Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH net] ipv6: Fix dangling pointer when ipv6 fragment
To:     hujunwei <hujunwei4@huawei.com>, davem@davemloft.net,
        kuznet@ms2.inr.ac.ru, yoshfuji@linux-ipv6.org,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc:     mingfangsen@huawei.com, liuzhiqiang26@huawei.com,
        zhangwenhao8@huawei.com
References: <cbbedd1f-3e99-85f7-86d7-d02a86d59c29@huawei.com>
From:   Eric Dumazet <eric.dumazet@gmail.com>
Message-ID: <ee0fb75b-f976-02ae-31e3-c3f957f71923@gmail.com>
Date:   Sat, 30 Mar 2019 00:48:06 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <cbbedd1f-3e99-85f7-86d7-d02a86d59c29@huawei.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


On 03/30/2019 12:29 AM, hujunwei wrote:
> From: Junwei Hu <hujunwei4@huawei.com>
> 
> At the beginning of ip6_fragment func, the prevhdr pointer is
> obtained in the ip6_find_1stfragopt func.
> However, all the pointers pointing into skb header may change
> when calling skb_checksum_help func with
> skb->ip_summed = CHECKSUM_PARTIAL condition.
> The prevhdr pointe will be dangling if it is not reloaded after
> calling __skb_linearize func in skb_checksum_help func.
> 
> Here, I add a variable, nexthdr_offset, to evaluate the offset,
> which does not changes even after calling __skb_linearize func.
> 
> Fixes: 405c92f7a541 ("ipv6: add defensive check for CHECKSUM_PARTIAL skbs in ip_fragment")
> Signed-off-by: Junwei Hu <hujunwei4@huawei.com>
> Reported-by: Wenhao Zhang <zhangwenhao8@huawei.com>
> Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>

Interesting.

We got a syzbot report yesterday about this issue. (email thread : BUG: unable to handle kernel paging request in ip6_fragment)

<quote>
syzbot found the following crash on:

HEAD commit:    8c838f53 dpaa2-eth: fix race condition with bql frame acco..
git tree:       net
console output: https://syzkaller.appspot.com/x/log.txt?x=12b83a9b200000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f05902bca21d8935
dashboard link: https://syzkaller.appspot.com/bug?extid=e8ce541d095e486074fc
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e8ce541d095e486074fc@syzkaller.appspotmail.com
</quote>


> 
> ---
>  net/ipv6/ip6_output.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index edbd12067170..6db3c60b3b66 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -606,12 +606,14 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
>      __be32 frag_id;
>      int ptr, offset = 0, err = 0;
>      u8 *prevhdr, nexthdr = 0;
> +    u8 nexthdr_offset;
>  
>      err = ip6_find_1stfragopt(skb, &prevhdr);
>      if (err < 0)
>          goto fail;
>      hlen = err;
>      nexthdr = *prevhdr;
> +    nexthdr_offset = prevhdr - skb_network_header(skb);
>  
>      mtu = ip6_skb_dst_mtu(skb);
>  
> @@ -646,6 +648,8 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
>          (err = skb_checksum_help(skb)))
>          goto fail;
>  
> +    prevhdr = skb_network_header(skb) + nexthdr_offset;
> +
>      hroom = LL_RESERVED_SPACE(rt->dst.dev);
>      if (skb_has_frag_list(skb)) {
>          unsigned int first_len = skb_pagelen(skb);
>