Received: by 2002:ac0:aed5:0:0:0:0:0 with SMTP id t21csp4477093imb; Wed, 6 Mar 2019 14:32:09 -0800 (PST) X-Google-Smtp-Source: APXvYqzSJBd7MDCmGey/T6JuaqTeewBLXOQ7KkXWrgNlXChC1GwdSS8p6UvMNikZ0C14OemmLagb X-Received: by 2002:a62:ac10:: with SMTP id v16mr9903158pfe.111.1551911529782; Wed, 06 Mar 2019 14:32:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551911529; cv=none; d=google.com; s=arc-20160816; b=etGkGxRr81fiuyZuAPMY8rOyx8DSVKhDTdn1rxgtfn0MQFeuxKA1OpG6jsO36kxRD9 PiOZJgS1P7Le/747QIXNyoPazHEfkR5W1MJ2kanoYjZDQ3Xiazfcjzo+d3m8sz7YqYqZ 23WV0bzlBEJoRreDA7Neha9P+sddJQBmHbjyXEXsHMVDiNpl30gXZu59+Kta4zyH4TYW njr6D1yW3O9A0FJQKGA8MhmxbSsXFwr1xm+1sf9+ZxMW/fzjMr0Z2Q2B00G4tfxF66iq cuWKSE86pc4FT7A0rt6bTgmnCgq39hqmW1epuCmNV8/I8xzinHfPTEtqu1KMVEIfs0TI yacg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:from:references:cc:to:subject:dkim-signature; bh=ESza+D2sKA/LuHOn567IPxtp5+Pk9utnmnVH7Mgi6bY=; b=kpHK4GLmBod4Pbs8gx9v/G5BgXGNOldIo3+BOO9cCg+r7uVAV3VI1Ik7zKU04/wAfD ujwaSVr267rd9VY+r8Em3rAniPX/RjbE9dUPBMnxh4yydB5bJG5VWfc7yhq0e+HIEXh/ /ClIsOXct+9pZvwM+byNQC5GGJgApbh6Uli3KPRbxtJ0GKPz9VUleQU6SQ6aFXxmh8nu 6eSspsKl6aQje62yl8b0auGELTOftefavQfhAnP+1Wh5La9PmT9UwwWOsSIcP3Hj8cCq QRtM2xAUpZdkB1ziK6eFumS+G98Y2H94WPm1UOyWqAk+AYVncRl+ud5pEM15U8DVl7iE kLpQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=bsgkCyTF; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j21si2339985pgg.434.2019.03.06.14.31.51; Wed, 06 Mar 2019 14:32:09 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=bsgkCyTF; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727380AbfCFWb2 (ORCPT + 99 others); Wed, 6 Mar 2019 17:31:28 -0500 Received: from mail-pg1-f194.google.com ([209.85.215.194]:45414 "EHLO mail-pg1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726352AbfCFWb2 (ORCPT ); Wed, 6 Mar 2019 17:31:28 -0500 Received: by mail-pg1-f194.google.com with SMTP id 125so9313101pgc.12; Wed, 06 Mar 2019 14:31:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=ESza+D2sKA/LuHOn567IPxtp5+Pk9utnmnVH7Mgi6bY=; b=bsgkCyTFGhH6eWoGNiVtJ2vEw7AKwhbgSV3ypFiEydVGFWsiD2QoffDwZ379HYAb0u NHJhIbamXbEUWmunu9uEUDwKzZeyD/pCXITGjoIH9xhq3JySPxk85iq7G1MsXr4dGMO2 jtvdUd83aPXdQ2cZxFxXu9xBlZ+HjCdX6TDRvXF2iyeKNbFBnrXNz7qyp9ixkQPI0bfq 0bK2hCyG5mHKdV+fnJkJB3S2CM90C1u47zwRCXjUwW8FuNPbh1tTXFzb6fNhsOZwuv+g t8VaVIhoYuj5gcJtEpNXJAeTJns2/Jr9yjkfHko3IeRI5oUWBOdoguS+0m5KHQg50g9O p3hQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=ESza+D2sKA/LuHOn567IPxtp5+Pk9utnmnVH7Mgi6bY=; b=rBWI6xCC3Tmqg9kzUR8hTbAaQzyoJt1eD/AdloKo6q1IAK4d5YwGE5xGjVm4kMWWRE xp8L6uL/1NKlazI7RLWiUOnk9ET/RK/XGvAKOdmC5UUMLLxpeEJd5/mi/xEb1ZjOXe9x 664lZuxbBuTal0xBGka0GQtzZOHGhX+S4CRl7uMFvUIt3yJWOBvsoLWCZBCl3OU585BN ohDImlrYU3uCPzlz7lID/H5RZK6FbDJRg+1BEqnGKrImEvwdihpNyghbCaLYk/Wd6bmY hEmFC6DzZVK99q4NjNrGtLPsAxmvYKEx9F1P91SlPZgBkB51jHw3zcGgO73Ak20bwBDd uscg== X-Gm-Message-State: APjAAAXsc3AN3DvsCCiXM9+auoR0GoGD170HRf7Rfek4cinRVZGnry9k Gw3vkjH4iAvaMdP8aCNABPff2okc X-Received: by 2002:a63:9246:: with SMTP id s6mr8262983pgn.349.1551911487277; Wed, 06 Mar 2019 14:31:27 -0800 (PST) Received: from ?IPv6:2620:15c:2c1:200:55c7:81e6:c7d8:94b? ([2620:15c:2c1:200:55c7:81e6:c7d8:94b]) by smtp.gmail.com with ESMTPSA id s79sm6606909pfa.61.2019.03.06.14.31.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 06 Mar 2019 14:31:26 -0800 (PST) Subject: Re: [PATCH v2] xfrm: Reset secpath in xfrm failure To: Myungho Jung , Steffen Klassert Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20190306215556.GA6104@myunghoj-Precision-5530> From: Eric Dumazet Message-ID: <1b3fc434-a5d2-286f-e7ef-027d165a5413@gmail.com> Date: Wed, 6 Mar 2019 14:31:25 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20190306215556.GA6104@myunghoj-Precision-5530> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/06/2019 01:55 PM, Myungho Jung wrote: > In esp4_gro_receive() and esp6_gro_receive(), secpath can be allocated > without adding xfrm state to xvec. Then, sp->xvec[sp->len - 1] would > fail and result in dereferencing invalid pointer in esp4_gso_segment() > and esp6_gso_segment(). Reset secpath if xfrm function returns error. > > Fixes: 7785bba299a8 ("esp: Add a software GRO codepath") > Reported-by: syzbot+b69368fd933c6c592f4c@syzkaller.appspotmail.com > Signed-off-by: Myungho Jung > --- > Changes in v2: > - Add fixes tag. > > net/ipv4/esp4_offload.c | 9 +++++++-- > net/ipv6/esp6_offload.c | 9 +++++++-- > 2 files changed, 14 insertions(+), 4 deletions(-) > > diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c > index 8756e0e790d2..7329e40c73f6 100644 > --- a/net/ipv4/esp4_offload.c > +++ b/net/ipv4/esp4_offload.c > @@ -51,14 +51,18 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, > if (!sp) > goto out; > > - if (sp->len == XFRM_MAX_DEPTH) > + if (sp->len == XFRM_MAX_DEPTH) { > + secpath_reset(skb); > goto out; > + } > > x = xfrm_state_lookup(dev_net(skb->dev), skb->mark, > (xfrm_address_t *)&ip_hdr(skb)->daddr, > spi, IPPROTO_ESP, AF_INET); > - if (!x) > + if (!x) { > + secpath_reset(skb); > goto out; > + } > I suggest another exit label, so that you replace "goto out" by "goto out_reset"; diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c index 8756e0e790d2a94a5b4a587c3bc3de0673baf2c4..76f754f6692696ba2aa8c9eb03b68b92d1e39ee1 100644 --- a/net/ipv4/esp4_offload.c +++ b/net/ipv4/esp4_offload.c @@ -82,6 +82,8 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, xfrm_input(skb, IPPROTO_ESP, spi, -2); return ERR_PTR(-EINPROGRESS); +out_reset: + secpath_reset(skb); out: skb_push(skb, offset); NAPI_GRO_CB(skb)->same_flow = 0; > sp->xvec[sp->len++] = x; > sp->olen++; > @@ -66,6 +70,7 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, > xo = xfrm_offload(skb); > if (!xo) { > xfrm_state_put(x); > + secpath_reset(skb); > goto out; > } > }