On Sun, 29 Apr 2018 09:54:59 -0700
Eric Dumazet <eduma...@google.com> wrote:
> syzbot/KMSAN reported an uninit-value in ip6_multipath_l3_keys(),
> root caused to a bad assumption of ICMP header being already
> pulled in skb->head
>
> ip_multipath_l3_keys() does the correct thing, so it is an IPv6 only bug.
>
> BUG: KMSAN: uninit-value in ip6_multipath_l3_keys net/ipv6/route.c:1830
> [inline]
> BUG: KMSAN: uninit-value in rt6_multipath_hash+0x5c4/0x640
> net/ipv6/route.c:1858
> CPU: 0 PID: 4507 Comm: syz-executor661 Not tainted 4.16.0+ #87
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:17 [inline]
> dump_stack+0x185/0x1d0 lib/dump_stack.c:53
> kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
> __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
> ip6_multipath_l3_keys net/ipv6/route.c:1830 [inline]
> rt6_multipath_hash+0x5c4/0x640 net/ipv6/route.c:1858
> ip6_route_input+0x65a/0x920 net/ipv6/route.c:1884
> ip6_rcv_finish+0x413/0x6e0 net/ipv6/ip6_input.c:69
> NF_HOOK include/linux/netfilter.h:288 [inline]
> ipv6_rcv+0x1e16/0x2340 net/ipv6/ip6_input.c:208
> __netif_receive_skb_core+0x47df/0x4a90 net/core/dev.c:4562
> __netif_receive_skb net/core/dev.c:4627 [inline]
> netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701
> netif_receive_skb+0x230/0x240 net/core/dev.c:4725
> tun_rx_batched drivers/net/tun.c:1555 [inline]
> tun_get_user+0x740f/0x7c60 drivers/net/tun.c:1962
> tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990
> call_write_iter include/linux/fs.h:1782 [inline]
> new_sync_write fs/read_write.c:469 [inline]
> __vfs_write+0x7fb/0x9f0 fs/read_write.c:482
> vfs_write+0x463/0x8d0 fs/read_write.c:544
> SYSC_write+0x172/0x360 fs/read_write.c:589
> SyS_write+0x55/0x80 fs/read_write.c:581
> do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
> entry_SYSCALL_64_after_hwframe+0x3d/0xa2
>
> Fixes: 23aebdacb05d ("ipv6: Compute multipath hash for ICMP errors from
> offending packet")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Reported-by: syzbot <syzkal...@googlegroups.com>
> Cc: Jakub Sitnicki <j...@redhat.com>
> ---
> net/ipv6/route.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index
> cde7d8251377c1a115e02c46843d361d3c0b4313..f4d61736c41abe8cd7f439c4a37100e90c1eacca
> 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -1835,11 +1835,16 @@ static void ip6_multipath_l3_keys(const struct
> sk_buff *skb,
> const struct ipv6hdr *inner_iph;
> const struct icmp6hdr *icmph;
> struct ipv6hdr _inner_iph;
> + struct icmp6hdr _icmph;
>
> if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6))
> goto out;
>
> - icmph = icmp6_hdr(skb);
> + icmph = skb_header_pointer(skb, skb_transport_offset(skb),
> + sizeof(_icmph), &_icmph);
> + if (!icmph)
> + goto out;
> +
> if (icmph->icmp6_type != ICMPV6_DEST_UNREACH &&
> icmph->icmp6_type != ICMPV6_PKT_TOOBIG &&
> icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
Thank you for the fix. I was not being careful there.
Acked-by: Jakub Sitnicki <j...@redhat.com>
