• Eric Dumazet's avatar
    vxlan: do not feed vxlan_vnifilter_dump_dev with non vxlan devices · 9d570741
    Eric Dumazet authored
    vxlan_vnifilter_dump_dev() assumes it is called only
    for vxlan devices. Make sure it is the case.
    
    BUG: KASAN: slab-out-of-bounds in vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349
    Read of size 4 at addr ffff888060d1ce70 by task syz-executor.3/17662
    
    CPU: 0 PID: 17662 Comm: syz-executor.3 Tainted: G        W         5.17.0-syzkaller-12888-g77c9387c #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]
     dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
     print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
     print_report mm/kasan/report.c:429 [inline]
     kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
     vxlan_vnifilter_dump_dev+0x9a0/0xb40 drivers/net/vxlan/vxlan_vnifilter.c:349
     vxlan_vnifilter_dump+0x3ff/0x650 drivers/net/vxlan/vxlan_vnifilter.c:428
     netlink_dump+0x4b5/0xb70 net/netlink/af_netlink.c:2270
     __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2375
     netlink_dump_start include/linux/netlink.h:245 [inline]
     rtnetlink_rcv_msg+0x70c/0xb80 net/core/rtnetlink.c:5953
     netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496
     netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
     netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
     netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1921
     sock_sendmsg_nosec net/socket.c:705 [inline]
     sock_sendmsg+0xcf/0x120 net/socket.c:725
     ____sys_sendmsg+0x6e2/0x800 net/socket.c:2413
     ___sys_sendmsg+0xf3/0x170 net/socket.c:2467
     __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    RIP: 0033:0x7f87b8e89049
    
    Fixes: f9c4bb0b ("vxlan: vni filtering support on collect metadata device")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Acked-by: default avatarRoopa Prabhu <roopa@nvidia.com>
    Link: https://lore.kernel.org/r/20220330194643.2706132-1-eric.dumazet@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    9d570741
vxlan_vnifilter.c 24.1 KB