• Xin Long's avatar
    tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb · c3bcde02
    Xin Long authored
    udp_tunnel(6)_xmit_skb() called by tipc_udp_xmit() expects a tunnel device
    to count packets on dev->tstats, a perpcu variable. However, TIPC is using
    udp tunnel with no tunnel device, and pass the lower dev, like veth device
    that only initializes dev->lstats(a perpcu variable) when creating it.
    
    Later iptunnel_xmit_stats() called by ip(6)tunnel_xmit() thinks the dev as
    a tunnel device, and uses dev->tstats instead of dev->lstats. tstats' each
    pointer points to a bigger struct than lstats, so when tstats->tx_bytes is
    increased, other percpu variable's members could be overwritten.
    
    syzbot has reported quite a few crashes due to fib_nh_common percpu member
    'nhc_pcpu_rth_output' overwritten, call traces are like:
    
      BUG: KASAN: slab-out-of-bounds in rt_cache_valid+0x158/0x190
      net/ipv4/route.c:1556
        rt_cache_valid+0x158/0x190 net/ipv4/route.c:1556
        __mkroute_output net/ipv4/route.c:2332 [inline]
        ip_route_output_key_hash_rcu+0x819/0x2d50 net/ipv4/route.c:2564
        ip_route_output_key_hash+0x1ef/0x360 net/ipv4/route.c:2393
        __ip_route_output_key include/net/route.h:125 [inline]
        ip_route_output_flow+0x28/0xc0 net/ipv4/route.c:2651
        ip_route_output_key include/net/route.h:135 [inline]
      ...
    
    or:
    
      kasan: GPF could be caused by NULL-ptr deref or user memory access
      RIP: 0010:dst_dev_put+0x24/0x290 net/core/dst.c:168
        <IRQ>
        rt_fibinfo_free_cpus net/ipv4/fib_semantics.c:200 [inline]
        free_fib_info_rcu+0x2e1/0x490 net/ipv4/fib_semantics.c:217
        __rcu_reclaim kernel/rcu/rcu.h:240 [inline]
        rcu_do_batch kernel/rcu/tree.c:2437 [inline]
        invoke_rcu_callbacks kernel/rcu/tree.c:2716 [inline]
        rcu_process_callbacks+0x100a/0x1ac0 kernel/rcu/tree.c:2697
      ...
    
    The issue exists since tunnel stats update is moved to iptunnel_xmit by
    Commit 039f5062 ("ip_tunnel: Move stats update to iptunnel_xmit()"),
    and here to fix it by passing a NULL tunnel dev to udp_tunnel(6)_xmit_skb
    so that the packets counting won't happen on dev->tstats.
    
    Reported-by: syzbot+9d4c12bfd45a58738d0a@syzkaller.appspotmail.com
    Reported-by: syzbot+a9e23ea2aa21044c2798@syzkaller.appspotmail.com
    Reported-by: syzbot+c4c4b2bb358bb936ad7e@syzkaller.appspotmail.com
    Reported-by: syzbot+0290d2290a607e035ba1@syzkaller.appspotmail.com
    Reported-by: syzbot+a43d8d4e7e8a7a9e149e@syzkaller.appspotmail.com
    Reported-by: syzbot+a47c5f4c6c00fc1ed16e@syzkaller.appspotmail.com
    Fixes: 039f5062 ("ip_tunnel: Move stats update to iptunnel_xmit()")
    Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    c3bcde02
udp_media.c 20.3 KB