2019-05-27 14:55:01 +08:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
2013-05-24 05:02:52 +08:00
|
|
|
/*
|
|
|
|
* MPLS GSO Support
|
|
|
|
*
|
|
|
|
* Authors: Simon Horman (horms@verge.net.au)
|
|
|
|
*
|
|
|
|
* Based on: GSO portions of net/ipv4/gre.c
|
|
|
|
*/
|
|
|
|
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
|
|
|
|
#include <linux/err.h>
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/netdev_features.h>
|
|
|
|
#include <linux/netdevice.h>
|
|
|
|
#include <linux/skbuff.h>
|
2023-06-09 03:17:37 +08:00
|
|
|
#include <net/gso.h>
|
2021-03-09 19:31:01 +08:00
|
|
|
#include <net/mpls.h>
|
2013-05-24 05:02:52 +08:00
|
|
|
|
|
|
|
static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
|
|
|
|
netdev_features_t features)
|
|
|
|
{
|
|
|
|
struct sk_buff *segs = ERR_PTR(-EINVAL);
|
2016-08-25 11:10:44 +08:00
|
|
|
u16 mac_offset = skb->mac_header;
|
2013-05-24 05:02:52 +08:00
|
|
|
netdev_features_t mpls_features;
|
2016-08-25 11:10:44 +08:00
|
|
|
u16 mac_len = skb->mac_len;
|
2013-05-24 05:02:52 +08:00
|
|
|
__be16 mpls_protocol;
|
2016-08-25 11:10:44 +08:00
|
|
|
unsigned int mpls_hlen;
|
|
|
|
|
net: mpls: error out if inner headers are not set
mpls_gso_segment() assumes skb_inner_network_header() returns
a valid result:
mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
goto out;
if (unlikely(!pskb_may_pull(skb, mpls_hlen)))
With syzbot reproducer, skb_inner_network_header() yields 0,
skb_network_header() returns 108, so this will
"pskb_may_pull(skb, -108)))" which triggers a newly added
DEBUG_NET_WARN_ON_ONCE() check:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull_reason include/linux/skbuff.h:2723 [inline]
WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull include/linux/skbuff.h:2739 [inline]
WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 mpls_gso_segment+0x773/0xaa0 net/mpls/mpls_gso.c:34
[..]
skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53
nsh_gso_segment+0x40a/0xad0 net/nsh/nsh.c:108
skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53
__skb_gso_segment+0x324/0x4c0 net/core/gso.c:124
skb_gso_segment include/net/gso.h:83 [inline]
[..]
sch_direct_xmit+0x11a/0x5f0 net/sched/sch_generic.c:327
[..]
packet_sendmsg+0x46a9/0x6130 net/packet/af_packet.c:3113
[..]
First iteration of this patch made mpls_hlen signed and changed
test to error out to "mpls_hlen <= 0 || ..".
Eric Dumazet said:
> I was thinking about adding a debug check in skb_inner_network_header()
> if inner_network_header is zero (that would mean it is not 'set' yet),
> but this would trigger even after your patch.
So add new skb_inner_network_header_was_set() helper and use that.
The syzbot reproducer injects data via packet socket. The skb that gets
allocated and passed down the stack has ->protocol set to NSH (0x894f)
and gso_type set to SKB_GSO_UDP | SKB_GSO_DODGY.
This gets passed to skb_mac_gso_segment(), which sees NSH as ptype to
find a callback for. nsh_gso_segment() retrieves next type:
proto = tun_p_to_eth_p(nsh_hdr(skb)->np);
... which is MPLS (TUN_P_MPLS_UC). It updates skb->protocol and then
calls mpls_gso_segment(). Inner offsets are all 0, so mpls_gso_segment()
ends up with a negative header size.
In case more callers rely on silent handling of such large may_pull values
we could also 'legalize' this behaviour, either replacing the debug check
with (len > INT_MAX) test or removing it and instead adding a comment
before existing
if (unlikely(len > skb->len))
return SKB_DROP_REASON_PKT_TOO_SMALL;
test in pskb_may_pull_reason(), saying that this check also implicitly
takes care of callers that miscompute header sizes.
Cc: Simon Horman <horms@kernel.org>
Fixes: 219eee9c0d16 ("net: skbuff: add overflow debug check to pull/push helpers")
Reported-by: syzbot+99d15fcdb0132a1e1a82@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/00000000000043b1310611e388aa@google.com/raw
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20240222140321.14080-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-02-22 22:03:10 +08:00
|
|
|
if (!skb_inner_network_header_was_set(skb))
|
|
|
|
goto out;
|
|
|
|
|
2016-08-25 11:10:44 +08:00
|
|
|
skb_reset_network_header(skb);
|
|
|
|
mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
|
2021-03-09 19:31:01 +08:00
|
|
|
if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
|
|
|
|
goto out;
|
2016-08-25 11:10:44 +08:00
|
|
|
if (unlikely(!pskb_may_pull(skb, mpls_hlen)))
|
|
|
|
goto out;
|
2013-05-24 05:02:52 +08:00
|
|
|
|
|
|
|
/* Setup inner SKB. */
|
|
|
|
mpls_protocol = skb->protocol;
|
|
|
|
skb->protocol = skb->inner_protocol;
|
|
|
|
|
2016-08-25 11:10:44 +08:00
|
|
|
__skb_pull(skb, mpls_hlen);
|
|
|
|
|
|
|
|
skb->mac_len = 0;
|
|
|
|
skb_reset_mac_header(skb);
|
2013-05-24 05:02:52 +08:00
|
|
|
|
|
|
|
/* Segment inner packet. */
|
2014-10-20 19:49:16 +08:00
|
|
|
mpls_features = skb->dev->mpls_features & features;
|
2013-05-24 05:02:52 +08:00
|
|
|
segs = skb_mac_gso_segment(skb, mpls_features);
|
2016-08-25 11:10:44 +08:00
|
|
|
if (IS_ERR_OR_NULL(segs)) {
|
|
|
|
skb_gso_error_unwind(skb, mpls_protocol, mpls_hlen, mac_offset,
|
|
|
|
mac_len);
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
skb = segs;
|
|
|
|
|
|
|
|
mpls_hlen += mac_len;
|
|
|
|
do {
|
|
|
|
skb->mac_len = mac_len;
|
|
|
|
skb->protocol = mpls_protocol;
|
2013-05-24 05:02:52 +08:00
|
|
|
|
2016-08-25 11:10:44 +08:00
|
|
|
skb_reset_inner_network_header(skb);
|
2013-05-24 05:02:52 +08:00
|
|
|
|
2016-08-25 11:10:44 +08:00
|
|
|
__skb_push(skb, mpls_hlen);
|
2013-05-24 05:02:52 +08:00
|
|
|
|
2016-08-25 11:10:44 +08:00
|
|
|
skb_reset_mac_header(skb);
|
|
|
|
skb_set_network_header(skb, mac_len);
|
|
|
|
} while ((skb = skb->next));
|
2016-05-19 00:06:09 +08:00
|
|
|
|
2016-08-25 11:10:44 +08:00
|
|
|
out:
|
2013-05-24 05:02:52 +08:00
|
|
|
return segs;
|
|
|
|
}
|
|
|
|
|
2015-01-29 19:15:03 +08:00
|
|
|
static struct packet_offload mpls_mc_offload __read_mostly = {
|
2013-05-24 05:02:52 +08:00
|
|
|
.type = cpu_to_be16(ETH_P_MPLS_MC),
|
2015-06-02 05:56:09 +08:00
|
|
|
.priority = 15,
|
2013-05-24 05:02:52 +08:00
|
|
|
.callbacks = {
|
|
|
|
.gso_segment = mpls_gso_segment,
|
|
|
|
},
|
|
|
|
};
|
|
|
|
|
2015-01-29 19:15:03 +08:00
|
|
|
static struct packet_offload mpls_uc_offload __read_mostly = {
|
2013-05-24 05:02:52 +08:00
|
|
|
.type = cpu_to_be16(ETH_P_MPLS_UC),
|
2015-06-02 05:56:09 +08:00
|
|
|
.priority = 15,
|
2013-05-24 05:02:52 +08:00
|
|
|
.callbacks = {
|
|
|
|
.gso_segment = mpls_gso_segment,
|
|
|
|
},
|
|
|
|
};
|
|
|
|
|
|
|
|
static int __init mpls_gso_init(void)
|
|
|
|
{
|
|
|
|
pr_info("MPLS GSO support\n");
|
|
|
|
|
|
|
|
dev_add_offload(&mpls_uc_offload);
|
|
|
|
dev_add_offload(&mpls_mc_offload);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __exit mpls_gso_exit(void)
|
|
|
|
{
|
|
|
|
dev_remove_offload(&mpls_uc_offload);
|
|
|
|
dev_remove_offload(&mpls_mc_offload);
|
|
|
|
}
|
|
|
|
|
|
|
|
module_init(mpls_gso_init);
|
|
|
|
module_exit(mpls_gso_exit);
|
|
|
|
|
|
|
|
MODULE_DESCRIPTION("MPLS GSO support");
|
2024-02-13 22:54:04 +08:00
|
|
|
MODULE_AUTHOR("Simon Horman <horms@verge.net.au>");
|
2013-05-24 05:02:52 +08:00
|
|
|
MODULE_LICENSE("GPL");
|