net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet
commit 54970a2fbb
upstream.
syzbot reproduces BUG_ON in skb_checksum_help():
tun creates (bogus) skb with huge partial-checksummed area and
small ip packet inside. Then ip_rcv trims the skb based on size
of internal ip packet, after that csum offset points beyond of
trimmed skb. Then checksum_tg() called via netfilter hook
triggers BUG_ON:
offset = skb_checksum_start_offset(skb);
BUG_ON(offset >= skb_headlen(skb));
To work around the problem this patch forces pskb_trim_rcsum_slow()
to return -EINVAL in described scenario. It allows its callers to
drop such kind of packets.
Link: https://syzkaller.appspot.com/bug?id=b419a5ca95062664fe1a60b764621eb4526e2cd0
Reported-by: syzbot+7010af67ced6105e5ab6@syzkaller.appspotmail.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/1b2494af-2c56-8ee2-7bc0-923fcad1cdf8@virtuozzo.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
5.4-rM2-2.2.x-imx-squashed
parent
bd0051a5cb
commit
bbb2fee395
|
@ -2017,6 +2017,12 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len)
|
|||
skb->csum = csum_block_sub(skb->csum,
|
||||
skb_checksum(skb, len, delta, 0),
|
||||
len);
|
||||
} else if (skb->ip_summed == CHECKSUM_PARTIAL) {
|
||||
int hdlen = (len > skb_headlen(skb)) ? skb_headlen(skb) : len;
|
||||
int offset = skb_checksum_start_offset(skb) + skb->csum_offset;
|
||||
|
||||
if (offset + sizeof(__sum16) > hdlen)
|
||||
return -EINVAL;
|
||||
}
|
||||
return __pskb_trim(skb, len);
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue