Paolo Abeni c329b261af net: prevent skb corruption on frag list segmentation ... Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: [ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 62.631083] #PF: supervisor read access in kernel mode [ 62.636312] #PF: error_code(0x0000) - not-present page [ 62.641541] PGD 0 P4D 0 [ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364 [ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022 [ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858 ./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261 net/ipv4/udp_offload.c:277) [ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246 [ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000 [ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4 [ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9 [ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2 [ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9 [ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000) knlGS:0000000000000000 [ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0 [ 62.749948] Call Trace: [ 62.752498] <TASK> [ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398) [ 62.787605] skb_mac_gso_segment (net/core/gro.c:141) [ 62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2)) [ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862 net/core/dev.c:3659) [ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710) [ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330) [ 62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210) net/netfilter/core.c:626) [ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55) [ 62.825652] maybe_deliver (net/bridge/br_forward.c:193) [ 62.829420] br_flood (net/bridge/br_forward.c:233) [ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215) [ 62.837403] br_handle_frame (net/bridge/br_input.c:298 net/bridge/br_input.c:416) [ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387) [ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570) [ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638 net/core/dev.c:5727) [ 62.876795] napi_complete_done (./include/linux/list.h:37 ./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067) [ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191) [ 62.893534] __napi_poll (net/core/dev.c:6498) [ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89 net/core/dev.c:6640) [ 62.905276] kthread (kernel/kthread.c:379) [ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314) [ 62.917119] </TASK> In the critical scenario, rx-gro-list GRO-ed packets are fed, via a bridge, both to the local input path and to an egress device (tun). The segmentation of such packets unsafely writes to the cloned skbs with shared heads. This change addresses the issue by uncloning as needed the to-be-segmented skbs. Reported-by: Ian Kumlien <ian.kumlien@gmail.com> Tested-by: Ian Kumlien <ian.kumlien@gmail.com> Fixes: 3a1296a38d ("net: Support GRO/GSO fraglist chaining.") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2023-07-08 10:03:26 +01:00
..
bpf_sk_storage.c	bpf: Teach verifier that certain helpers accept NULL pointer.	2023-04-04 16:57:16 -07:00
datagram.c	net: datagram: fix data-races in datagram_poll()	2023-05-10 19:06:49 -07:00
dev.c	net: fix net device address assign type	2023-06-22 19:55:12 -07:00
dev.h	net-sysctl: factor-out rpm mask manipulation helpers	2023-02-09 17:45:55 -08:00
dev_addr_lists.c
dev_addr_lists_test.c	kunit: Use KUNIT_EXPECT_MEMEQ macro	2022-10-27 02:40:14 -06:00
dev_ioctl.c	net: dsa: replace NETDEV_PRE_CHANGE_HWTSTAMP notifier with a stub	2023-04-09 15:35:49 +01:00
drop_monitor.c	net: extend drop reasons for multiple subsystems	2023-04-20 20:20:49 -07:00
dst.c	net: dst: fix missing initialization of rt_uncached	2023-04-21 20:26:56 -07:00
dst_cache.c
failover.c	net: failover: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf	2022-12-12 15:18:25 -08:00
fib_notifier.c
fib_rules.c
filter.c	bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings	2023-06-21 23:48:41 +02:00
flow_dissector.c	net: flow_dissector: add support for cfm packets	2023-06-12 17:01:45 -07:00
flow_offload.c	net: flow_offload: add support for ARP frame matching	2022-11-14 11:24:16 +00:00
gen_estimator.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
gen_stats.c	net: Remove the obsolte u64_stats_fetch_*_irq() users (net).	2022-10-28 20:13:54 -07:00
gro.c	gro: move the tc_ext comparison to a helper	2023-06-18 18:08:35 +01:00
gro_cells.c
gso.c	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
hwbm.c
link_watch.c	net: linkwatch: only report IF_OPER_LOWERLAYERDOWN if iflink is actually down	2022-11-16 09:45:00 +00:00
lwt_bpf.c
lwtunnel.c	xfrm: lwtunnel: squelch kernel warning in case XFRM encap type is not available	2022-10-12 10:45:51 +02:00
Makefile	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
neighbour.c	neighbour: switch to standard rcu, instead of rcu_bh	2023-03-21 21:32:18 -07:00
net-procfs.c	net-sysfs: display two backlog queue len separately	2023-03-22 12:03:52 +01:00
net-sysfs.c	net: make default_rps_mask a per netns attribute	2023-02-20 11:22:54 +00:00
net-sysfs.h
net-traces.c	udp6: add a missing call into udp_fail_queue_rcv_skb tracepoint	2023-07-07 09:16:52 +01:00
net_namespace.c	lib/ref_tracker: improve printing stats	2023-06-05 15:28:42 -07:00
netclassid_cgroup.c
netdev-genl-gen.c	net: ynl: prefix uAPI header include with uapi/	2023-05-26 10:30:14 +01:00
netdev-genl-gen.h	net: ynl: prefix uAPI header include with uapi/	2023-05-26 10:30:14 +01:00
netdev-genl.c	netdev-genl: create a simple family for netdev stuff	2023-02-02 20:48:23 -08:00
netevent.c
netpoll.c	netpoll: allocate netdev tracker right away	2023-06-15 08:21:11 +01:00
netprio_cgroup.c
of_net.c	of: net: export of_get_mac_address_nvmem()	2022-11-29 10:45:53 +01:00
page_pool.c	page_pool: fix inconsistency for page_pool_ring_[un]lock()	2023-05-23 20:25:13 -07:00
pktgen.c	net: introduce and use skb_frag_fill_page_desc()	2023-05-13 19:47:56 +01:00
ptp_classifier.c
request_sock.c
rtnetlink.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-06-27 09:45:22 -07:00
scm.c	net: Ensure ->msg_control_user is used for user buffers	2023-04-14 11:09:27 +01:00
secure_seq.c
selftests.c
skbuff.c	net: prevent skb corruption on frag list segmentation	2023-07-08 10:03:26 +01:00
skmsg.c	bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready()	2023-06-01 14:44:53 +02:00
sock.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-06-27 09:45:22 -07:00
sock_destructor.h
sock_diag.c	net: fix __sock_gen_cookie()	2022-11-21 20:36:30 -08:00
sock_map.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
sock_reuseport.c	soreuseport: Fix socket selection for SO_INCOMING_CPU.	2022-10-25 11:35:16 +02:00
stream.c	net: deal with most data-races in sk_wait_event()	2023-05-10 10:03:32 +01:00
sysctl_net_core.c	net/sysctl: Rename kvfree_rcu() to kvfree_rcu_mightsleep()	2023-04-05 13:48:04 +00:00
timestamping.c
tso.c	net: tso: inline tso_count_descs()	2022-12-12 15:04:39 -08:00
utils.c	net: core: inet[46]_pton strlen len types	2022-11-01 21:14:39 -07:00
xdp.c	bpf-next-for-netdev	2023-04-13 16:43:38 -07:00