|
| 1 | +ipvlan: add ipvlan_route_v6_outbound() helper |
| 2 | + |
| 3 | +jira LE-1907 |
| 4 | +cve CVE-2023-52796 |
| 5 | +Rebuild_History Non-Buildable kernel-4.18.0-553.16.1.el8_10 |
| 6 | +commit-author Eric Dumazet < [email protected]> |
| 7 | +commit 18f039428c7df183b09c69ebf10ffd4e521035d2 |
| 8 | +Empty-Commit: Cherry-Pick Conflicts during history rebuild. |
| 9 | +Will be included in final tarball splat. Ref for failed cherry-pick at: |
| 10 | +ciq/ciq_backports/kernel-4.18.0-553.16.1.el8_10/18f03942.failed |
| 11 | + |
| 12 | +Inspired by syzbot reports using a stack of multiple ipvlan devices. |
| 13 | + |
| 14 | +Reduce stack size needed in ipvlan_process_v6_outbound() by moving |
| 15 | +the flowi6 struct used for the route lookup in an non inlined |
| 16 | +helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, |
| 17 | +immediately reclaimed. |
| 18 | + |
| 19 | +Also make sure ipvlan_process_v4_outbound() is not inlined. |
| 20 | + |
| 21 | +We might also have to lower MAX_NEST_DEV, because only syzbot uses |
| 22 | +setups with more than four stacked devices. |
| 23 | + |
| 24 | +BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) |
| 25 | +stack guard page: 0000 [#1] SMP KASAN |
| 26 | +CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 |
| 27 | +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 |
| 28 | +RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188 |
| 29 | +Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 |
| 30 | +RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 |
| 31 | +RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 |
| 32 | +RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 |
| 33 | +RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 |
| 34 | +R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c |
| 35 | +R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 |
| 36 | +FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 |
| 37 | +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| 38 | +CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 |
| 39 | +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 |
| 40 | +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 |
| 41 | +Call Trace: |
| 42 | +<#DF> |
| 43 | +</#DF> |
| 44 | +<TASK> |
| 45 | +[<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 |
| 46 | +[<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline] |
| 47 | +[<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] |
| 48 | +[<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline] |
| 49 | +[<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline] |
| 50 | +[<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline] |
| 51 | +[<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632 |
| 52 | +[<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306 |
| 53 | +[<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline] |
| 54 | +[<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221 |
| 55 | +[<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606 |
| 56 | +[<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline] |
| 57 | +[<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116 |
| 58 | +[<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638 |
| 59 | +[<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651 |
| 60 | +[<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline] |
| 61 | +[<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline] |
| 62 | +[<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] |
| 63 | +[<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] |
| 64 | +[<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 |
| 65 | +[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 |
| 66 | +[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] |
| 67 | +[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] |
| 68 | +[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 |
| 69 | +[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 |
| 70 | +[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] |
| 71 | +[<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] |
| 72 | +[<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline] |
| 73 | +[<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 |
| 74 | +[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] |
| 75 | +[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 |
| 76 | +[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] |
| 77 | +[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 |
| 78 | +[<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline] |
| 79 | +[<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 |
| 80 | +[<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] |
| 81 | +[<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] |
| 82 | +[<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] |
| 83 | +[<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 |
| 84 | +[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 |
| 85 | +[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] |
| 86 | +[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] |
| 87 | +[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 |
| 88 | +[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 |
| 89 | +[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] |
| 90 | +[<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] |
| 91 | +[<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline] |
| 92 | +[<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 |
| 93 | +[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] |
| 94 | +[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 |
| 95 | +[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] |
| 96 | +[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 |
| 97 | +[<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline] |
| 98 | +[<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 |
| 99 | +[<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] |
| 100 | +[<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] |
| 101 | +[<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] |
| 102 | +[<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 |
| 103 | +[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 |
| 104 | +[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] |
| 105 | +[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] |
| 106 | +[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 |
| 107 | +[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 |
| 108 | +[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] |
| 109 | +[<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] |
| 110 | +[<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline] |
| 111 | +[<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 |
| 112 | +[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] |
| 113 | +[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 |
| 114 | +[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] |
| 115 | +[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 |
| 116 | +[<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline] |
| 117 | +[<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 |
| 118 | +[<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] |
| 119 | +[<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] |
| 120 | +[<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] |
| 121 | +[<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 |
| 122 | +[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 |
| 123 | +[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] |
| 124 | +[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] |
| 125 | +[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 |
| 126 | +[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 |
| 127 | +[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] |
| 128 | +[<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] |
| 129 | +[<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline] |
| 130 | +[<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 |
| 131 | +[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] |
| 132 | +[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 |
| 133 | +[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] |
| 134 | +[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 |
| 135 | +[<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline] |
| 136 | +[<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 |
| 137 | +[<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] |
| 138 | +[<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] |
| 139 | +[<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] |
| 140 | +[<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 |
| 141 | +[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 |
| 142 | +[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] |
| 143 | +[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] |
| 144 | +[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 |
| 145 | +[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 |
| 146 | +[<ffffffff84d4a65e>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] |
| 147 | +[<ffffffff84d4a65e>] neigh_resolve_output+0x64e/0x750 net/core/neighbour.c:1560 |
| 148 | +[<ffffffff855ce503>] neigh_output include/net/neighbour.h:545 [inline] |
| 149 | +[<ffffffff855ce503>] ip6_finish_output2+0x1643/0x1ae0 net/ipv6/ip6_output.c:139 |
| 150 | +[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] |
| 151 | +[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 |
| 152 | +[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] |
| 153 | +[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 |
| 154 | +[<ffffffff855b9ce4>] dst_output include/net/dst.h:444 [inline] |
| 155 | +[<ffffffff855b9ce4>] NF_HOOK include/linux/netfilter.h:309 [inline] |
| 156 | +[<ffffffff855b9ce4>] ip6_xmit+0x11a4/0x1b20 net/ipv6/ip6_output.c:352 |
| 157 | +[<ffffffff8597984e>] sctp_v6_xmit+0x9ae/0x1230 net/sctp/ipv6.c:250 |
| 158 | +[<ffffffff8594623e>] sctp_packet_transmit+0x25de/0x2bc0 net/sctp/output.c:653 |
| 159 | +[<ffffffff858f5142>] sctp_packet_singleton+0x202/0x310 net/sctp/outqueue.c:783 |
| 160 | +[<ffffffff858ea411>] sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline] |
| 161 | +[<ffffffff858ea411>] sctp_outq_flush+0x661/0x3d40 net/sctp/outqueue.c:1212 |
| 162 | +[<ffffffff858f02f9>] sctp_outq_uncork+0x79/0xb0 net/sctp/outqueue.c:764 |
| 163 | +[<ffffffff8589f060>] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] |
| 164 | +[<ffffffff8589f060>] sctp_do_sm+0x55c0/0x5c30 net/sctp/sm_sideeffect.c:1170 |
| 165 | +[<ffffffff85941567>] sctp_primitive_ASSOCIATE+0x97/0xc0 net/sctp/primitive.c:73 |
| 166 | +[<ffffffff859408b2>] sctp_sendmsg_to_asoc+0xf62/0x17b0 net/sctp/socket.c:1839 |
| 167 | +[<ffffffff85910b5e>] sctp_sendmsg+0x212e/0x33b0 net/sctp/socket.c:2029 |
| 168 | +[<ffffffff8544d559>] inet_sendmsg+0x149/0x310 net/ipv4/af_inet.c:849 |
| 169 | +[<ffffffff84c6c4d2>] sock_sendmsg_nosec net/socket.c:716 [inline] |
| 170 | +[<ffffffff84c6c4d2>] sock_sendmsg net/socket.c:736 [inline] |
| 171 | +[<ffffffff84c6c4d2>] ____sys_sendmsg+0x572/0x8c0 net/socket.c:2504 |
| 172 | +[<ffffffff84c6ca91>] ___sys_sendmsg net/socket.c:2558 [inline] |
| 173 | +[<ffffffff84c6ca91>] __sys_sendmsg+0x271/0x360 net/socket.c:2587 |
| 174 | +[<ffffffff84c6cbff>] __do_sys_sendmsg net/socket.c:2596 [inline] |
| 175 | +[<ffffffff84c6cbff>] __se_sys_sendmsg net/socket.c:2594 [inline] |
| 176 | +[<ffffffff84c6cbff>] __x64_sys_sendmsg+0x7f/0x90 net/socket.c:2594 |
| 177 | +[<ffffffff85b32553>] do_syscall_x64 arch/x86/entry/common.c:51 [inline] |
| 178 | +[<ffffffff85b32553>] do_syscall_64+0x53/0x80 arch/x86/entry/common.c:84 |
| 179 | +[<ffffffff85c00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd |
| 180 | + |
| 181 | +Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") |
| 182 | + Reported-by: syzbot < [email protected]> |
| 183 | + Signed-off-by: Eric Dumazet < [email protected]> |
| 184 | + Cc: Mahesh Bandewar < [email protected]> |
| 185 | + Cc: Willem de Bruijn < [email protected]> |
| 186 | + Reviewed-by: Willem de Bruijn < [email protected]> |
| 187 | + Signed-off-by: David S. Miller < [email protected]> |
| 188 | +(cherry picked from commit 18f039428c7df183b09c69ebf10ffd4e521035d2) |
| 189 | + Signed-off-by: Jonathan Maple < [email protected]> |
| 190 | + |
| 191 | +# Conflicts: |
| 192 | +# drivers/net/ipvlan/ipvlan_core.c |
| 193 | +diff --cc drivers/net/ipvlan/ipvlan_core.c |
| 194 | +index 4acee967f244,2d5b021b4ea6..000000000000 |
| 195 | +--- a/drivers/net/ipvlan/ipvlan_core.c |
| 196 | ++++ b/drivers/net/ipvlan/ipvlan_core.c |
| 197 | +@@@ -487,16 -494,11 +501,19 @@@ static int ipvlan_process_v6_outbound(s |
| 198 | + |
| 199 | + memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); |
| 200 | + |
| 201 | +- err = ip6_local_out(net, skb->sk, skb); |
| 202 | ++ err = ip6_local_out(dev_net(dev), skb->sk, skb); |
| 203 | + if (unlikely(net_xmit_eval(err))) |
| 204 | + - DEV_STATS_INC(dev, tx_errors); |
| 205 | + + dev->stats.tx_errors++; |
| 206 | + else |
| 207 | + ret = NET_XMIT_SUCCESS; |
| 208 | +++<<<<<<< HEAD |
| 209 | + + goto out; |
| 210 | + +err: |
| 211 | + + dev->stats.tx_errors++; |
| 212 | + + kfree_skb(skb); |
| 213 | + +out: |
| 214 | +++======= |
| 215 | +++>>>>>>> 18f039428c7d (ipvlan: add ipvlan_route_v6_outbound() helper) |
| 216 | + return ret; |
| 217 | + } |
| 218 | + #else |
| 219 | +* Unmerged path drivers/net/ipvlan/ipvlan_core.c |
0 commit comments