mirror of
https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable.git
synced 2025-09-14 11:19:08 +10:00
commit7af76e9d18
upstream. Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 <snip registers, remove unreliable trace> [ 45.402911] Call Trace: [ 45.403105] <IRQ> [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483] __br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116] __napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] </IRQ> This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: ┌────────────────┐ ┌────────────────┐ │ veth0_to_hsr ├───┤ hsr_slave0 ┼───┐ └────────────────┘ └────────────────┘ │ │ ┌──────┐ ├─┤ hsr0 ├───┐ │ └──────┘ │ ┌────────────────┐ ┌────────────────┐ │ │┌────────┐ │ veth1_to_hsr ┼───┤ hsr_slave1 ├───┘ └┤ │ └────────────────┘ └────────────────┘ ┌┼ bridge │ ││ │ │└────────┘ │ ┌───────┐ │ │ ... ├──────┘ └───────┘ To trigger the events leading up to crash, reproducer sends a corrupted HSR frame with incomplete TAG, via AF_PACKET socket on 'veth0_to_hsr'. The first HSR-layer function to process this frame is hsr_handle_frame(). It and then checks if the protocol is ETH_P_PRP or ETH_P_HSR. If it is, it calls skb_set_network_header(skb, ETH_HLEN + HSR_HLEN), without checking that the skb is long enough. For the crashing frame it is not, and hence the skb->network_header and skb->mac_len fields are set incorrectly, pointing after the end of the linear buffer. I will call this a BUG#1 and it is what is addressed by this patch. In the crashing scenario before the fix, the skb continues to go down the hsr path as follows. hsr_handle_frame() then calls this sequence hsr_forward_skb() fill_frame_info() hsr->proto_ops->fill_frame_info() hsr_fill_frame_info() hsr_fill_frame_info() contains a check that intends to check whether the skb actually contains the HSR header. But the check relies on the skb->mac_len field which was erroneously setup due to BUG#1, so the check passes and the execution continues back in the hsr_forward_skb(): hsr_forward_skb() hsr_forward_do() hsr->proto_ops->get_untagged_frame() hsr_get_untagged_frame() create_stripped_skb_hsr() In create_stripped_skb_hsr(), a copy of the skb is created and is further corrupted by operation that attempts to strip the HSR tag in a call to __pskb_copy(). The skb enters create_stripped_skb_hsr() with ethernet header pushed in linear buffer. The skb_pull(skb_in, HSR_HLEN) thus pulls 6 bytes of ethernet header into the headroom, creating skb_in with a headroom of size 8. The subsequent __pskb_copy() then creates an skb with headroom of just 2 and skb->len of just 12, this is how it looks after the copy: gdb) p skb->len $10 = 12 (gdb) p skb->data $11 = (unsigned char *) 0xffff888041e45382 "\252\252\252\252\252!\210\373", (gdb) p skb->head $12 = (unsigned char *) 0xffff888041e45380 "" It seems create_stripped_skb_hsr() assumes that ETH header is pulled in the headroom when it's entered, because it just pulls HSR header on top. But that is not the case in our code-path and we end up with the corrupted skb instead. I will call this BUG#2 *I got confused here because it seems that under no conditions can create_stripped_skb_hsr() work well, the assumption it makes is not true during the processing of hsr frames - since the skb_push() in hsr_handle_frame to skb_pull in hsr_deliver_master(). I wonder whether I missed something here.* Next, the execution arrives in hsr_deliver_master(). It calls skb_pull(ETH_HLEN), which just returns NULL - the SKB does not have enough space for the pull (as it only has 12 bytes in total at this point). *The skb_pull() here further suggests that ethernet header is meant to be pushed through the whole hsr processing and create_stripped_skb_hsr() should pull it before doing the HSR header pull.* hsr_deliver_master() then puts the corrupted skb on the queue, it is then picked up from there by bridge frame handling layer and finally lands in br_dev_queue_push_xmit where it panics. Cc: stable@kernel.org Fixes:48b491a5cc
("net: hsr: fix mac_len checks") Reported-by: syzbot+a81f2759d022496b40ab@syzkaller.appspotmail.com Signed-off-by: Jakub Acs <acsjakub@amazon.de> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20250819082842.94378-1-acsjakub@amazon.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
248 lines
5.8 KiB
C
248 lines
5.8 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* Copyright 2011-2014 Autronica Fire and Security AS
|
|
*
|
|
* Author(s):
|
|
* 2011-2014 Arvid Brodin, arvid.brodin@alten.se
|
|
*
|
|
* Frame handler other utility functions for HSR and PRP.
|
|
*/
|
|
|
|
#include "hsr_slave.h"
|
|
#include <linux/etherdevice.h>
|
|
#include <linux/if_arp.h>
|
|
#include <linux/if_vlan.h>
|
|
#include "hsr_main.h"
|
|
#include "hsr_device.h"
|
|
#include "hsr_forward.h"
|
|
#include "hsr_framereg.h"
|
|
|
|
bool hsr_invalid_dan_ingress_frame(__be16 protocol)
|
|
{
|
|
return (protocol != htons(ETH_P_PRP) && protocol != htons(ETH_P_HSR));
|
|
}
|
|
|
|
static rx_handler_result_t hsr_handle_frame(struct sk_buff **pskb)
|
|
{
|
|
struct sk_buff *skb = *pskb;
|
|
struct hsr_port *port;
|
|
struct hsr_priv *hsr;
|
|
__be16 protocol;
|
|
|
|
/* Packets from dev_loopback_xmit() do not have L2 header, bail out */
|
|
if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
|
|
return RX_HANDLER_PASS;
|
|
|
|
if (!skb_mac_header_was_set(skb)) {
|
|
WARN_ONCE(1, "%s: skb invalid", __func__);
|
|
return RX_HANDLER_PASS;
|
|
}
|
|
|
|
port = hsr_port_get_rcu(skb->dev);
|
|
if (!port)
|
|
goto finish_pass;
|
|
hsr = port->hsr;
|
|
|
|
if (hsr_addr_is_self(port->hsr, eth_hdr(skb)->h_source)) {
|
|
/* Directly kill frames sent by ourselves */
|
|
kfree_skb(skb);
|
|
goto finish_consume;
|
|
}
|
|
|
|
/* For HSR, only tagged frames are expected (unless the device offloads
|
|
* HSR tag removal), but for PRP there could be non tagged frames as
|
|
* well from Single attached nodes (SANs).
|
|
*/
|
|
protocol = eth_hdr(skb)->h_proto;
|
|
|
|
if (!(port->dev->features & NETIF_F_HW_HSR_TAG_RM) &&
|
|
port->type != HSR_PT_INTERLINK &&
|
|
hsr->proto_ops->invalid_dan_ingress_frame &&
|
|
hsr->proto_ops->invalid_dan_ingress_frame(protocol))
|
|
goto finish_pass;
|
|
|
|
skb_push(skb, ETH_HLEN);
|
|
skb_reset_mac_header(skb);
|
|
if ((!hsr->prot_version && protocol == htons(ETH_P_PRP)) ||
|
|
protocol == htons(ETH_P_HSR)) {
|
|
if (!pskb_may_pull(skb, ETH_HLEN + HSR_HLEN)) {
|
|
kfree_skb(skb);
|
|
goto finish_consume;
|
|
}
|
|
|
|
skb_set_network_header(skb, ETH_HLEN + HSR_HLEN);
|
|
}
|
|
skb_reset_mac_len(skb);
|
|
|
|
/* Only the frames received over the interlink port will assign a
|
|
* sequence number and require synchronisation vs other sender.
|
|
*/
|
|
if (port->type == HSR_PT_INTERLINK) {
|
|
spin_lock_bh(&hsr->seqnr_lock);
|
|
hsr_forward_skb(skb, port);
|
|
spin_unlock_bh(&hsr->seqnr_lock);
|
|
} else {
|
|
hsr_forward_skb(skb, port);
|
|
}
|
|
|
|
finish_consume:
|
|
return RX_HANDLER_CONSUMED;
|
|
|
|
finish_pass:
|
|
return RX_HANDLER_PASS;
|
|
}
|
|
|
|
bool hsr_port_exists(const struct net_device *dev)
|
|
{
|
|
return rcu_access_pointer(dev->rx_handler) == hsr_handle_frame;
|
|
}
|
|
|
|
static int hsr_check_dev_ok(struct net_device *dev,
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
/* Don't allow HSR on non-ethernet like devices */
|
|
if ((dev->flags & IFF_LOOPBACK) || dev->type != ARPHRD_ETHER ||
|
|
dev->addr_len != ETH_ALEN) {
|
|
NL_SET_ERR_MSG_MOD(extack, "Cannot use loopback or non-ethernet device as HSR slave.");
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* Don't allow enslaving hsr devices */
|
|
if (is_hsr_master(dev)) {
|
|
NL_SET_ERR_MSG_MOD(extack,
|
|
"Cannot create trees of HSR devices.");
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (hsr_port_exists(dev)) {
|
|
NL_SET_ERR_MSG_MOD(extack,
|
|
"This device is already a HSR slave.");
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (is_vlan_dev(dev)) {
|
|
NL_SET_ERR_MSG_MOD(extack, "HSR on top of VLAN is not yet supported in this driver.");
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (dev->priv_flags & IFF_DONT_BRIDGE) {
|
|
NL_SET_ERR_MSG_MOD(extack,
|
|
"This device does not support bridging.");
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
/* HSR over bonded devices has not been tested, but I'm not sure it
|
|
* won't work...
|
|
*/
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Setup device to be added to the HSR bridge. */
|
|
static int hsr_portdev_setup(struct hsr_priv *hsr, struct net_device *dev,
|
|
struct hsr_port *port,
|
|
struct netlink_ext_ack *extack)
|
|
|
|
{
|
|
struct net_device *hsr_dev;
|
|
struct hsr_port *master;
|
|
int res;
|
|
|
|
/* Don't use promiscuous mode for offload since L2 frame forward
|
|
* happens at the offloaded hardware.
|
|
*/
|
|
if (!port->hsr->fwd_offloaded) {
|
|
res = dev_set_promiscuity(dev, 1);
|
|
if (res)
|
|
return res;
|
|
}
|
|
|
|
master = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
|
|
hsr_dev = master->dev;
|
|
|
|
res = netdev_upper_dev_link(dev, hsr_dev, extack);
|
|
if (res)
|
|
goto fail_upper_dev_link;
|
|
|
|
res = netdev_rx_handler_register(dev, hsr_handle_frame, port);
|
|
if (res)
|
|
goto fail_rx_handler;
|
|
dev_disable_lro(dev);
|
|
|
|
return 0;
|
|
|
|
fail_rx_handler:
|
|
netdev_upper_dev_unlink(dev, hsr_dev);
|
|
fail_upper_dev_link:
|
|
if (!port->hsr->fwd_offloaded)
|
|
dev_set_promiscuity(dev, -1);
|
|
|
|
return res;
|
|
}
|
|
|
|
int hsr_add_port(struct hsr_priv *hsr, struct net_device *dev,
|
|
enum hsr_port_type type, struct netlink_ext_ack *extack)
|
|
{
|
|
struct hsr_port *port, *master;
|
|
int res;
|
|
|
|
if (type != HSR_PT_MASTER) {
|
|
res = hsr_check_dev_ok(dev, extack);
|
|
if (res)
|
|
return res;
|
|
}
|
|
|
|
port = hsr_port_get_hsr(hsr, type);
|
|
if (port)
|
|
return -EBUSY; /* This port already exists */
|
|
|
|
port = kzalloc(sizeof(*port), GFP_KERNEL);
|
|
if (!port)
|
|
return -ENOMEM;
|
|
|
|
port->hsr = hsr;
|
|
port->dev = dev;
|
|
port->type = type;
|
|
|
|
if (type != HSR_PT_MASTER) {
|
|
res = hsr_portdev_setup(hsr, dev, port, extack);
|
|
if (res)
|
|
goto fail_dev_setup;
|
|
}
|
|
|
|
list_add_tail_rcu(&port->port_list, &hsr->ports);
|
|
synchronize_rcu();
|
|
|
|
master = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
|
|
netdev_update_features(master->dev);
|
|
dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
|
|
|
|
return 0;
|
|
|
|
fail_dev_setup:
|
|
kfree(port);
|
|
return res;
|
|
}
|
|
|
|
void hsr_del_port(struct hsr_port *port)
|
|
{
|
|
struct hsr_priv *hsr;
|
|
struct hsr_port *master;
|
|
|
|
hsr = port->hsr;
|
|
master = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
|
|
list_del_rcu(&port->port_list);
|
|
|
|
if (port != master) {
|
|
netdev_update_features(master->dev);
|
|
dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
|
|
netdev_rx_handler_unregister(port->dev);
|
|
if (!port->hsr->fwd_offloaded)
|
|
dev_set_promiscuity(port->dev, -1);
|
|
netdev_upper_dev_unlink(port->dev, master->dev);
|
|
}
|
|
|
|
synchronize_rcu();
|
|
|
|
kfree(port);
|
|
}
|