• Eric Dumazet's avatar
    bonding/alb: properly access headers in bond_alb_xmit() · 38f88c45
    Eric Dumazet authored
    syzbot managed to send an IPX packet through bond_alb_xmit()
    and af_packet and triggered a use-after-free.
    
    First, bond_alb_xmit() was using ipx_hdr() helper to reach
    the IPX header, but ipx_hdr() was using the transport offset
    instead of the network offset. In the particular syzbot
    report transport offset was 0xFFFF
    
    This patch removes ipx_hdr() since it was only (mis)used from bonding.
    
    Then we need to make sure IPv4/IPv6/IPX headers are pulled
    in skb->head before dereferencing anything.
    
    BUG: KASAN: use-after-free in bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
    Read of size 2 at addr ffff8801ce56dfff by task syz-executor.2/18108
     (if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) ...)
    
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     [<ffffffff8441fc42>] __dump_stack lib/dump_stack.c:17 [inline]
     [<ffffffff8441fc42>] dump_stack+0x14d/0x20b lib/dump_stack.c:53
     [<ffffffff81a7dec4>] print_address_description+0x6f/0x20b mm/kasan/report.c:282
     [<ffffffff81a7e0ec>] kasan_report_error mm/kasan/report.c:380 [inline]
     [<ffffffff81a7e0ec>] kasan_report mm/kasan/report.c:438 [inline]
     [<ffffffff81a7e0ec>] kasan_report.cold+0x8c/0x2a0 mm/kasan/report.c:422
     [<ffffffff81a7dc4f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:469
     [<ffffffff82c8c00a>] bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
     [<ffffffff82c60c74>] __bond_start_xmit drivers/net/bonding/bond_main.c:4199 [inline]
     [<ffffffff82c60c74>] bond_start_xmit+0x4f4/0x1570 drivers/net/bonding/bond_main.c:4224
     [<ffffffff83baa558>] __netdev_start_xmit include/linux/netdevice.h:4525 [inline]
     [<ffffffff83baa558>] netdev_start_xmit include/linux/netdevice.h:4539 [inline]
     [<ffffffff83baa558>] xmit_one net/core/dev.c:3611 [inline]
     [<ffffffff83baa558>] dev_hard_start_xmit+0x168/0x910 net/core/dev.c:3627
     [<ffffffff83bacf35>] __dev_queue_xmit+0x1f55/0x33b0 net/core/dev.c:4238
     [<ffffffff83bae3a8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:4278
     [<ffffffff84339189>] packet_snd net/packet/af_packet.c:3226 [inline]
     [<ffffffff84339189>] packet_sendmsg+0x4919/0x70b0 net/packet/af_packet.c:3252
     [<ffffffff83b1ac0c>] sock_sendmsg_nosec net/socket.c:673 [inline]
     [<ffffffff83b1ac0c>] sock_sendmsg+0x12c/0x160 net/socket.c:684
     [<ffffffff83b1f5a2>] __sys_sendto+0x262/0x380 net/socket.c:1996
     [<ffffffff83b1f700>] SYSC_sendto net/socket.c:2008 [inline]
     [<ffffffff83b1f700>] SyS_sendto+0x40/0x60 net/socket.c:2004
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Cc: Jay Vosburgh <j.vosburgh@gmail.com>
    Cc: Veaceslav Falico <vfalico@gmail.com>
    Cc: Andy Gospodarek <andy@greyhouse.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    38f88c45
ipx.h 4.28 KB