Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 121d57af authored Jan 19, 2018 by Willem de Bruijn Committed by David S. Miller Jan 22, 2018

gso: validate gso_type in GSO handlers

Validate gso_type during segmentation as SKB_GSO_DODGY sources
may pass packets where the gso_type does not match the contents.

Syzkaller was able to enter the SCTP gso handler with a packet of
gso_type SKB_GSO_TCPV4.

On entry of transport layer gso handlers, verify that the gso_type
matches the transport protocol.

Fixes: 90017acc ("sctp: Add GSO support")
Link: http://lkml.kernel.org/r/<001a1137452496ffc305617e5fe0@google.com

>
Reported-by:  <syzbot+fee64147a25aecd48055@syzkaller.appspotmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 7c68d1a6

net/ipv4/esp4_offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -122,6 +122,9 @@ static struct sk_buff esp4_gso_segment(struct sk_buff skb,
		if (!xo)
		goto out;

		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_ESP))
		goto out;

		seq = xo->seq.low;

		x = skb->sp->xvec[skb->sp->len - 1];

net/ipv4/tcp_offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -32,6 +32,9 @@ static void tcp_gso_tstamp(struct sk_buff *skb, unsigned int ts_seq,
		static struct sk_buff tcp4_gso_segment(struct sk_buff skb,
		netdev_features_t features)
		{
		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4))
		return ERR_PTR(-EINVAL);

		if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
		return ERR_PTR(-EINVAL);

net/ipv4/udp_offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -203,6 +203,9 @@ static struct sk_buff udp4_ufo_fragment(struct sk_buff skb,
		goto out;
		}

		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP))
		goto out;

		if (!pskb_may_pull(skb, sizeof(struct udphdr)))
		goto out;

net/ipv6/esp6_offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -149,6 +149,9 @@ static struct sk_buff esp6_gso_segment(struct sk_buff skb,
		if (!xo)
		goto out;

		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_ESP))
		goto out;

		seq = xo->seq.low;

		x = skb->sp->xvec[skb->sp->len - 1];

net/ipv6/tcpv6_offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -46,6 +46,9 @@ static struct sk_buff tcp6_gso_segment(struct sk_buff skb,
		{
		struct tcphdr *th;

		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
		return ERR_PTR(-EINVAL);

		if (!pskb_may_pull(skb, sizeof(*th)))
		return ERR_PTR(-EINVAL);