Eric Dumazet 501a90c945 inet: protect against too small mtu values. ... syzbot was once again able to crash a host by setting a very small mtu on loopback device. Let's make inetdev_valid_mtu() available in include/net/ip.h, and use it in ip_setup_cork(), so that we protect both ip_append_page() and __ip_append_data() Also add a READ_ONCE() when the device mtu is read. Pairs this lockless read with one WRITE_ONCE() in __dev_set_mtu(), even if other code paths might write over this field. Add a big comment in include/linux/netdevice.h about dev->mtu needing READ_ONCE()/WRITE_ONCE() annotations. Hopefully we will add the missing ones in followup patches. [1] refcount_t: saturated; leaking memory. WARNING: CPU: 0 PID: 9464 at lib/refcount.c:22 refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 9464 Comm: syz-executor850 Not tainted 5.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x3e kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22 Code: 06 31 ff 89 de e8 c8 f5 e6 fd 84 db 0f 85 6f ff ff ff e8 7b f4 e6 fd 48 c7 c7 e0 71 4f 88 c6 05 56 a6 a4 06 01 e8 c7 a8 b7 fd <0f> 0b e9 50 ff ff ff e8 5c f4 e6 fd 0f b6 1d 3d a6 a4 06 31 ff 89 RSP: 0018:ffff88809689f550 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815e4336 RDI: ffffed1012d13e9c RBP: ffff88809689f560 R08: ffff88809c50a3c0 R09: fffffbfff15d31b1 R10: fffffbfff15d31b0 R11: ffffffff8ae98d87 R12: 0000000000000001 R13: 0000000000040100 R14: ffff888099041104 R15: ffff888218d96e40 refcount_add include/linux/refcount.h:193 [inline] skb_set_owner_w+0x2b6/0x410 net/core/sock.c:1999 sock_wmalloc+0xf1/0x120 net/core/sock.c:2096 ip_append_page+0x7ef/0x1190 net/ipv4/ip_output.c:1383 udp_sendpage+0x1c7/0x480 net/ipv4/udp.c:1276 inet_sendpage+0xdb/0x150 net/ipv4/af_inet.c:821 kernel_sendpage+0x92/0xf0 net/socket.c:3794 sock_sendpage+0x8b/0xc0 net/socket.c:936 pipe_to_sendpage+0x2da/0x3c0 fs/splice.c:458 splice_from_pipe_feed fs/splice.c:512 [inline] __splice_from_pipe+0x3ee/0x7c0 fs/splice.c:636 splice_from_pipe+0x108/0x170 fs/splice.c:671 generic_splice_sendpage+0x3c/0x50 fs/splice.c:842 do_splice_from fs/splice.c:861 [inline] direct_splice_actor+0x123/0x190 fs/splice.c:1035 splice_direct_to_actor+0x3b4/0xa30 fs/splice.c:990 do_splice_direct+0x1da/0x2a0 fs/splice.c:1078 do_sendfile+0x597/0xd00 fs/read_write.c:1464 __do_sys_sendfile64 fs/read_write.c:1525 [inline] __se_sys_sendfile64 fs/read_write.c:1511 [inline] __x64_sys_sendfile64+0x1dd/0x220 fs/read_write.c:1511 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x441409 Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fffb64c4f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441409 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 RBP: 0000000000073b8a R08: 0000000000000010 R09: 0000000000000010 R10: 0000000000010001 R11: 0000000000000246 R12: 0000000000402180 R13: 0000000000402210 R14: 0000000000000000 R15: 0000000000000000 Kernel Offset: disabled Rebooting in 86400 seconds.. Fixes: 1470ddf7f8 ("inet: Remove explicit write references to sk/inet in ip_append_data") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-12-07 11:55:11 -08:00
..
9p	…
bluetooth	Bluetooth: Add support for utilizing Fast Advertising Interval	2019-09-05 17:27:21 +02:00
caif	…
iucv	…
netfilter	netfilter: nf_tables: constify nft_reg_load{8, 16, 64}()	2019-11-20 11:21:34 -08:00
netns	ipv6: keep track of routes using src	2019-11-21 14:45:55 -08:00
nfc	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234	2019-06-19 17:09:07 +02:00
phonet	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336	2019-06-05 17:37:07 +02:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-11-25 14:57:26 -08:00
tc_act	net: sched: take reference to psample group in flow_action infra	2019-09-16 09:18:03 +02:00
6lowpan.h	…
Space.h	…
act_api.h	net/sched: actions: remove unused 'order'	2019-11-12 12:11:22 -08:00
addrconf.h	ipv6: Make ipv6_mc_may_pull() return bool.	2019-10-07 09:37:27 -04:00
af_ieee802154.h	…
af_rxrpc.h	…
af_unix.h	…
af_vsock.h	vsock: prevent transport modules unloading	2019-11-14 18:12:18 -08:00
ah.h	…
arp.h	net: avoid potential false sharing in neighbor related code	2019-11-06 16:14:48 -08:00
atmclip.h	…
ax25.h	…
ax88796.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
bond_3ad.h	…
bond_alb.h	…
bond_options.h	bonding: add an option to specify a delay between peer notifications	2019-07-04 12:30:48 -07:00
bonding.h	bonding: fix state transition issue in link monitoring	2019-11-05 17:40:16 -08:00
bpf_sk_storage.h	bpf: support cloning sk storage on accept()	2019-08-17 23:18:54 +02:00
busy_poll.h	net: annotate lockless accesses to sk->sk_napi_id	2019-10-30 17:34:35 -07:00
calipso.h	…
cfg80211-wext.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
cfg80211.h	mac80211: Implement Airtime-based Queue Limit (AQL)	2019-11-22 13:36:25 +01:00
cfg802154.h	…
checksum.h	…
cipso_ipv4.h	…
cls_cgroup.h	…
codel.h	…
codel_impl.h	…
codel_qdisc.h	…
compat.h	…
datalink.h	…
dcbevent.h	…
dcbnl.h	…
devlink.h	Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux	2019-11-13 14:24:58 -08:00
dn.h	…
dn_dev.h	…
dn_fib.h	…
dn_neigh.h	…
dn_nsp.h	…
dn_route.h	…
drop_monitor.h	drop_monitor: Add basic infrastructure for hardware drops	2019-08-17 12:40:08 -07:00
dsa.h	net: dsa: ocelot: add tagger for Ocelot/Felix switches	2019-11-15 12:32:16 -08:00
dsfield.h	…
dst.h	net: dst.h: Fix shifting signed 32-bit value by 31 bits problem	2019-07-01 10:48:34 -07:00
dst_cache.h	…
dst_metadata.h	…
dst_ops.h	…
erspan.h	…
esp.h	…
ethoc.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
failover.h	…
fib_notifier.h	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
fib_rules.h	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
firewire.h	…
flow.h	…
flow_dissector.h	cls_flower: Fix the behavior using port ranges with hw-offload	2019-12-03 11:55:46 -08:00
flow_offload.h	net: core: rename indirect block ingress cb function	2019-12-06 20:45:09 -08:00
fou.h	…
fq.h	net/flow_dissector: switch to siphash	2019-10-23 20:13:22 -07:00
fq_impl.h	net/fq_impl: Switch to kvmalloc() for memory allocation	2019-11-08 09:11:49 +01:00
garp.h	…
gen_stats.h	net_sched: extend packet counter to 64bit	2019-11-05 18:20:55 -08:00
genetlink.h	net: genetlink: remove unused genl_family_attrbuf()	2019-10-06 15:44:47 +02:00
geneve.h	…
gre.h	…
gro_cells.h	…
gtp.h	…
gue.h	net:gue.h:Fix shifting signed 32-bit value by 31 bits problem	2019-07-01 10:58:23 -07:00
hwbm.h	net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static	2019-10-25 16:24:32 -07:00
icmp.h	…
ieee80211_radiotap.h	…
ieee802154_netdev.h	…
if_inet6.h	ipv6: shrink struct ipv6_mc_socklist	2019-08-28 14:43:03 -07:00
ife.h	…
ila.h	…
inet6_connection_sock.h	…
inet6_hashtables.h	…
inet_common.h	inet: factor out inet_send_prepare()	2019-07-03 13:51:54 -07:00
inet_connection_sock.h	net/tls: use RCU protection on icsk->icsk_ulp_data	2019-08-31 23:44:28 -07:00
inet_ecn.h	…
inet_frag.h	inet: frags: re-introduce skb coalescing for local delivery	2019-08-08 15:55:10 -07:00
inet_hashtables.h	…
inet_sock.h	ip: support SO_MARK cmsg	2019-09-13 21:44:19 +02:00
inet_timewait_sock.h	tcp: honor SO_PRIORITY in TIME_WAIT state	2019-09-27 12:05:02 +02:00
inetpeer.h	…
ip.h	inet: protect against too small mtu values.	2019-12-07 11:55:11 -08:00
ip6_checksum.h	…
ip6_fib.h	ipv6: keep track of routes using src	2019-11-21 14:45:55 -08:00
ip6_route.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-27 21:06:39 -07:00
ip6_tunnel.h	ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL	2019-06-18 20:48:45 -04:00
ip_fib.h	ipv4: move fib4_has_custom_rules() helper to public header	2019-11-21 14:45:55 -08:00
ip_tunnels.h	…
ip_vs.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-11-02 13:54:56 -07:00
ipcomp.h	…
ipconfig.h	…
ipv6.h	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-04 12:27:12 -08:00
ipv6_frag.h	inet: fix various use-after-free in defrags units	2019-06-19 11:37:47 -04:00
ipv6_stubs.h	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2019-12-04 12:27:13 -08:00
ipx.h	…
iw_handler.h	…
kcm.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
l3mdev.h	…
lag.h	…
lapb.h	…
lib80211.h	…
llc.h	…
llc_c_ac.h	…
llc_c_ev.h	…
llc_c_st.h	…
llc_conn.h	llc: fix sk_buff leak in llc_conn_service()	2019-10-08 13:23:05 -07:00
llc_if.h	…
llc_pdu.h	…
llc_s_ac.h	…
llc_s_ev.h	…
llc_s_st.h	…
llc_sap.h	…
lwtunnel.h	…
mac80211.h	mac80211: Use Airtime-based Queue Limits (AQL) on packet dequeue	2019-11-22 13:36:25 +01:00
mac802154.h	…
mip6.h	…
mld.h	…
mpls.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
mpls_iptunnel.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
mrp.h	…
ncsi.h	…
ndisc.h	net: avoid potential false sharing in neighbor related code	2019-11-06 16:14:48 -08:00
neighbour.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-11-09 11:04:37 -08:00
net_failover.h	…
net_namespace.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-11-02 13:54:56 -07:00
net_ratelimit.h	…
netevent.h	…
netlabel.h	…
netlink.h	netlink: Fix nlmsg_parse as a wrapper for strict message parsing	2019-08-13 20:37:16 -07:00
netprio_cgroup.h	netprio: use css ID instead of cgroup ID	2019-11-12 08:18:03 -08:00
netrom.h	…
nexthop.h	net: Properly update v4 routes with v6 nexthop	2019-09-05 12:35:58 +02:00
nl802154.h	…
nsh.h	…
p8022.h	…
page_pool.h	net: page_pool: add the possibility to sync DMA memory for device	2019-11-20 12:34:28 -08:00
ping.h	…
pkt_cls.h	net: sched: take reference to action dev before calling offloads	2019-08-26 14:17:43 -07:00
pkt_sched.h	Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net	2019-09-17 23:51:10 +02:00
pptp.h	…
protocol.h	…
psample.h	net: sched: take reference to psample group in flow_action infra	2019-09-16 09:18:03 +02:00
psnap.h	…
raw.h	…
rawv6.h	…
red.h	…
regulatory.h	…
request_sock.h	net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head	2019-10-09 21:34:31 -07:00
rose.h	…
route.h	ipv4: use dst hint for ipv4 list receive	2019-11-21 14:45:55 -08:00
rsi_91x.h	…
rtnetlink.h	…
rtnh.h	…
sch_generic.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-11-09 11:04:37 -08:00
scm.h	…
secure_seq.h	…
seg6.h	…
seg6_hmac.h	…
seg6_local.h	…
slhc_vj.h	…
smc.h	net/smc: introduce bookkeeping of SMCD link groups	2019-11-15 12:28:28 -08:00
snmp.h	net/tls: add skeleton of MIB statistics	2019-10-05 16:29:00 -07:00
sock.h	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-11-26 16:02:40 -08:00
sock_reuseport.h	udp: correct reuseport selection with connected sockets	2019-09-16 09:02:18 +02:00
stp.h	…
strparser.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
switchdev.h	…
tcp.h	tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()	2019-12-06 21:05:14 -08:00
tcp_states.h	…
timewait_sock.h	…
tipc.h	…
tls.h	net/tls: use sg_next() to walk sg entries	2019-11-28 22:40:29 -08:00
tls_toe.h	net/tls: rename tls_hw_* functions tls_toe_*	2019-10-04 14:07:07 -07:00
transp_v6.h	…
tso.h	…
tun_proto.h	…
udp.h	udp: Remove unlikely() from IS_ERR*() condition	2019-08-30 19:49:37 -07:00
udp_tunnel.h	…
udplite.h	…
vsock_addr.h	vsock: remove include/linux/vm_sockets.h file	2019-11-14 18:12:17 -08:00
vxlan.h	vxlan: add adjacent link to limit depth level	2019-10-24 14:53:49 -07:00
wext.h	…
wimax.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268	2019-06-05 17:30:29 +02:00
x25.h	…
x25device.h	…
xdp.h	xdp: page_pool related fix to cpumap	2019-06-19 11:23:13 -04:00
xdp_priv.h	page_pool: do not release pool until inflight == 0.	2019-11-16 12:39:10 -08:00
xdp_sock.h	xsk: Restructure/inline XSKMAP lookup/redirect/flush	2019-11-02 00:38:49 +01:00
xfrm.h	xfrm: ifdef setsockopt(UDP_ENCAP_ESPINUDP/UDP_ENCAP_ESPINUDP_NON_IKE)	2019-10-09 06:55:32 +02:00