Eric Dumazet 4600beae41 dccp: fix dccp_v4_err()/dccp_v6_err() again ... [ Upstream commit 6af289746a ] dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed. We need to make sure the ICMP messages are big enough, using more standard ways (no more assumptions). syzbot reported: BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline] BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867 icmpv6_rcv+0x19d5/0x30d0 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:304 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x83b/0x920 tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Fixes: 977ad86c2a ("dccp: Fix out of bounds access in DCCP error handler") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Jann Horn <jannh@google.com> Reviewed-by: Jann Horn <jannh@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-10-10 21:43:38 +02:00
..
6lowpan
9p	9p: virtio: make sure 'offs' is initialized in zc_request	2023-09-23 10:46:52 +02:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2023-01-18 09:26:32 +01:00
8021q	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()	2023-05-30 12:38:36 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 12:47:02 +02:00
atm	atm: hide unused procfs functions	2023-06-09 10:22:52 +02:00
ax25	ax25: Fix UAF bugs in ax25 timers	2022-04-27 13:15:32 +02:00
batman-adv	batman-adv: Fix batadv_v_ogm_aggr_send memory leak	2023-08-30 16:35:15 +02:00
bluetooth	Bluetooth: L2CAP: Fix use-after-free	2023-08-30 16:35:11 +02:00
bpf	bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()	2022-11-25 17:36:54 +01:00
bridge	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode	2023-08-11 11:33:40 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:30:37 +01:00
can	can: bcm: Fix UAF in bcm_proc_show()	2023-08-11 11:33:47 +02:00
ceph	libceph: fix potential hang in ceph_osdc_notify()	2023-08-11 11:33:56 +02:00
core	af_unix: Fix data race around sk->sk_err.	2023-09-23 10:47:02 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:01:58 +01:00
dccp	dccp: fix dccp_v4_err()/dccp_v6_err() again	2023-10-10 21:43:38 +02:00
decnet	Remove DECnet support from kernel	2023-06-21 15:38:58 +02:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-24 08:01:25 +02:00
dsa	net: dsa: Fix duplicate frames flooded by learning	2020-04-02 16:34:24 +02:00
ethernet
hsr	net: hsr: Fix potential use-after-free	2022-12-08 11:16:32 +01:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-11-03 23:50:54 +09:00
ife
ipv4	ipv4: fix null-deref in ipv4_link_failure	2023-10-10 21:43:38 +02:00
ipv6	net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr	2023-09-23 10:47:02 +02:00
ipx
iucv	net/iucv: Fix size of interrupt data	2023-03-22 13:26:15 +01:00
kcm	kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().	2023-09-23 10:47:03 +02:00
key	net: af_key: fix sadb_x_filter validation	2023-08-30 16:35:11 +02:00
l2tp	inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().	2023-04-26 11:18:57 +02:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:12:08 +01:00
llc	llc: Don't drop packet from non-root netns.	2023-08-11 11:33:49 +02:00
mac80211	wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta	2023-04-20 12:02:10 +02:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-14 11:26:14 +01:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:46:06 +01:00
ncsi	net/ncsi: Avoid GFP_KERNEL in response handler	2021-04-16 11:57:51 +02:00
netfilter	netfilter: xt_sctp: validate the flag_info count	2023-09-23 10:46:59 +02:00
netlabel	netlabel: fix shift wrapping bug in netlbl_catmap_setlong()	2023-09-23 10:46:53 +02:00
netlink	netlink: Add __sock_i_ino() for __netlink_diag_dump().	2023-08-11 11:33:35 +02:00
netrom	netrom: Deny concurrent connect().	2023-09-23 10:46:55 +02:00
nfc	nfc: change order inside nfc_se_io error path	2023-03-17 08:30:37 +01:00
nsh	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()	2023-05-30 12:38:36 +01:00
openvswitch	net: openvswitch: fix flow memory leak in ovs_flow_cmd_new	2023-02-22 12:46:01 +01:00
packet	net/packet: annotate data-races around tp->status	2023-08-16 18:10:54 +02:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 13:57:37 +01:00
psample
qrtr	net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()	2021-03-30 14:40:12 +02:00
rds	net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()	2022-10-26 13:17:00 +02:00
rfkill
rose	net/rose: Fix to not accept on connected socket	2023-02-22 12:46:05 +01:00
rxrpc	rxrpc: Don't try to resend the request if we're receiving the reply	2022-06-14 16:53:50 +02:00
sched	net/sched: Retire rsvp classifier	2023-09-23 10:47:06 +02:00
sctp	sctp: handle invalid error codes without calling BUG()	2023-09-23 10:46:54 +02:00
smc	net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending	2022-05-18 09:18:06 +02:00
strparser
sunrpc	SUNRPC: Fix UAF in svc_tcp_listen_data_ready()	2023-08-11 11:33:44 +02:00
switchdev
tipc	net: tipc: resize nlattr array to correct size	2023-06-21 15:38:59 +02:00
tls
unix	af_unix: Fix data-race around unix_tot_inflight.	2023-09-23 10:47:02 +02:00
vmw_vsock	vsock: avoid to close connected socket after the timeout	2023-05-30 12:38:36 +01:00
wimax
wireless	wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()	2023-08-11 11:33:48 +02:00
x25	net/x25: Fix to not accept on connected socket	2023-02-22 12:46:02 +01:00
xfrm	net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure	2023-08-30 16:35:14 +02:00
compat.c	net: Return the correct errno code	2021-06-30 08:48:47 -04:00
Kconfig	Remove DECnet support from kernel	2023-06-21 15:38:58 +02:00
Makefile	Remove DECnet support from kernel	2023-06-21 15:38:58 +02:00
socket.c	net: annotate sk->sk_err write from do_recvmmsg()	2023-05-30 12:38:34 +01:00
sysctl_net.c