Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 5 May 2023 07:58:22 +0200
From:   Florian Westphal <fw@strlen.de>
To:     "Fengtao (fengtao, Euler)" <fengtao40@huawei.com>
Cc:     Florian Westphal <fw@strlen.de>, jhs@mojatatu.com,
        xiyou.wangcong@gmail.com, jiri@resnulli.us, davem@davemloft.net,
        kuba@kernel.org, stephen@networkplumber.org,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        yanan@huawei.com, caowangbao@huawei.com
Subject: Re: BUG: KASAN: stack-out-of-bounds in __ip_options_echo
Message-ID: <20230505055822.GA6126@breakpoint.cc>
References: <05324dd2-3620-8f07-60a0-051814913ff8@huawei.com>
 <20230502165446.GA22029@breakpoint.cc>
 <9dd7ec8f-bc40-39af-febb-a7e8aabbaaed@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <9dd7ec8f-bc40-39af-febb-a7e8aabbaaed@huawei.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Precedence: bulk

Fengtao (fengtao, Euler) <fengtao40@huawei.com> wrote:
> Hi
> 
> I have tested the patch, the panic not happend.
> And I search the similar issue in kernel, and found commit:
> [1]https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed0de45a1008
> [2]https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3da1ed7ac398
> 
> So I tested another patch like this:
> ------------[ cut here ]------------
> --- .//net/ipv4/netfilter/nf_reject_ipv4.c      2023-05-02 13:03:35.427896081 +0000
> +++ .//net/ipv4/netfilter/nf_reject_ipv4.c.new  2023-05-02 13:03:00.433897970 +0000
> @@ -187,6 +187,7 @@ > 
>  void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
>  {
> +       struct ip_options opt;
>         struct iphdr *iph = ip_hdr(skb_in);
>         u8 proto = iph->protocol;
> 
> @@ -196,13 +197,18 @@
>         if (hook == NF_INET_PRE_ROUTING && nf_reject_fill_skb_dst(skb_in))
>                 return;
> 
> +       memset(&opt, 0, sizeof(opt));
> +       opt.optlen = iph->ihl*4 - sizeof(struct iphdr);
> +       if (__ip_options_compile(dev_net(skb_in->dev), &opt, skb_in, NULL))
> +               return;
> +
>         if (skb_csum_unnecessary(skb_in) || !nf_reject_verify_csum(proto)) {
> -               icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
> +               __icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0, &opt);
>                 return;
>         }
> 
>         if (nf_ip_checksum(skb_in, hook, ip_hdrlen(skb_in), proto) == 0)
> -               icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
> +               __icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0, &opt);
>  }
>  EXPORT_SYMBOL_GPL(nf_send_unreach);
> ------------[ cut here ]------------
> 
> This can also fix the issue :)

No, it papers over the problem, by only fixing this specific instance
(icmpv4).  What about ipv6?  What about all other IPCB accesses?

> BTW, I think the problem is more then ipvlan? Maybe some other scenarios that can trigger such issue.

Such as?

I don't see how this is fixable, just have have a look at "git grep
IPCB", how do you envision stack to know how such access is valid or
not?