Xin Long a204aef9fd xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output ... An use-after-free crash can be triggered when sending big packets over vxlan over esp with esp offload enabled: [] BUG: KASAN: use-after-free in ipv6_gso_pull_exthdrs.part.8+0x32c/0x4e0 [] Call Trace: [] dump_stack+0x75/0xa0 [] kasan_report+0x37/0x50 [] ipv6_gso_pull_exthdrs.part.8+0x32c/0x4e0 [] ipv6_gso_segment+0x2c8/0x13c0 [] skb_mac_gso_segment+0x1cb/0x420 [] skb_udp_tunnel_segment+0x6b5/0x1c90 [] inet_gso_segment+0x440/0x1380 [] skb_mac_gso_segment+0x1cb/0x420 [] esp4_gso_segment+0xae8/0x1709 [esp4_offload] [] inet_gso_segment+0x440/0x1380 [] skb_mac_gso_segment+0x1cb/0x420 [] __skb_gso_segment+0x2d7/0x5f0 [] validate_xmit_skb+0x527/0xb10 [] __dev_queue_xmit+0x10f8/0x2320 <--- [] ip_finish_output2+0xa2e/0x1b50 [] ip_output+0x1a8/0x2f0 [] xfrm_output_resume+0x110e/0x15f0 [] __xfrm4_output+0xe1/0x1b0 [] xfrm4_output+0xa0/0x200 [] iptunnel_xmit+0x5a7/0x920 [] vxlan_xmit_one+0x1658/0x37a0 [vxlan] [] vxlan_xmit+0x5e4/0x3ec8 [vxlan] [] dev_hard_start_xmit+0x125/0x540 [] __dev_queue_xmit+0x17bd/0x2320 <--- [] ip6_finish_output2+0xb20/0x1b80 [] ip6_output+0x1b3/0x390 [] ip6_xmit+0xb82/0x17e0 [] inet6_csk_xmit+0x225/0x3d0 [] __tcp_transmit_skb+0x1763/0x3520 [] tcp_write_xmit+0xd64/0x5fe0 [] __tcp_push_pending_frames+0x8c/0x320 [] tcp_sendmsg_locked+0x2245/0x3500 [] tcp_sendmsg+0x27/0x40 As on the tx path of vxlan over esp, skb->inner_network_header would be set on vxlan_xmit() and xfrm4_tunnel_encap_add(), and the later one can overwrite the former one. It causes skb_udp_tunnel_segment() to use a wrong skb->inner_network_header, then the issue occurs. This patch is to fix it by calling xfrm_output_gso() instead when the inner_protocol is set, in which gso_segment of inner_protocol will be done first. While at it, also improve some code around. Fixes: 7862b4058b ("esp: Add gso handlers for esp4 and esp6") Reported-by: Xiumei Mu <xmu@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>		2020-04-21 07:30:06 +02:00
..
espintcp.c	xfrm: espintcp: save and call old ->sk_destruct	2020-04-20 07:34:16 +02:00
Kconfig	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2019-11-25 20:02:57 -08:00
Makefile	xfrm: add espintcp (RFC 8229)	2019-12-09 09:59:07 +01:00
xfrm_algo.c	crypto: skcipher - remove the "blkcipher" algorithm type	2019-11-01 13:38:32 +08:00
xfrm_device.c	xfrm: do pskb_pull properly in __xfrm_transport_prep	2020-04-15 09:50:03 +02:00
xfrm_hash.c	mm: remove include/linux/bootmem.h	2018-10-31 08:54:16 -07:00
xfrm_hash.h	xfrm: use complete IPv6 addresses for hash	2018-10-15 10:09:18 +02:00
xfrm_inout.h	xfrm: remove input2 indirection from xfrm_mode	2019-04-08 09:14:55 +02:00
xfrm_input.c	xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input	2020-04-15 09:50:03 +02:00
xfrm_interface.c	xfrm: interface: use icmp_ndo_send helper	2020-02-13 14:19:00 -08:00
xfrm_ipcomp.c	net: Use skb_frag_off accessors	2019-07-30 14:21:32 -07:00
xfrm_output.c	xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output	2020-04-21 07:30:06 +02:00
xfrm_policy.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2020-03-29 21:25:29 -07:00
xfrm_proc.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
xfrm_replay.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 335	2019-06-05 17:37:06 +02:00
xfrm_state.c	xfrm: Use kmem_cache_zalloc() instead of kmem_cache_alloc() with flag GFP_ZERO.	2020-02-19 09:33:56 +01:00
xfrm_sysctl.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm_user.c	xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire	2020-02-12 11:06:32 +01:00