Paolo Abeni 1731234e8b net: prevent skb corruption on frag list segmentation ... [ Upstream commit c329b261af ] Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: [ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 62.631083] #PF: supervisor read access in kernel mode [ 62.636312] #PF: error_code(0x0000) - not-present page [ 62.641541] PGD 0 P4D 0 [ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364 [ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022 [ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858 ./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261 net/ipv4/udp_offload.c:277) [ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246 [ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000 [ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4 [ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9 [ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2 [ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9 [ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000) knlGS:0000000000000000 [ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0 [ 62.749948] Call Trace: [ 62.752498] <TASK> [ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398) [ 62.787605] skb_mac_gso_segment (net/core/gro.c:141) [ 62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2)) [ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862 net/core/dev.c:3659) [ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710) [ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330) [ 62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210) net/netfilter/core.c:626) [ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55) [ 62.825652] maybe_deliver (net/bridge/br_forward.c:193) [ 62.829420] br_flood (net/bridge/br_forward.c:233) [ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215) [ 62.837403] br_handle_frame (net/bridge/br_input.c:298 net/bridge/br_input.c:416) [ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387) [ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570) [ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638 net/core/dev.c:5727) [ 62.876795] napi_complete_done (./include/linux/list.h:37 ./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067) [ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191) [ 62.893534] __napi_poll (net/core/dev.c:6498) [ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89 net/core/dev.c:6640) [ 62.905276] kthread (kernel/kthread.c:379) [ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314) [ 62.917119] </TASK> In the critical scenario, rx-gro-list GRO-ed packets are fed, via a bridge, both to the local input path and to an egress device (tun). The segmentation of such packets unsafely writes to the cloned skbs with shared heads. This change addresses the issue by uncloning as needed the to-be-segmented skbs. Reported-by: Ian Kumlien <ian.kumlien@gmail.com> Tested-by: Ian Kumlien <ian.kumlien@gmail.com> Fixes: 3a1296a38d ("net: Support GRO/GSO fraglist chaining.") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-07-23 13:49:23 +02:00
..
bpf_sk_storage.c
datagram.c	net: datagram: fix data-races in datagram_poll()	2023-05-24 17:32:32 +01:00
dev.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-14 11:15:21 +02:00
dev.h
dev_addr_lists.c
dev_addr_lists_test.c
dev_ioctl.c
devlink.c	devlink: protect devlink dump by the instance lock	2022-12-31 13:32:55 +01:00
drop_monitor.c
dst.c
dst_cache.c
failover.c
fib_notifier.c
fib_rules.c
filter.c	bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings	2023-07-19 16:21:11 +02:00
flow_dissector.c	netfilter: conntrack: Fix data-races around ct mark	2022-11-18 15:21:00 +01:00
flow_offload.c
gen_estimator.c
gen_stats.c
gro.c	skb: Do mix page pool and page referenced frags in GRO	2023-02-09 11:28:05 +01:00
gro_cells.c
hwbm.c
link_watch.c
lwt_bpf.c
lwtunnel.c	xfrm: lwtunnel: squelch kernel warning in case XFRM encap type is not available	2022-10-12 10:45:51 +02:00
Makefile
neighbour.c	neighbour: delete neigh_lookup_nodev as not used	2023-06-21 16:01:03 +02:00
net-procfs.c
net-sysfs.c	net-sysfs: Convert to use sysfs_emit() APIs	2022-09-30 12:27:44 +01:00
net-sysfs.h
net-traces.c
net_namespace.c	net: fix UaF in netns ops registration error path	2023-02-01 08:34:43 +01:00
netclassid_cgroup.c
netevent.c
netpoll.c	net: don't let netpoll invoke NAPI if in xmit context	2023-04-13 16:55:21 +02:00
netprio_cgroup.c
of_net.c
page_pool.c	page_pool: fix inconsistency for page_pool_ring_[un]lock()	2023-06-05 09:26:20 +02:00
pktgen.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
ptp_classifier.c
request_sock.c
rtnetlink.c	netlink: do not hard code device address lenth in fdb dumps	2023-07-19 16:21:12 +02:00
scm.c	scm: add user copy checks to put_cmsg()	2023-03-10 09:33:54 +01:00
secure_seq.c
selftests.c
skbuff.c	net: prevent skb corruption on frag list segmentation	2023-07-23 13:49:23 +02:00
skmsg.c	bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready()	2023-06-14 11:15:16 +02:00
sock.c	netlink: Add __sock_i_ino() for __netlink_diag_dump().	2023-07-19 16:21:13 +02:00
sock_destructor.h
sock_diag.c
sock_map.c	bpf, sockmap: Convert schedule_work into delayed_work	2023-06-05 09:26:18 +02:00
sock_reuseport.c	soreuseport: Fix socket selection for SO_INCOMING_CPU.	2022-12-31 13:32:04 +01:00
stream.c	net: deal with most data-races in sk_wait_event()	2023-05-24 17:32:32 +01:00
sysctl_net_core.c
timestamping.c
tso.c
utils.c
xdp.c