Andrey Konovalov' via syzkaller > > > > > > Hi Eric, > > > > > > > > As far as I can see, skb_network_offset() becomes negative after > > > > pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data) in nf_ct_frag6_queue(). > > > > At least I'm able to detect that with a BUG_ON(). > > > > > > > > Also it seems that the issue is only reproducible (at least with the > > > > poc I provided) for a short time after boot. > > > > > > > > > Eric, > > > > > > Is it enough to debug? Or maybe Andrey can trace some values for you. > > > > Well, now we are talking, if you tell me how many modules you load, it > > might help ;) > > > > nf_ct_frag6_queue is nowhere to be seen in my kernels, that might > > explain why I could not reproduce the bug. > > > > Let me try ;) > > > > Might be a bug added in commit daaa7d647f81f3 > ("netfilter: ipv6: avoid nf_iterate recursion") > > Florian, what do you think of dropping a packet that presumably was > mangled badly by nf_ct_frag6_queue() ? > > (Like about 48 byte pulled :(, and/or skb->csum changed ) > > diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c > index f7aab5ab93a5..31aa947332d8 100644 > --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c > +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c > @@ -65,8 +65,8 @@ static unsigned int ipv6_defrag(void *priv, > > err = nf_ct_frag6_gather(state->net, skb, > nf_ct6_defrag_user(state->hook, skb)); > - /* queued */ > - if (err == -EINPROGRESS) > + /* queued or mangled ... */ > + if (err) > return NF_STOLEN; Or more exactly , returning NF_DROP so that skb is really freed ;) diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index f7aab5ab93a5..508739a3ca2a 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c @@ -65,9 +65,9 @@ static unsigned int ipv6_defrag(void *priv, err = nf_ct_frag6_gather(state->net, skb, nf_ct6_defrag_user(state->hook, skb)); - /* queued */ - if (err == -EINPROGRESS) - return NF_STOLEN; + /* queued or mangled ... */ + if (err) + return (err == -EINPROGRESS) ? NF_STOLEN : NF_DROP; return NF_ACCEPT; }