microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/drivers
История
Eric Dumazet 1f6b623924 gtp: pull network headers in gtp_dev_xmit() 
commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 upstream.

syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1]

We must make sure the IPv4 or Ipv6 header is pulled in skb->head
before accessing fields in them.

Use pskb_inet_may_pull() to fix this issue.

[1]
BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline]
 BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline]
 BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281
  ipv6_pdp_find drivers/net/gtp.c:220 [inline]
  gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline]
  gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281
  __netdev_start_xmit include/linux/netdevice.h:4913 [inline]
  netdev_start_xmit include/linux/netdevice.h:4922 [inline]
  xmit_one net/core/dev.c:3580 [inline]
  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596
  __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423
  dev_queue_xmit include/linux/netdevice.h:3105 [inline]
  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276
  packet_snd net/packet/af_packet.c:3145 [inline]
  packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177
  sock_sendmsg_nosec net/socket.c:730 [inline]
  __sock_sendmsg+0x30f/0x380 net/socket.c:745
  __sys_sendto+0x685/0x830 net/socket.c:2204
  __do_sys_sendto net/socket.c:2216 [inline]
  __se_sys_sendto net/socket.c:2212 [inline]
  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212
  x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
  slab_post_alloc_hook mm/slub.c:3994 [inline]
  slab_alloc_node mm/slub.c:4037 [inline]
  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080
  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583
  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674
  alloc_skb include/linux/skbuff.h:1320 [inline]
  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526
  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815
  packet_alloc_skb net/packet/af_packet.c:2994 [inline]
  packet_snd net/packet/af_packet.c:3088 [inline]
  packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177
  sock_sendmsg_nosec net/socket.c:730 [inline]
  __sock_sendmsg+0x30f/0x380 net/socket.c:745
  __sys_sendto+0x685/0x830 net/socket.c:2204
  __do_sys_sendto net/socket.c:2216 [inline]
  __se_sys_sendto net/socket.c:2212 [inline]
  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212
  x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024

Fixes: 999cb275c807 ("gtp: add IPv6 support")
Fixes: 459aa660eb ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Harald Welte <laforge@gnumonks.org>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2024-09-04 13:23:28 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:39:11 +02:00
acpi ACPI: SBS: manage alarm sysfs attribute through psy core 2024-08-19 05:45:37 +02:00
amba
…
android binder: fix hang of unregistered readers 2024-08-19 05:45:16 +02:00
ata Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error" 2024-08-19 05:45:52 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-09-04 13:23:18 +02:00
auxdisplay
…
base driver core: Fix uevent_show() vs driver detach race 2024-08-19 05:45:45 +02:00
bcma
…
block rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings 2024-08-19 05:45:22 +02:00
bluetooth Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 2024-08-19 05:45:22 +02:00
bus bus: tegra-aconnect: Update dependency to ARCH_TEGRA 2024-03-26 18:21:19 -04:00
cdrom
…
char char: xillybus: Check USB endpoints when probing device 2024-09-04 13:23:15 +02:00
clk clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use 2024-08-19 05:45:16 +02:00
clocksource clocksource/drivers/arm_global_timer: Guard against division by zero 2024-09-04 13:23:25 +02:00
comedi comedi: vmk80xx: fix incomplete endpoint checking 2024-04-27 17:05:26 +02:00
connector
…
counter
…
cpufreq cppc_cpufreq: Fix possible null pointer dereference 2024-06-16 13:39:21 +02:00
cpuidle cpuidle: Avoid potential overflow in integer multiplication 2024-04-13 13:01:43 +02:00
crypto crypto: hisilicon/sec - Fix memory leak for sec resource release 2024-07-05 09:14:24 +02:00
cxl cxl/mem: Fix shutdown order 2023-11-20 11:08:27 +01:00
dax
…
dca
…
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-23 08:54:38 +01:00
dio
…
dma dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels 2024-08-19 05:45:23 +02:00
dma-buf dma-buf/sw-sync: don't enable IRQ from sync_print_obj() 2024-06-16 13:39:49 +02:00
edac EDAC, i10nm: make skx_common.o a separate module 2024-08-19 05:44:49 +02:00
eisa
…
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-16 13:39:39 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:51:01 +02:00
firmware firmware: turris-mox-rwtm: Initialize completion before mailbox 2024-08-19 05:44:55 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-16 13:39:38 +02:00
fsi
…
gnss
…
gpio gpiolib: of: add polarity quirk for TSC2005 2024-07-18 13:07:32 +02:00
gpu drm/lima: set gp bus_stop bit before hard reset 2024-09-04 13:23:24 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:14:23 +02:00
hid HID: wacom: Modify pen IDs 2024-08-19 05:45:33 +02:00
hsi
…
hv
…
hwmon hwmon: (ltc2992) Avoid division by zero 2024-09-04 13:23:23 +02:00
hwspinlock
…
hwtracing coresight: Fix ref leak when of_coresight_parse_endpoint() fails 2024-08-19 05:45:04 +02:00
i2c i2c: riic: avoid potential division by zero 2024-09-04 13:23:20 +02:00
i3c i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer 2024-09-04 13:23:21 +02:00
idle
…
iio iio: chemical: bme680: Fix sensor data read operation 2024-07-05 09:14:46 +02:00
infiniband IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock 2024-09-04 13:23:22 +02:00
input Input: elan_i2c - do not leave interrupt disabled on suspend failure 2024-08-19 05:45:05 +02:00
interconnect Revert "interconnect: Teach lockdep about icc_bw_lock order" 2024-03-06 14:38:50 +00:00
iommu iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en 2024-08-19 05:45:26 +02:00
ipack
…
irqchip irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc 2024-09-04 13:23:28 +02:00
isdn mISDN: Fix a use after free in hfcmulti_tx() 2024-08-19 05:45:25 +02:00
leds leds: triggers: Flush pending brightness before activating trigger 2024-08-19 05:45:29 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-19 05:45:06 +02:00
mailbox mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt 2024-02-23 08:54:50 +01:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 16:56:31 +00:00
md md: clean up invalid BUG_ON in md_ioctl 2024-09-04 13:23:25 +02:00
media media: drivers/media/dvb-core: copy user arrays safely 2024-09-04 13:23:24 +02:00
memory memory: stm32-fmc2-ebi: check regmap_read return value 2024-09-04 13:23:25 +02:00
memstick
…
message
…
mfd mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-19 05:45:03 +02:00
misc mei: demote client disconnect warning on suspend to debug 2024-07-27 10:46:10 +02:00
mmc mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() 2024-07-05 09:14:45 +02:00
most
…
mtd ubi: eba: properly rollback inside self_check_eba 2024-08-19 05:45:16 +02:00
mux
…
net gtp: pull network headers in gtp_dev_xmit() 2024-09-04 13:23:28 +02:00
nfc nfc/nci: Add the inconsistency check between the input data length and count 2024-07-18 13:07:36 +02:00
ntb NTB: fix possible name leak in ntb_register_device() 2024-03-26 18:21:28 -04:00
nubus
…
nvdimm nd_btt: Make BTT lanes preemptible 2023-11-20 11:08:22 +01:00
nvme nvmet-rdma: fix possible bad dereference when freeing rsps 2024-09-04 13:23:28 +02:00
nvmem nvmem: core: only change name to fram for current attribute 2024-07-18 13:07:42 +02:00
of cma: factor out minimum alignment requirement 2024-07-05 09:14:13 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:23 -04:00
parisc
…
parport dev/parport: fix the array out-of-bounds risk 2024-08-19 05:45:16 +02:00
pci PCI: dwc: Restore MSI Receiver mask during resume 2024-08-19 05:45:50 +02:00
pcmcia pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() 2023-11-20 11:08:27 +01:00
perf perf: hisi: Fix use-after-free when register pmu fails 2023-11-20 11:08:21 +01:00
phy phy: cadence-torrent: Check return value on register read 2024-08-19 05:45:23 +02:00
pinctrl pinctrl: freescale: mxs: Fix refcount of child 2024-08-19 05:45:09 +02:00
platform platform/x86: lg-laptop: fix %s null argument warning 2024-09-04 13:23:28 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:54:38 +01:00
power power: supply: axp288_charger: Round constant_charge_voltage writes down 2024-08-19 05:45:46 +02:00
powercap
…
pps
…
ps3
…
ptp ptp: fix integer overflow in max_vclocks_store 2024-07-05 09:14:31 +02:00
pwm pwm: stm32: Always do lazy disabling 2024-08-19 05:44:51 +02:00
rapidio
…
ras
…
regulator regulator: bd71815: fix ramp values 2024-07-05 09:14:33 +02:00
remoteproc remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init 2024-08-19 05:45:30 +02:00
reset reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning 2024-01-25 14:52:30 -08:00
rpmsg rpmsg: virtio: Free driver_override when rpmsg_remove() 2024-02-23 08:54:24 +01:00
rtc rtc: isl1208: Fix return value of nvmem callbacks 2024-08-19 05:45:20 +02:00
s390 bitmap: introduce generic optimized bitmap_size() 2024-09-04 13:23:16 +02:00
sbus
…
scsi scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() 2024-09-04 13:23:24 +02:00
sh
…
siox
…
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 11:51:04 +02:00
soc drivers: soc: xilinx: check return status of get_api_version() 2024-08-19 05:45:29 +02:00
soundwire soundwire: cadence: fix invalid PDI offset 2024-06-16 13:39:34 +02:00
spi spi: spi-fsl-lpspi: Fix scldiv calculation 2024-08-19 05:45:42 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-07-05 09:14:20 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-09-04 13:23:20 +02:00
staging staging: ks7010: disable bh on tx_dev_lock 2024-09-04 13:23:22 +02:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-05-17 11:50:54 +02:00
tc
…
tee tee: optee: Fix kernel panic caused by incorrect error handling 2024-04-10 16:18:46 +02:00
thermal thermal/drivers/qcom/lmh: Check for SCM availability at probe 2024-06-16 13:39:55 +02:00
thunderbolt thunderbolt: Mark XDomain as unplugged when router is removed 2024-09-04 13:23:15 +02:00
tty serial: core: check uartclk for zero to avoid divide by zero 2024-08-19 05:45:46 +02:00
uio uio: Fix use-after-free in uio_open 2024-01-25 14:52:31 -08:00
usb usb: dwc3: core: Skip setting event buffers for host only controllers 2024-09-04 13:23:28 +02:00
vdpa vduse: Temporarily fail if control queue feature requested 2024-07-05 09:14:42 +02:00
vfio vfio/fsl-mc: Block calling interrupt handler without trigger 2024-04-10 16:19:30 +02:00
vhost vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler 2024-08-19 05:45:44 +02:00
video fbdev: savage: Handle err return when savagefb_check_var failed 2024-06-16 13:39:57 +02:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-16 13:39:32 +02:00
virtio virtio: delete vq in vp_find_vqs_msix() when request_irq() fails 2024-06-16 13:39:47 +02:00
visorbus
…
vlynq
…
vme
…
w1
…
watchdog watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin 2024-06-16 13:39:59 +02:00
xen xen/events: close evtchn after mapping cleanup 2024-04-10 16:18:46 +02:00
zorro
…
Kconfig
…
Makefile
…