Received: by 10.192.165.156 with SMTP id m28csp60431imm; Tue, 10 Apr 2018 16:23:29 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+aQ5U5BVU2Z02ywSsK2fCFctg5+VsemzzPgdjFwiFbO0O10xNYRnsYaWuvph0Fm7NhPhw5 X-Received: by 10.98.178.20 with SMTP id x20mr2005857pfe.32.1523402609675; Tue, 10 Apr 2018 16:23:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523402609; cv=none; d=google.com; s=arc-20160816; b=Ui8rSBCAiKMGYj2UzJeQQV1pwp7/f7JIdOTlxg+2HtBxoYi8vYhi1idkJZOhrjW3vL r+DwXLrEkPYYr+LvgcJQz4ZFpxjZt+0d7eetwg7TAWXYe7qRqxGbmvRGRw+kwlF9jqE7 L4REmCDS0hx1JU5ITOXzC91ChGWG0dD47xC+nyU7/H3SQ7LTYE7KI9ZozOlH9uMAMFio y73/vg7F04FeGJrN4tDTBG6446ptRnnB3n50eyd+hEPau15xP9534DlplofV1Ehc6Kkr eWJ7ambDHgWP0vpYjyrrEYIDgMb8VxpPwP6hUTr/+VUhnIDnox814x+3hXCDuLjD/dY+ HweA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=JoMtZzRMKZM40j9uJpOKg8wko34jWTPQOgqe0vTdcZs=; b=Rlg9pqZ8NrTieGA0D3JK8VAN11B725CPLJD5fyO7yP00buYHiP+aM/d+IbYYiSe8pZ 2h7HC/T0Vi4jLMubES07Qe67eRPjcrBjt+eWdtUTF00wnjj+UzkGiIrWGd/dkgC7FKku p6mbbX0Oqr8BvcE7/7720L0AKoyfKt+ptdDK8Y/UOr7Ve+LdByVS+ZLELYhhLcCb2Bjh 2TuyeaXfX6Iq2XwCTDHQld+2I8Z5mY7HRpfFRZ9cXKeQhBshMC+YZqgrF2th5LFQaq+a i/shkLMcSq720wMUmobJPsih8dabDey57U60aYHPju55KKgvx3LfdeUS9UwOF4YfD1pB omYQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s21si2951644pfi.87.2018.04.10.16.22.53; Tue, 10 Apr 2018 16:23:29 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754807AbeDJWb2 (ORCPT + 99 others); Tue, 10 Apr 2018 18:31:28 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:40362 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752802AbeDJWb0 (ORCPT ); Tue, 10 Apr 2018 18:31:26 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 463DFDE0; Tue, 10 Apr 2018 22:31:25 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Pravin B Shelar , "Reported-by: syzbot" , "David S. Miller" Subject: [PATCH 4.15 125/168] net: fix possible out-of-bound read in skb_network_protocol() Date: Wed, 11 Apr 2018 00:24:27 +0200 Message-Id: <20180410212805.897549657@linuxfoundation.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180410212800.144079021@linuxfoundation.org> References: <20180410212800.144079021@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet [ Upstream commit 1dfe82ebd7d8fd43dba9948fdfb31f145014baa0 ] skb mac header is not necessarily set at the time skb_network_protocol() is called. Use skb->data instead. BUG: KASAN: slab-out-of-bounds in skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739 Read of size 2 at addr ffff8801b3097a0b by task syz-executor5/14242 CPU: 1 PID: 14242 Comm: syz-executor5 Not tainted 4.16.0-rc6+ #280 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x23c/0x360 mm/kasan/report.c:412 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443 skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739 harmonize_features net/core/dev.c:2924 [inline] netif_skb_features+0x509/0x9b0 net/core/dev.c:3011 validate_xmit_skb+0x81/0xb00 net/core/dev.c:3084 validate_xmit_skb_list+0xbf/0x120 net/core/dev.c:3142 packet_direct_xmit+0x117/0x790 net/packet/af_packet.c:256 packet_snd net/packet/af_packet.c:2944 [inline] packet_sendmsg+0x3aed/0x60b0 net/packet/af_packet.c:2969 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xca/0x110 net/socket.c:639 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2047 __sys_sendmsg+0xe5/0x210 net/socket.c:2081 Fixes: 19acc327258a ("gso: Handle Trans-Ether-Bridging protocol in skb_network_protocol()") Signed-off-by: Eric Dumazet Cc: Pravin B Shelar Reported-by: Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/core/dev.c +++ b/net/core/dev.c @@ -2719,7 +2719,7 @@ __be16 skb_network_protocol(struct sk_bu if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr)))) return 0; - eth = (struct ethhdr *)skb_mac_header(skb); + eth = (struct ethhdr *)skb->data; type = eth->h_proto; }