- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2730/7378] drivers/platform/mpam/mpam_resctrl.c:25:1: sparse: sparse: symbol 'resctrl_mon_ctx_waiters' was not declared. Should it be static?
by kernel test robot 13 Apr '24

13 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2ce949a800b76538410170a027def9b8f24f791a commit: 9119da1439390ea4f29a0635652248aa3c2040f0 [2730/7378] arm_mpam: resctrl: Allow resctrl to allocate monitors config: arm64-randconfig-r131-20240412 (https://download.01.org/0day-ci/archive/20240413/202404130113.aJEKDEIq-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240413/202404130113.aJEKDEIq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404130113.aJEKDEIq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/platform/mpam/mpam_resctrl.c:25:1: sparse: sparse: symbol 'resctrl_mon_ctx_waiters' was not declared. Should it be static? >> drivers/platform/mpam/mpam_resctrl.c:45:5: sparse: sparse: symbol '__mon_is_rmid_idx' was not declared. Should it be static? >> drivers/platform/mpam/mpam_resctrl.c:46:6: sparse: sparse: symbol 'mon_is_rmid_idx' was not declared. Should it be static? drivers/platform/mpam/mpam_resctrl.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/slab.h, ...): include/linux/page-flags.h:245:46: sparse: sparse: self-comparison always evaluates to false vim +/resctrl_mon_ctx_waiters +25 drivers/platform/mpam/mpam_resctrl.c 24 > 25 DECLARE_WAIT_QUEUE_HEAD(resctrl_mon_ctx_waiters); 26 27 /* 28 * The classes we've picked to map to resctrl resources. 29 * Class pointer may be NULL. 30 */ 31 static struct mpam_resctrl_res mpam_resctrl_exports[RDT_NUM_RESOURCES]; 32 33 static bool exposed_alloc_capable; 34 static bool exposed_mon_capable; 35 static struct mpam_class *mbm_local_class; 36 static struct mpam_class *mbm_total_class; 37 38 /* 39 * MPAM emulates CDP by setting different PARTID in the I/D fields of MPAM1_EL1. 40 * This applies globally to all traffic the CPU generates. 41 */ 42 static bool cdp_enabled; 43 44 /* A dummy mon context to use when the monitors were allocated up front */ > 45 u32 __mon_is_rmid_idx = USE_RMID_IDX; > 46 void *mon_is_rmid_idx = &__mon_is_rmid_idx; 47 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v3 00/16] arm64 bpf trampoline for olk-5.10
by Pu Lehui 12 Apr '24

12 Apr '24

Alexander Duyck (1): bpf, arm64: Fix BTI type used for freplace attached functions Nathan Chancellor (1): bpf, arm64: Mark dummy_tramp as global Peter Zijlstra (1): x86/ibt,ftrace: Search for __fentry__ location Xu Kuohai (13): arm64, insn: Add ldr/str with immediate offset bpf, arm64: Optimize BPF store/load using arm64 str/ldr(immediate offset) bpf, arm64: Adjust the offset of str/ldr(immediate) to positive number arm64: Add LDR (literal) instruction bpf, arm64: Implement bpf_arch_text_poke() for arm64 bpf, arm64: Add bpf trampoline for arm64 bpf, arm64: Fix compile error in dummy_tramp() bpf, arm64: Fix bpf trampoline instruction endianness bpf, arm64: Fixed a BTI error on returning to patched function ftrace: Allow users to disable ftrace direct call arm64: ftrace: Support long jump for ftrace direct call arm64: ftrace: Add ftrace direct call support arm64: ftrace: Support direct call for no literal module functions arch/arm64/Kconfig | 2 + arch/arm64/Makefile | 4 + arch/arm64/include/asm/ftrace.h | 31 +- arch/arm64/include/asm/insn.h | 14 + arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kernel/entry-ftrace.S | 39 +- arch/arm64/kernel/ftrace.c | 248 ++++++++- arch/arm64/kernel/insn.c | 111 +++- arch/arm64/net/bpf_jit.h | 25 + arch/arm64/net/bpf_jit_comp.c | 875 +++++++++++++++++++++++++++++-- arch/x86/kernel/kprobes/core.c | 11 +- include/linux/ftrace.h | 3 + kernel/bpf/trampoline.c | 20 +- kernel/kprobes.c | 8 +- kernel/trace/Kconfig | 7 +- kernel/trace/ftrace.c | 65 ++- 16 files changed, 1348 insertions(+), 116 deletions(-) -- 2.34.1

2 17

[PATCH openEuler-1.0-LTS 0/5] CVE-2024-26812
by Jinjie Ruan 12 Apr '24

12 Apr '24

This patch set fix CVE-2024-26812. Alex Williamson (4): vfio: Introduce interface to flush virqfd inject workqueue vfio/pci: Disable auto-enable of exclusive INTx IRQ vfio/pci: Lock external INTx masking ops vfio/pci: Create persistent INTx handler Barry Song (1): genirq: Add IRQF_NO_AUTOEN for request_irq/nmi() drivers/vfio/pci/vfio_pci_intrs.c | 177 ++++++++++++++++++------------ drivers/vfio/virqfd.c | 21 ++++ include/linux/interrupt.h | 4 + include/linux/vfio.h | 2 + kernel/irq/manage.c | 11 +- 5 files changed, 143 insertions(+), 72 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10 v2 00/15] arm64 bpf trampoline for olk-5.10
by Pu Lehui 12 Apr '24

12 Apr '24

Alexander Duyck (1): bpf, arm64: Fix BTI type used for freplace attached functions Nathan Chancellor (1): bpf, arm64: Mark dummy_tramp as global Peter Zijlstra (1): x86/ibt,ftrace: Search for __fentry__ location Xu Kuohai (12): arm64, insn: Add ldr/str with immediate offset bpf, arm64: Optimize BPF store/load using arm64 str/ldr(immediate offset) bpf, arm64: Adjust the offset of str/ldr(immediate) to positive number arm64: Add LDR (literal) instruction bpf, arm64: Implement bpf_arch_text_poke() for arm64 bpf, arm64: Add bpf trampoline for arm64 bpf, arm64: Fix compile error in dummy_tramp() bpf, arm64: Fix bpf trampoline instruction endianness ftrace: Allow users to disable ftrace direct call arm64: ftrace: Support long jump for ftrace direct call arm64: ftrace: Add ftrace direct call support arm64: ftrace: Support direct call for no literal module functions arch/arm64/Kconfig | 2 + arch/arm64/Makefile | 4 + arch/arm64/include/asm/ftrace.h | 31 +- arch/arm64/include/asm/insn.h | 14 + arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kernel/entry-ftrace.S | 39 +- arch/arm64/kernel/ftrace.c | 248 ++++++++- arch/arm64/kernel/insn.c | 111 +++- arch/arm64/net/bpf_jit.h | 21 + arch/arm64/net/bpf_jit_comp.c | 874 +++++++++++++++++++++++++++++-- arch/x86/kernel/kprobes/core.c | 11 +- include/linux/ftrace.h | 3 + kernel/bpf/trampoline.c | 20 +- kernel/kprobes.c | 8 +- kernel/trace/Kconfig | 7 +- kernel/trace/ftrace.c | 65 ++- 16 files changed, 1343 insertions(+), 116 deletions(-) -- 2.34.1

2 16

[OLK-6.6 0/9] RDMA/hns: some bugfix
by Chengchang Tang 12 Apr '24

12 Apr '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Some bugfix for hns RoCE. Chengchang Tang (6): RDMA/hns: fix iommu_map_sg() failed when MR bigger than 4G RDMA/hns: Use complete parentheses in macros RDMA/hns: Remove extra blank line in get_sge_num_from_max_inl_data() RDMA/hns: Fix missing resetting notify RDMA/hns: Fix missing capacities in query_device() RDMA/hns: Fix cpu stuck by printings during reset wenglianfa (3): RDMA/hns: Fix simultaneous reset and resource deregistration RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() RDMA/hns: Fix long waiting cmd event when reset drivers/infiniband/core/ib_core_uverbs.c | 85 ++++++++++++++++++ drivers/infiniband/core/rdma_core.h | 1 - drivers/infiniband/core/uverbs_main.c | 64 -------------- drivers/infiniband/hw/hns/hns_roce_cq.c | 33 +++++-- drivers/infiniband/hw/hns/hns_roce_db.c | 31 +++++-- drivers/infiniband/hw/hns/hns_roce_device.h | 38 +++++++- drivers/infiniband/hw/hns/hns_roce_hem.c | 17 ++-- drivers/infiniband/hw/hns/hns_roce_hem.h | 12 +-- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 95 ++++++++++++-------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 +- drivers/infiniband/hw/hns/hns_roce_main.c | 16 +++- drivers/infiniband/hw/hns/hns_roce_mr.c | 96 ++++++++++++++++++++- drivers/infiniband/hw/hns/hns_roce_qp.c | 33 +++++-- drivers/infiniband/hw/hns/hns_roce_srq.c | 47 ++++++++-- include/rdma/ib_verbs.h | 2 + 15 files changed, 423 insertions(+), 149 deletions(-) -- 2.30.0

1 9

[PATCH openEuler-22.03-LTS-SP2 0/3] fs/ntfs3: fix CVE-2023-52640
by Baokun Li 12 Apr '24

12 Apr '24

Edward Adam Davis (1): fs/ntfs3: Fix oob in ntfs_listxattr Zeng Heng (2): ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea() fs/ntfs3/xattr.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.31.1

2 4

[PATCH openEuler-22.03-LTS-SP1 0/3] fs/ntfs3: fix CVE-2023-52640
by Baokun Li 12 Apr '24

12 Apr '24

Edward Adam Davis (1): fs/ntfs3: Fix oob in ntfs_listxattr Zeng Heng (2): ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea() fs/ntfs3/xattr.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.31.1

2 4

[PATCH OLK-5.10] net: ip_tunnel: prevent perpetual headroom growth
by Zhengchao Shao 12 Apr '24

12 Apr '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.212 commit 2e95350fe9db9d53c701075060ac8ac883b68aee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E47C CVE: CVE-2024-26804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f ] syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read of size 1 at addr ffff88812fb4000e by task syz-executor183/5191 [..] kasan_report+0xda/0x110 mm/kasan/report.c:588 __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline] ___skb_get_hash net/core/flow_dissector.c:1791 [inline] __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856 skb_get_hash include/linux/skbuff.h:1556 [inline] ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748 ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592 ... ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 .. iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831 ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 ... The splat occurs because skb->data points past skb->head allocated area. This is because neigh layer does: __skb_pull(skb, skb_network_offset(skb)); ... but skb_network_offset() returns a negative offset and __skb_pull() arg is unsigned. IOW, we skb->data gets "adjusted" by a huge value. The negative value is returned because skb->head and skb->data distance is more than 64k and skb->network_header (u16) has wrapped around. The bug is in the ip_tunnel infrastructure, which can cause dev->needed_headroom to increment ad infinitum. The syzkaller reproducer consists of packets getting routed via a gre tunnel, and route of gre encapsulated packets pointing at another (ipip) tunnel. The ipip encapsulation finds gre0 as next output device. This results in the following pattern: 1). First packet is to be sent out via gre0. Route lookup found an output device, ipip0. 2). ip_tunnel_xmit for gre0 bumps gre0->needed_headroom based on the future output device, rt.dev->needed_headroom (ipip0). 3). ip output / start_xmit moves skb on to ipip0. which runs the same code path again (xmit recursion). 4). Routing step for the post-gre0-encap packet finds gre0 as output device to use for ipip0 encapsulated packet. tunl0->needed_headroom is then incremented based on the (already bumped) gre0 device headroom. This repeats for every future packet: gre0->needed_headroom gets inflated because previous packets' ipip0 step incremented rt->dev (gre0) headroom, and ipip0 incremented because gre0 needed_headroom was increased. For each subsequent packet, gre/ipip0->needed_headroom grows until post-expand-head reallocations result in a skb->head/data distance of more than 64k. Once that happens, skb->network_header (u16) wraps around when pskb_expand_head tries to make sure that skb_network_offset() is unchanged after the headroom expansion/reallocation. After this skb_network_offset(skb) returns a different (and negative) result post headroom expansion. The next trip to neigh layer (or anything else that would __skb_pull the network header) makes skb->data point to a memory location outside skb->head area. v2: Cap the needed_headroom update to an arbitarily chosen upperlimit to prevent perpetual increase instead of dropping the headroom increment completely. Reported-and-tested-by: syzbot+bfde3bef047a81b8fde6(a)syzkaller.appspotmail.com Closes: https://groups.google.com/g/syzkaller-bugs/c/fL9G6GtWskY/m/VKk_PR5FBAAJ Fixes: 243aad830e8a ("ip_gre: include route header_len in max_headroom calculation") Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240220135606.4939-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv4/ip_tunnel.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c index 99f70b990eb1..50f8231e9dae 100644 --- a/net/ipv4/ip_tunnel.c +++ b/net/ipv4/ip_tunnel.c @@ -540,6 +540,20 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, return 0; } +static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +{ + /* we must cap headroom to some upperlimit, else pskb_expand_head + * will overflow header offsets in skb_headers_offset_update(). + */ + static const unsigned int max_allowed = 512; + + if (headroom > max_allowed) + headroom = max_allowed; + + if (headroom > READ_ONCE(dev->needed_headroom)) + WRITE_ONCE(dev->needed_headroom, headroom); +} + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto, int tunnel_hlen) { @@ -613,13 +627,13 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, } headroom += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len; - if (headroom > READ_ONCE(dev->needed_headroom)) - WRITE_ONCE(dev->needed_headroom, headroom); - - if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + if (skb_cow_head(skb, headroom)) { ip_rt_put(rt); goto tx_dropped; } + + ip_tunnel_adj_headroom(dev, headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, proto, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; @@ -797,16 +811,16 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr) + rt->dst.header_len + ip_encap_hlen(&tunnel->encap); - if (max_headroom > READ_ONCE(dev->needed_headroom)) - WRITE_ONCE(dev->needed_headroom, max_headroom); - if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + if (skb_cow_head(skb, max_headroom)) { ip_rt_put(rt); dev->stats.tx_dropped++; kfree_skb(skb); return; } + ip_tunnel_adj_headroom(dev, max_headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, protocol, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS 0/3] fs/ntfs3: fix CVE-2023-52640
by Baokun Li 12 Apr '24

12 Apr '24

Edward Adam Davis (1): fs/ntfs3: Fix oob in ntfs_listxattr Zeng Heng (2): ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea() fs/ntfs3/xattr.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.31.1

2 4

[PATCH openEuler-1.0-LTS] net: ip_tunnel: prevent perpetual headroom growth
by Zhengchao Shao 12 Apr '24

12 Apr '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.8-rc7 commit 5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E47C CVE: CVE-2024-26804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read of size 1 at addr ffff88812fb4000e by task syz-executor183/5191 [..] kasan_report+0xda/0x110 mm/kasan/report.c:588 __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline] ___skb_get_hash net/core/flow_dissector.c:1791 [inline] __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856 skb_get_hash include/linux/skbuff.h:1556 [inline] ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748 ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592 ... ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 .. iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831 ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 ... The splat occurs because skb->data points past skb->head allocated area. This is because neigh layer does: __skb_pull(skb, skb_network_offset(skb)); ... but skb_network_offset() returns a negative offset and __skb_pull() arg is unsigned. IOW, we skb->data gets "adjusted" by a huge value. The negative value is returned because skb->head and skb->data distance is more than 64k and skb->network_header (u16) has wrapped around. The bug is in the ip_tunnel infrastructure, which can cause dev->needed_headroom to increment ad infinitum. The syzkaller reproducer consists of packets getting routed via a gre tunnel, and route of gre encapsulated packets pointing at another (ipip) tunnel. The ipip encapsulation finds gre0 as next output device. This results in the following pattern: 1). First packet is to be sent out via gre0. Route lookup found an output device, ipip0. 2). ip_tunnel_xmit for gre0 bumps gre0->needed_headroom based on the future output device, rt.dev->needed_headroom (ipip0). 3). ip output / start_xmit moves skb on to ipip0. which runs the same code path again (xmit recursion). 4). Routing step for the post-gre0-encap packet finds gre0 as output device to use for ipip0 encapsulated packet. tunl0->needed_headroom is then incremented based on the (already bumped) gre0 device headroom. This repeats for every future packet: gre0->needed_headroom gets inflated because previous packets' ipip0 step incremented rt->dev (gre0) headroom, and ipip0 incremented because gre0 needed_headroom was increased. For each subsequent packet, gre/ipip0->needed_headroom grows until post-expand-head reallocations result in a skb->head/data distance of more than 64k. Once that happens, skb->network_header (u16) wraps around when pskb_expand_head tries to make sure that skb_network_offset() is unchanged after the headroom expansion/reallocation. After this skb_network_offset(skb) returns a different (and negative) result post headroom expansion. The next trip to neigh layer (or anything else that would __skb_pull the network header) makes skb->data point to a memory location outside skb->head area. v2: Cap the needed_headroom update to an arbitarily chosen upperlimit to prevent perpetual increase instead of dropping the headroom increment completely. Reported-and-tested-by: syzbot+bfde3bef047a81b8fde6(a)syzkaller.appspotmail.com Closes: https://groups.google.com/g/syzkaller-bugs/c/fL9G6GtWskY/m/VKk_PR5FBAAJ Fixes: 243aad830e8a ("ip_gre: include route header_len in max_headroom calculation") Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240220135606.4939-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/ip_tunnel.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv4/ip_tunnel.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c index 30e93b4f831f..b3ce8ab42cee 100644 --- a/net/ipv4/ip_tunnel.c +++ b/net/ipv4/ip_tunnel.c @@ -553,6 +553,20 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, return 0; } +static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +{ + /* we must cap headroom to some upperlimit, else pskb_expand_head + * will overflow header offsets in skb_headers_offset_update(). + */ + static const unsigned int max_allowed = 512; + + if (headroom > max_allowed) + headroom = max_allowed; + + if (headroom > READ_ONCE(dev->needed_headroom)) + WRITE_ONCE(dev->needed_headroom, headroom); +} + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto) { struct ip_tunnel *tunnel = netdev_priv(dev); @@ -609,13 +623,14 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto) else if (skb->protocol == htons(ETH_P_IP)) df = inner_iph->frag_off & htons(IP_DF); headroom += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len; - if (headroom > dev->needed_headroom) - dev->needed_headroom = headroom; - if (skb_cow_head(skb, dev->needed_headroom)) { + if (skb_cow_head(skb, headroom)) { ip_rt_put(rt); goto tx_dropped; } + + ip_tunnel_adj_headroom(dev, headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, proto, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; @@ -777,16 +792,16 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr) + rt->dst.header_len + ip_encap_hlen(&tunnel->encap); - if (max_headroom > dev->needed_headroom) - dev->needed_headroom = max_headroom; - if (skb_cow_head(skb, dev->needed_headroom)) { + if (skb_cow_head(skb, max_headroom)) { ip_rt_put(rt); dev->stats.tx_dropped++; kfree_skb(skb); return; } + ip_tunnel_adj_headroom(dev, max_headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, protocol, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; -- 2.34.1

2 1