• Eric Dumazet's avatar
    ip_tunnel: better validate user provided tunnel names · 6cc0290b
    Eric Dumazet authored
    
    [ Upstream commit 9cb726a2 ]
    
    Use dev_valid_name() to make sure user does not provide illegal
    device name.
    
    syzbot caught the following bug :
    
    BUG: KASAN: stack-out-of-bounds in strlcpy include/linux/string.h:300 [inline]
    BUG: KASAN: stack-out-of-bounds in __ip_tunnel_create+0xca/0x6b0 net/ipv4/ip_tunnel.c:257
    Write of size 20 at addr ffff8801ac79f810 by task syzkaller268107/4482
    
    CPU: 0 PID: 4482 Comm: syzkaller268107 Not tainted 4.16.0+ #1
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:17 [inline]
     dump_stack+0x1b9/0x29f lib/dump_stack.c:53
     print_address_description+0x6c/0x20b mm/kasan/report.c:256
     kasan_report_error mm/kasan/report.c:354 [inline]
     kasan_report.cold.7+0xac/0x2f5 mm/kasan/report.c:412
     check_memory_region_inline mm/kasan/kasan.c:260 [inline]
     check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
     memcpy+0x37/0x50 mm/kasan/kasan.c:303
     strlcpy include/linux/string.h:300 [inline]
     __ip_tunnel_create+0xca/0x6b0 net/ipv4/ip_tunnel.c:257
     ip_tunnel_create net/ipv4/ip_tunnel.c:352 [inline]
     ip_tunnel_ioctl+0x818/0xd40 net/ipv4/ip_tunnel.c:861
     ipip_tunnel_ioctl+0x1c5/0x420 net/ipv4/ipip.c:350
     dev_ifsioc+0x43e/0xb90 net/core/dev_ioctl.c:334
     dev_ioctl+0x69a/0xcc0 net/core/dev_ioctl.c:525
     sock_ioctl+0x47e/0x680 net/socket.c:1015
     vfs_ioctl fs/ioctl.c:46 [inline]
     file_ioctl fs/ioctl.c:500 [inline]
     do_vfs_ioctl+0x1cf/0x1650 fs/ioctl.c:684
     ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
     SYSC_ioctl fs/ioctl.c:708 [inline]
     SyS_ioctl+0x24/0x30 fs/ioctl.c:706
     do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
     entry_SYSCALL_64_after_hwframe+0x42/0xb7
    
    Fixes: c5441932 ("GRE: Refactor GRE tunneling code.")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    6cc0290b
ip_tunnel.c 28 KB