Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3110e213 authored Jan 19, 2018 by Willem de Bruijn Committed by Greg Kroah-Hartman Jan 31, 2018

gso: validate gso_type in GSO handlers


[ Upstream commit 121d57af308d0cf943f08f4738d24d3966c38cd9 ]

Validate gso_type during segmentation as SKB_GSO_DODGY sources
may pass packets where the gso_type does not match the contents.

Syzkaller was able to enter the SCTP gso handler with a packet of
gso_type SKB_GSO_TCPV4.

On entry of transport layer gso handlers, verify that the gso_type
matches the transport protocol.

Fixes: 90017acc ("sctp: Add GSO support")
Link: http://lkml.kernel.org/r/<001a1137452496ffc305617e5fe0@google.com

>
Reported-by:  <syzbot+fee64147a25aecd48055@syzkaller.appspotmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent cc99c6d5

net/ipv4/tcp_offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -32,6 +32,9 @@ static void tcp_gso_tstamp(struct sk_buff *skb, unsigned int ts_seq,
		static struct sk_buff tcp4_gso_segment(struct sk_buff skb,
		netdev_features_t features)
		{
		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4))
		return ERR_PTR(-EINVAL);

		if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
		return ERR_PTR(-EINVAL);

net/ipv4/udp_offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -205,6 +205,9 @@ static struct sk_buff udp4_ufo_fragment(struct sk_buff skb,
		goto out;
		}

		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP))
		goto out;

		if (!pskb_may_pull(skb, sizeof(struct udphdr)))
		goto out;

net/ipv6/tcpv6_offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -46,6 +46,9 @@ static struct sk_buff tcp6_gso_segment(struct sk_buff skb,
		{
		struct tcphdr *th;

		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
		return ERR_PTR(-EINVAL);

		if (!pskb_may_pull(skb, sizeof(*th)))
		return ERR_PTR(-EINVAL);

net/ipv6/udp_offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -55,6 +55,9 @@ static struct sk_buff udp6_ufo_fragment(struct sk_buff skb,
		const struct ipv6hdr *ipv6h;
		struct udphdr *uh;

		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP))
		goto out;

		if (!pskb_may_pull(skb, sizeof(struct udphdr)))
		goto out;

net/sctp/offload.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -44,6 +44,9 @@ static struct sk_buff sctp_gso_segment(struct sk_buff skb,
		struct sk_buff *segs = ERR_PTR(-EINVAL);
		struct sctphdr *sh;

		if (!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP))
		goto out;

		sh = sctp_hdr(skb);
		if (!pskb_may_pull(skb, sizeof(*sh)))
		goto out;