[5.10,054/188] net: ensure mac header is set in virtio_net_hdr_to_skb()

From: Eric Dumazet <edumazet@google.com>

From: Eric Dumazet <edumazet@google.com>

commit 61431a5907fc36d0738e9a547c7e1556349a03e9 upstream.

Commit 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct")
added a call to dev_parse_header_protocol() but mac_header is not yet set.

This means that eth_hdr() reads complete garbage, and syzbot complained about it [1]

This patch resets mac_header earlier, to get more coverage about this change.

Audit of virtio_net_hdr_to_skb() callers shows that this change should be safe.

[1]

BUG: KASAN: use-after-free in eth_header_parse_protocol+0xdc/0xe0 net/ethernet/eth.c:282
Read of size 2 at addr ffff888017a6200b by task syz-executor313/8409

CPU: 1 PID: 8409 Comm: syz-executor313 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
 eth_header_parse_protocol+0xdc/0xe0 net/ethernet/eth.c:282
 dev_parse_header_protocol include/linux/netdevice.h:3177 [inline]
 virtio_net_hdr_to_skb.constprop.0+0x99d/0xcd0 include/linux/virtio_net.h:83
 packet_snd net/packet/af_packet.c:2994 [inline]
 packet_sendmsg+0x2325/0x52b0 net/packet/af_packet.c:3031
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 sock_no_sendpage+0xf3/0x130 net/core/sock.c:2860
 kernel_sendpage.part.0+0x1ab/0x350 net/socket.c:3631
 kernel_sendpage net/socket.c:3628 [inline]
 sock_sendpage+0xe5/0x140 net/socket.c:947
 pipe_to_sendpage+0x2ad/0x380 fs/splice.c:364
 splice_from_pipe_feed fs/splice.c:418 [inline]
 __splice_from_pipe+0x43e/0x8a0 fs/splice.c:562
 splice_from_pipe fs/splice.c:597 [inline]
 generic_splice_sendpage+0xd4/0x140 fs/splice.c:746
 do_splice_from fs/splice.c:767 [inline]
 do_splice+0xb7e/0x1940 fs/splice.c:1079
 __do_splice+0x134/0x250 fs/splice.c:1144
 __do_sys_splice fs/splice.c:1350 [inline]
 __se_sys_splice fs/splice.c:1332 [inline]
 __x64_sys_splice+0x198/0x250 fs/splice.c:1332
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46

Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Balazs Nemeth <bnemeth@redhat.com>
Cc: Willem de Bruijn <willemb@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/virtio_net.h |    2 ++
 1 file changed, 2 insertions(+)

Message ID	20210412084015.443866093@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>, Balazs Nemeth <bnemeth@redhat.com>, Willem de Bruijn <willemb@google.com>, syzbot <syzkaller@googlegroups.com>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 5.10 054/188] net: ensure mac header is set in virtio_net_hdr_to_skb() Date: Mon, 12 Apr 2021 10:39:28 +0200 Message-Id: <20210412084015.443866093@linuxfoundation.org> In-Reply-To: <20210412084013.643370347@linuxfoundation.org> References: <20210412084013.643370347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,003/188] ALSA: hda/realtek: Fix speaker amp setup on Acer Aspire E1 [5.10,004/188] ALSA: hda/conexant: Apply quirk for another HP ZBook G5 model [5.10,007/188] nfc: fix refcount leak in llcp_sock_connect() [5.10,009/188] nfc: Avoid endless loops caused by repeated llcp_sock_connect() [5.10,010/188] selinux: make nslot handling in avtab more robust [5.10,011/188] selinux: fix cond_list corruption when changing booleans [5.10,013/188] xen/evtchn: Change irq_info lock to raw_spinlock_t [5.10,015/188] net: dsa: lantiq_gswip: Let GSWIP automatically set the xMII clock [5.10,016/188] net: dsa: lantiq_gswip: Dont use PHY auto polling [5.10,017/188] net: dsa: lantiq_gswip: Configure all remaining GSWIP_MII_CFG bits [5.10,020/188] IB/hfi1: Fix probe time panic when AIP is enabled with a buggy BIOS [5.10,021/188] LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late [5.10,022/188] gcov: re-fix clang-11+ support [5.10,023/188] ia64: fix user_stack_pointer() for ptrace() [5.10,025/188] ocfs2: fix deadlock between setattr and dio_end_io_write [5.10,028/188] of: property: fw_devlink: do not link ".*,nr-gpios" [5.10,031/188] ARM: dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin [5.10,033/188] ice: Continue probe on link/PHY errors [5.10,035/188] ice: prevent ice_open and ice_stop during reset [5.10,036/188] ice: fix memory allocation call [5.10,039/188] ice: Use port number instead of PF ID for WoL [5.10,040/188] ice: Cleanup fltr list in case of allocation issues [5.10,042/188] ice: fix memory leak of aRFS after resuming from suspend [5.10,046/188] bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET [5.10,047/188] ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx [5.10,048/188] libbpf: Ensure umem pointer is non-NULL before dereferencing [5.10,053/188] bpf, sockmap: Fix incorrect fwd_alloc accounting [5.10,054/188] net: ensure mac header is set in virtio_net_hdr_to_skb() [5.10,057/188] i40e: Fix sparse error: vsi->netdev could be null [5.10,058/188] i40e: Fix sparse error: uninitialized symbol ring [5.10,059/188] i40e: Fix sparse errors in i40e_txrx.c [5.10,060/188] vdpa/mlx5: Fix suspend/resume index restoration [5.10,062/188] net: sched: fix action overwrite reference counting [5.10,064/188] nl80211: fix potential leak of ACL params [5.10,066/188] mac80211: fix time-is-after bug in mlme [5.10,070/188] net: let skb_orphan_partial wake-up waiters. [5.10,072/188] thunderbolt: Fix off by one in tb_port_find_retimer() [5.10,074/188] usbip: stub-dev synchronize sysfs code paths [5.10,077/188] driver core: Fix locking bug in deferred_probe_timeout_work_func() [5.10,078/188] scsi: pm80xx: Fix chip initialization failure [5.10,080/188] percpu: make pcpu_nr_empty_pop_pages per chunk type [5.10,081/188] i2c: turn recovery error on init to debug [5.10,083/188] KVM: x86/mmu: Merge flush and non-flush tdp_mmu_iter_cond_resched [5.10,085/188] KVM: x86/mmu: Ensure forward progress when yielding in TDP MMU iter [5.10,087/188] KVM: x86/mmu: Ensure TLBs are flushed when yielding during GFN range zap [5.10,089/188] KVM: x86/mmu: Dont allow TDP MMU to yield when recovering NX pages [5.10,094/188] xfrm: interface: fix ipv4 pmtu check to honor ip header df [5.10,095/188] xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume [5.10,096/188] remoteproc: qcom: pil_info: avoid 64-bit division [5.10,098/188] ARM: OMAP4: Fix PMIC voltage domains for bionic [5.10,102/188] ASoC: SOF: Intel: HDA: fix core status verification [5.10,103/188] ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips [5.10,104/188] xfrm: Fix NULL pointer dereference on policy lookup [5.10,106/188] i40e: Added Asym_Pause to supported link modes [5.10,108/188] hostfs: fix memory handling in follow_link() [5.10,109/188] amd-xgbe: Update DMA coherency values [5.10,111/188] geneve: do not modify the shared tunnel info when PMTU triggers an ICMP reply [5.10,114/188] arm64: dts: imx8mm/q: Fix pad control of SD1_DATA0 [5.10,116/188] can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE [5.10,117/188] can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE [5.10,119/188] ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso [5.10,120/188] gianfar: Handle error code at MAC address change [5.10,122/188] cxgb4: avoid collecting SGE_QBASE regs during traffic [5.10,125/188] net/ncsi: Avoid channel_monitor hrtimer deadlock [5.10,126/188] net: qrtr: Fix memory leak on qrtr_tx_wait failure [5.10,127/188] nfp: flower: ignore duplicate merge hints from FW [5.10,130/188] ASoC: sunxi: sun4i-codec: fill ASoC card owner [5.10,132/188] net/mlx5e: Fix ethtool indication of connector type [5.10,134/188] net/rds: Fix a use after free in rds_message_map_pages [5.10,136/188] soc/fsl: qbman: fix conflicting alignment attributes [5.10,138/188] RDMA/rtrs-clt: Close rtrs client conn before destroying rtrs clt session files [5.10,140/188] net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...); [5.10,142/188] scsi: ufs: core: Fix task management request completion timeout [5.10,144/188] net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb [5.10,146/188] clk: fix invalid usage of list cursor in register [5.10,147/188] clk: fix invalid usage of list cursor in unregister [5.10,152/188] openvswitch: fix send of uninitialized stack memory in ct limit reply [5.10,153/188] i2c: designware: Adjust bus_freq_hz when refuse high speed mode set [5.10,154/188] iwlwifi: fix 11ax disabled bit in the regulatory capability flags [5.10,156/188] tipc: increment the tmp aead refcnt before attaching it [5.10,157/188] net: hns3: clear VF down state bit before request link status [5.10,159/188] net/mlx5: Fix PPLM register mapping [5.10,161/188] RDMA/cxgb4: check for ipv6 address properly while destroying listener [5.10,162/188] perf report: Fix wrong LBR block sorting [5.10,163/188] RDMA/qedr: Fix kernel panic when trying to access recv_cq [5.10,165/188] i40e: Fix parameters in aq_get_phy_register() [5.10,168/188] vdpa/mlx5: Fix wrong use of bit numbers [5.10,170/188] clk: socfpga: fix iomem pointer cast on 64-bit [5.10,171/188] lockdep: Address clang -Wformat warning printing for %hd [5.10,172/188] dt-bindings: net: ethernet-controller: fix typo in NVMEM [5.10,173/188] net: sched: bump refcount for new action in ACT replace mode [5.10,175/188] cfg80211: remove WARN_ON() in cfg80211_sme_connect [5.10,177/188] drivers: net: fix memory leak in atusb_probe [5.10,179/188] net: mac802154: Fix general protection fault [5.10,180/188] net: ieee802154: nl-mac: fix check on panid [5.10,183/188] net: ieee802154: fix nl802154 add llsec key [5.10,186/188] net: ieee802154: forbid monitor for del llsec seclevel [5.10,188/188] Revert "net: sched: bump refcount for new action in ACT replace mode"

[5.10,054/188] net: ensure mac header is set in virtio_net_hdr_to_skb()

Commit Message

Patch