1. 09 Jul, 2024 31 commits
  2. 04 Jul, 2024 4 commits
    • Denis Arefev's avatar
      net: missing check virtio · e269d79c
      Denis Arefev authored
      Two missing check in virtio_net_hdr_to_skb() allowed syzbot
      to crash kernels again
      
      1. After the skb_segment function the buffer may become non-linear
      (nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere
      the __skb_linearize function will not be executed, then the buffer will
      remain non-linear. Then the condition (offset >= skb_headlen(skb))
      becomes true, which causes WARN_ON_ONCE in skb_checksum_help.
      
      2. The struct sk_buff and struct virtio_net_hdr members must be
      mathematically related.
      (gso_size) must be greater than (needed) otherwise WARN_ON_ONCE.
      (remainder) must be greater than (needed) otherwise WARN_ON_ONCE.
      (remainder) may be 0 if division is without remainder.
      
      offset+2 (4191) > skb_headlen() (1116)
      WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303
      Modules linked in:
      CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee2 #0
      Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
      RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303
      Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef
      RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286
      RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209
      RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001
      RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c
      R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d
      FS:  0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       <TASK>
       ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777
       ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584
       ip_finish_output_gso net/ipv4/ip_output.c:286 [inline]
       __ip_finish_output net/ipv4/ip_output.c:308 [inline]
       __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295
       ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323
       NF_HOOK_COND include/linux/netfilter.h:303 [inline]
       ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433
       dst_output include/net/dst.h:451 [inline]
       ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129
       iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82
       ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline]
       sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076
       __netdev_start_xmit include/linux/netdevice.h:4940 [inline]
       netdev_start_xmit include/linux/netdevice.h:4954 [inline]
       xmit_one net/core/dev.c:3545 [inline]
       dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561
       __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346
       dev_queue_xmit include/linux/netdevice.h:3134 [inline]
       packet_xmit+0x257/0x380 net/packet/af_packet.c:276
       packet_snd net/packet/af_packet.c:3087 [inline]
       packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119
       sock_sendmsg_nosec net/socket.c:730 [inline]
       __sock_sendmsg+0xd5/0x180 net/socket.c:745
       __sys_sendto+0x255/0x340 net/socket.c:2190
       __do_sys_sendto net/socket.c:2202 [inline]
       __se_sys_sendto net/socket.c:2198 [inline]
       __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198
       do_syscall_x64 arch/x86/entry/common.c:51 [inline]
       do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
       entry_SYSCALL_64_after_hwframe+0x63/0x6b
      
      Found by Linux Verification Center (linuxtesting.org) with Syzkaller
      
      Fixes: 0f6925b3 ("virtio_net: Do not pull payload in skb->head")
      Signed-off-by: default avatarDenis Arefev <arefev@swemel.ru>
      Message-Id: <20240613095448.27118-1-arefev@swemel.ru>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      e269d79c
    • Yunseong Kim's avatar
      tools/virtio: creating pipe assertion in vringh_test · ede9c33e
      Yunseong Kim authored
      parallel_test() function in vringh_test needs to verify
      the creation of the guest/host pipe.
      Signed-off-by: default avatarYunseong Kim <yskelg@gmail.com>
      Message-Id: <20240624174905.27980-2-yskelg@gmail.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      ede9c33e
    • Xuan Zhuo's avatar
      virtio_ring: fix KMSAN error for premapped mode · 840b2d39
      Xuan Zhuo authored
      Add kmsan for virtqueue_dma_map_single_attrs to fix:
      
      BUG: KMSAN: uninit-value in receive_buf+0x45ca/0x6990
       receive_buf+0x45ca/0x6990
       virtnet_poll+0x17e0/0x3130
       net_rx_action+0x832/0x26e0
       handle_softirqs+0x330/0x10f0
       [...]
      
      Uninit was created at:
       __alloc_pages_noprof+0x62a/0xe60
       alloc_pages_noprof+0x392/0x830
       skb_page_frag_refill+0x21a/0x5c0
       virtnet_rq_alloc+0x50/0x1500
       try_fill_recv+0x372/0x54c0
       virtnet_open+0x210/0xbe0
       __dev_open+0x56e/0x920
       __dev_change_flags+0x39c/0x2000
       dev_change_flags+0xaa/0x200
       do_setlink+0x197a/0x7420
       rtnl_setlink+0x77c/0x860
       [...]
      Signed-off-by: default avatarXuan Zhuo <xuanzhuo@linux.alibaba.com>
      Tested-by: default avatarAlexander Potapenko <glider@google.com>
      Message-Id: <20240606111345.93600-1-xuanzhuo@linux.alibaba.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>  # s390x
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      840b2d39
    • Michael S. Tsirkin's avatar
      vhost/vsock: always initialize seqpacket_allow · 1e1fdcbd
      Michael S. Tsirkin authored
      There are two issues around seqpacket_allow:
      1. seqpacket_allow is not initialized when socket is
         created. Thus if features are never set, it will be
         read uninitialized.
      2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared,
         then seqpacket_allow will not be cleared appropriately
         (existing apps I know about don't usually do this but
          it's legal and there's no way to be sure no one relies
          on this).
      
      To fix:
      	- initialize seqpacket_allow after allocation
      	- set it unconditionally in set_features
      
      Reported-by: syzbot+6c21aeb59d0e82eb2782@syzkaller.appspotmail.com
      Reported-by: default avatarJeongjun Park <aha310510@gmail.com>
      Fixes: ced7b713 ("vhost/vsock: support SEQPACKET for transport").
      Tested-by: default avatarArseny Krasnov <arseny.krasnov@kaspersky.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: Stefan Hajnoczi <stefanha@redhat.com>
      Message-ID: <20240422100010-mutt-send-email-mst@kernel.org>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Reviewed-by: default avatarStefano Garzarella <sgarzare@redhat.com>
      Reviewed-by: default avatarEugenio Pérez <eperezma@redhat.com>
      Acked-by: default avatarJakub Kicinski <kuba@kernel.org>
      1e1fdcbd
  3. 02 Jul, 2024 5 commits