On Thu, Oct 8, 2020 at 12:18 PM Willem de Bruijn <willemdebruijn.ker...@gmail.com> wrote: > > On Thu, Oct 8, 2020 at 3:04 PM Willem de Bruijn > <willemdebruijn.ker...@gmail.com> wrote: > > > > On Thu, Oct 8, 2020 at 1:34 PM Cong Wang <xiyou.wangc...@gmail.com> wrote: > > > > > > On Thu, Oct 8, 2020 at 4:49 AM Willem de Bruijn > > > <willemdebruijn.ker...@gmail.com> wrote: > > > > > > > > On Wed, Oct 7, 2020 at 9:22 PM Cong Wang <xiyou.wangc...@gmail.com> > > > > wrote: > > > > > > > > > > GRE tunnel has its own header_ops, ipgre_header_ops, and sets it > > > > > conditionally. When it is set, it assumes the outer IP header is > > > > > already created before ipgre_xmit(). > > > > > > > > > > This is not true when we send packets through a raw packet socket, > > > > > where L2 headers are supposed to be constructed by user. Packet > > > > > socket calls dev_validate_header() to validate the header. But > > > > > GRE tunnel does not set dev->hard_header_len, so that check can > > > > > be simply bypassed, therefore uninit memory could be passed down > > > > > to ipgre_xmit(). > > > > > > > > If dev->hard_header_len is zero, the packet socket will not reserve > > > > room for the link layer header, so skb->data points to network_header. > > > > But I don't see any uninitialized packet data? > > > > > > The uninit data is allocated by packet_alloc_skb(), if > > > dev->hard_header_len > > > is 0 and 'len' is anything between [0, tunnel->hlen + sizeof(struct > > > iphdr)), > > > dev_validate_header() still returns true obviously but only 'len' > > > bytes are copied > > > from user-space by skb_copy_datagram_from_iter(). Therefore, those bytes > > > within range (len, tunnel->hlen + sizeof(struct iphdr)] are uninitialized. > > Oh, do you mean that ipgre_xmit will process undefined data because it > calls skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)) ?
The syzbot report has the information for both of your questions: https://syzkaller.appspot.com/text?tag=CrashReport&x=11845568500000 It clearly shows packet_snd() and ipgre_xmit(). Thanks.
