Commit fdafed45 authored by Cong Wang's avatar Cong Wang Committed by Jakub Kicinski

ip_gre: set dev->hard_header_len and dev->needed_headroom properly

GRE tunnel has its own header_ops, ipgre_header_ops, and sets it
conditionally. When it is set, it assumes the outer IP header is
already created before ipgre_xmit().

This is not true when we send packets through a raw packet socket,
where L2 headers are supposed to be constructed by user. Packet
socket calls dev_validate_header() to validate the header. But
GRE tunnel does not set dev->hard_header_len, so that check can
be simply bypassed, therefore uninit memory could be passed down
to ipgre_xmit(). Similar for dev->needed_headroom.

dev->hard_header_len is supposed to be the length of the header
created by dev->header_ops->create(), so it should be used whenever
header_ops is set, and dev->needed_headroom should be used when it
is not set.

Reported-and-tested-by: syzbot+4a2c52677a8a1aa283cb@syzkaller.appspotmail.com
Cc: William Tu <u9012063@gmail.com>
Acked-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Acked-by: default avatarXie He <xie.he.0141@gmail.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 4e3bbb33
...@@ -625,9 +625,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, ...@@ -625,9 +625,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
} }
if (dev->header_ops) { if (dev->header_ops) {
/* Need space for new headers */ if (skb_cow_head(skb, 0))
if (skb_cow_head(skb, dev->needed_headroom -
(tunnel->hlen + sizeof(struct iphdr))))
goto free_skb; goto free_skb;
tnl_params = (const struct iphdr *)skb->data; tnl_params = (const struct iphdr *)skb->data;
...@@ -748,7 +746,11 @@ static void ipgre_link_update(struct net_device *dev, bool set_mtu) ...@@ -748,7 +746,11 @@ static void ipgre_link_update(struct net_device *dev, bool set_mtu)
len = tunnel->tun_hlen - len; len = tunnel->tun_hlen - len;
tunnel->hlen = tunnel->hlen + len; tunnel->hlen = tunnel->hlen + len;
dev->needed_headroom = dev->needed_headroom + len; if (dev->header_ops)
dev->hard_header_len += len;
else
dev->needed_headroom += len;
if (set_mtu) if (set_mtu)
dev->mtu = max_t(int, dev->mtu - len, 68); dev->mtu = max_t(int, dev->mtu - len, 68);
...@@ -944,6 +946,7 @@ static void __gre_tunnel_init(struct net_device *dev) ...@@ -944,6 +946,7 @@ static void __gre_tunnel_init(struct net_device *dev)
tunnel->parms.iph.protocol = IPPROTO_GRE; tunnel->parms.iph.protocol = IPPROTO_GRE;
tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen; tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
dev->needed_headroom = tunnel->hlen + sizeof(tunnel->parms.iph);
dev->features |= GRE_FEATURES; dev->features |= GRE_FEATURES;
dev->hw_features |= GRE_FEATURES; dev->hw_features |= GRE_FEATURES;
...@@ -987,10 +990,14 @@ static int ipgre_tunnel_init(struct net_device *dev) ...@@ -987,10 +990,14 @@ static int ipgre_tunnel_init(struct net_device *dev)
return -EINVAL; return -EINVAL;
dev->flags = IFF_BROADCAST; dev->flags = IFF_BROADCAST;
dev->header_ops = &ipgre_header_ops; dev->header_ops = &ipgre_header_ops;
dev->hard_header_len = tunnel->hlen + sizeof(*iph);
dev->needed_headroom = 0;
} }
#endif #endif
} else if (!tunnel->collect_md) { } else if (!tunnel->collect_md) {
dev->header_ops = &ipgre_header_ops; dev->header_ops = &ipgre_header_ops;
dev->hard_header_len = tunnel->hlen + sizeof(*iph);
dev->needed_headroom = 0;
} }
return ip_tunnel_init(dev); return ip_tunnel_init(dev);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment