Eric Dumazet 8e50ed7745 erspan: do not use skb_mac_header() in ndo_start_xmit() ... Drivers should not assume skb_mac_header(skb) == skb->data in their ndo_start_xmit(). Use skb_network_offset() and skb_transport_offset() which better describe what is needed in erspan_fb_xmit() and ip6erspan_tunnel_xmit() syzbot reported: WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline] WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 Modules linked in: CPU: 0 PID: 5083 Comm: syz-executor406 Not tainted 6.3.0-rc2-syzkaller-00866-gd4671cb96fa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 RIP: 0010:skb_mac_header include/linux/skbuff.h:2873 [inline] RIP: 0010:ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 Code: 04 02 41 01 de 84 c0 74 08 3c 03 0f 8e 1c 0a 00 00 45 89 b4 24 c8 00 00 00 c6 85 77 fe ff ff 01 e9 33 e7 ff ff e8 b4 27 a1 f8 <0f> 0b e9 b6 e7 ff ff e8 a8 27 a1 f8 49 8d bf f0 0c 00 00 48 b8 00 RSP: 0018:ffffc90003b2f830 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 RDX: ffff888021273a80 RSI: ffffffff88e1bd4c RDI: 0000000000000003 RBP: ffffc90003b2f9d8 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: ffff88802b28da00 R13: 00000000000000d0 R14: ffff88807e25b6d0 R15: ffff888023408000 FS: 0000555556a61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e5b11eb6e8 CR3: 0000000027c1b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __netdev_start_xmit include/linux/netdevice.h:4900 [inline] netdev_start_xmit include/linux/netdevice.h:4914 [inline] __dev_direct_xmit+0x504/0x730 net/core/dev.c:4300 dev_direct_xmit include/linux/netdevice.h:3088 [inline] packet_xmit+0x20a/0x390 net/packet/af_packet.c:285 packet_snd net/packet/af_packet.c:3075 [inline] packet_sendmsg+0x31a0/0x5150 net/packet/af_packet.c:3107 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0xde/0x190 net/socket.c:747 __sys_sendto+0x23a/0x340 net/socket.c:2142 __do_sys_sendto net/socket.c:2154 [inline] __se_sys_sendto net/socket.c:2150 [inline] __x64_sys_sendto+0xe1/0x1b0 net/socket.c:2150 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f123aaa1039 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc15d12058 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f123aaa1039 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000020000040 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f123aa648c0 R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 Fixes: 1baf5ebf89 ("erspan: auto detect truncated packets.") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Link: https://lore.kernel.org/r/20230320163427.8096-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2023-03-21 21:16:26 -07:00
..
ila	ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()	2023-03-01 08:48:46 +00:00
netfilter	netfilter: tproxy: fix deadlock due to missing BH disable	2023-03-06 12:09:48 +01:00
Kconfig	…
Makefile	…
addrconf.c	ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link local address	2023-02-01 19:52:22 -08:00
addrconf_core.c	…
addrlabel.c	ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network	2022-11-07 12:26:15 +00:00
af_inet6.c	net: no longer support SOCK_REFCNT_DEBUG feature	2023-02-15 10:25:21 +00:00
ah6.c	net: ipv6: Remove completion function scaffolding	2023-02-13 18:35:15 +08:00
anycast.c	…
calipso.c	…
datagram.c	ipv6: Fix datagram socket connection with DSCP.	2023-02-09 22:49:04 -08:00
esp6.c	net: ipv6: Remove completion function scaffolding	2023-02-13 18:35:15 +08:00
esp6_offload.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2022-11-29 20:50:51 -08:00
exthdrs.c	…
exthdrs_core.c	…
exthdrs_offload.c	…
fib6_notifier.c	…
fib6_rules.c	…
fou6.c	…
icmp.c	ipv6: icmp6: add drop reason support to icmpv6_echo_reply()	2023-02-20 08:54:23 +00:00
inet6_connection_sock.c	…
inet6_hashtables.c	tcp: Access &tcp_hashinfo via net.	2022-09-20 10:21:49 -07:00
ioam6.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
ioam6_iptunnel.c	…
ip6_checksum.c	…
ip6_fib.c	ipv6: fib6_new_sernum() optimization	2022-11-16 12:42:00 +00:00
ip6_flowlabel.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
ip6_gre.c	erspan: do not use skb_mac_header() in ndo_start_xmit()	2023-03-21 21:16:26 -07:00
ip6_icmp.c	…
ip6_input.c	…
ip6_offload.c	IPv6/GRO: generic helper to remove temporary HBH/jumbo header in driver	2022-12-12 15:41:44 -08:00
ip6_offload.h	…
ip6_output.c	ipv6: fix reachability confirmation with proxy_ndp	2023-01-23 11:17:37 +00:00
ip6_tunnel.c	net: tunnels: annotate lockless accesses to dev->needed_headroom	2023-03-15 00:04:04 -07:00
ip6_udp_tunnel.c	…
ip6_vti.c	ipv6: tunnels: use DEV_STATS_INC()	2022-11-16 12:48:44 +00:00
ip6mr.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
ipcomp6.c	xfrm: ipcomp: add extack to ipcomp{4,6}_init_state	2022-09-29 07:18:00 +02:00
ipv6_sockglue.c	net: no longer support SOCK_REFCNT_DEBUG feature	2023-02-15 10:25:21 +00:00
mcast.c	treewide: use get_random_u32_below() instead of deprecated function	2022-11-18 02:15:15 +01:00
mcast_snoop.c	…
mip6.c	xfrm: mip6: add extack to mip6_destopt_init_state, mip6_rthdr_init_state	2022-09-29 07:18:01 +02:00
ndisc.c	ipv6: icmp6: add SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST	2023-02-20 08:54:23 +00:00
netfilter.c	…
output_core.c	treewide: use get_random_u32_{above,below}() instead of manual loop	2022-11-18 02:15:22 +01:00
ping.c	inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().	2022-10-24 09:40:38 +01:00
proc.c	icmp: Add counters for rate limits	2023-01-26 10:52:18 +01:00
protocol.c	…
raw.c	raw: use net_hash_mix() in hash function	2023-02-03 19:56:23 -08:00
reassembly.c	net: dropreason: add SKB_DROP_REASON_DUP_FRAG	2022-10-31 20:14:26 -07:00
route.c	ipv6: Add lwtunnel encap size of all siblings in nexthop calculation	2023-02-23 10:54:13 +01:00
rpl.c	…
rpl_iptunnel.c	net: ipv6: rpl_iptunnel: Replace 0-length arrays with flexible arrays	2023-01-06 19:28:01 -08:00
seg6.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-09-08 18:38:30 +02:00
seg6_hmac.c	…
seg6_iptunnel.c	…
seg6_local.c	seg6: add PSP flavor support for SRv6 End behavior	2023-02-16 13:18:06 +01:00
sit.c	ipv6/sit: use DEV_STATS_INC() to avoid data-races	2022-11-16 12:48:44 +00:00
syncookies.c	…
sysctl_net_ipv6.c	…
tcp_ipv6.c	Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net	2023-02-17 11:06:39 +00:00
tcpv6_offload.c	…
tunnel6.c	…
udp.c	udp: Access &udp_table via net.	2022-11-16 09:43:35 +00:00
udp_impl.h	tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().	2022-10-12 17:50:37 -07:00
udp_offload.c	udp: allow header check for dodgy GSO_UDP_L4 packets.	2022-12-12 09:29:56 +00:00
udplite.c	tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().	2022-10-12 17:50:37 -07:00
xfrm6_input.c	…
xfrm6_output.c	…
xfrm6_policy.c	xfrm: Fix ignored return value in xfrm6_init()	2022-11-22 07:16:34 +01:00
xfrm6_protocol.c	…
xfrm6_state.c	…
xfrm6_tunnel.c	xfrm: tunnel: add extack to ipip_init_state, xfrm6_tunnel_init_state	2022-09-29 07:18:00 +02:00