Nikolay Aleksandrov 37a04788c5 wireguard: device: check for metadata_dst with skb_valid_dst() ... [ Upstream commit 45ac774c33 ] When we try to transmit an skb with md_dst attached through wireguard we hit a null pointer dereference in wg_xmit() due to the use of dst_mtu() which calls into dst_blackhole_mtu() which in turn tries to dereference dst->dev. Since wireguard doesn't use md_dsts we should use skb_valid_dst(), which checks for DST_METADATA flag, and if it's set, then falls back to wireguard's device mtu. That gives us the best chance of transmitting the packet; otherwise if the blackhole netdev is used we'd get ETH_MIN_MTU. [ 263.693506] BUG: kernel NULL pointer dereference, address: 00000000000000e0 [ 263.693908] #PF: supervisor read access in kernel mode [ 263.694174] #PF: error_code(0x0000) - not-present page [ 263.694424] PGD 0 P4D 0 [ 263.694653] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 263.694876] CPU: 5 PID: 951 Comm: mausezahn Kdump: loaded Not tainted 5.18.0-rc1+ #522 [ 263.695190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014 [ 263.695529] RIP: 0010:dst_blackhole_mtu+0x17/0x20 [ 263.695770] Code: 00 00 00 0f 1f 44 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8b 47 10 48 83 e0 fc 8b 40 04 85 c0 75 09 48 8b 07 <8b> 80 e0 00 00 00 c3 66 90 0f 1f 44 00 00 48 89 d7 be 01 00 00 00 [ 263.696339] RSP: 0018:ffffa4a4422fbb28 EFLAGS: 00010246 [ 263.696600] RAX: 0000000000000000 RBX: ffff8ac9c3553000 RCX: 0000000000000000 [ 263.696891] RDX: 0000000000000401 RSI: 00000000fffffe01 RDI: ffffc4a43fb48900 [ 263.697178] RBP: ffffa4a4422fbb90 R08: ffffffff9622635e R09: 0000000000000002 [ 263.697469] R10: ffffffff9b69a6c0 R11: ffffa4a4422fbd0c R12: ffff8ac9d18b1a00 [ 263.697766] R13: ffff8ac9d0ce1840 R14: ffff8ac9d18b1a00 R15: ffff8ac9c3553000 [ 263.698054] FS: 00007f3704c337c0(0000) GS:ffff8acaebf40000(0000) knlGS:0000000000000000 [ 263.698470] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 263.698826] CR2: 00000000000000e0 CR3: 0000000117a5c000 CR4: 00000000000006e0 [ 263.699214] Call Trace: [ 263.699505] <TASK> [ 263.699759] wg_xmit+0x411/0x450 [ 263.700059] ? bpf_skb_set_tunnel_key+0x46/0x2d0 [ 263.700382] ? dev_queue_xmit_nit+0x31/0x2b0 [ 263.700719] dev_hard_start_xmit+0xd9/0x220 [ 263.701047] __dev_queue_xmit+0x8b9/0xd30 [ 263.701344] __bpf_redirect+0x1a4/0x380 [ 263.701664] __dev_queue_xmit+0x83b/0xd30 [ 263.701961] ? packet_parse_headers+0xb4/0xf0 [ 263.702275] packet_sendmsg+0x9a8/0x16a0 [ 263.702596] ? _raw_spin_unlock_irqrestore+0x23/0x40 [ 263.702933] sock_sendmsg+0x5e/0x60 [ 263.703239] __sys_sendto+0xf0/0x160 [ 263.703549] __x64_sys_sendto+0x20/0x30 [ 263.703853] do_syscall_64+0x3b/0x90 [ 263.704162] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 263.704494] RIP: 0033:0x7f3704d50506 [ 263.704789] Code: 48 c7 c0 ff ff ff ff eb b7 66 2e 0f 1f 84 00 00 00 00 00 90 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 72 c3 90 55 48 83 ec 30 44 89 4c 24 2c 4c 89 [ 263.705652] RSP: 002b:00007ffe954b0b88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 263.706141] RAX: ffffffffffffffda RBX: 0000558bb259b490 RCX: 00007f3704d50506 [ 263.706544] RDX: 000000000000004a RSI: 0000558bb259b7b2 RDI: 0000000000000003 [ 263.706952] RBP: 0000000000000000 R08: 00007ffe954b0b90 R09: 0000000000000014 [ 263.707339] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe954b0b90 [ 263.707735] R13: 000000000000004a R14: 0000558bb259b7b2 R15: 0000000000000001 [ 263.708132] </TASK> [ 263.708398] Modules linked in: bridge netconsole bonding [last unloaded: bridge] [ 263.708942] CR2: 00000000000000e0 Fixes: e7096c131e ("net: WireGuard secure network tunnel") Link: https://github.com/cilium/cilium/issues/19428 Reported-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-05-09 09:14:35 +02:00
..
selftest	wireguard: allowedips: free empty intermediate nodes when removing single node	2021-06-04 14:25:14 -07:00
Makefile	wireguard: do not use -O3	2021-06-04 14:25:14 -07:00
allowedips.c	wireguard: allowedips: add missing __rcu annotation to satisfy sparse	2021-12-08 09:04:45 +01:00
allowedips.h	wireguard: allowedips: free empty intermediate nodes when removing single node	2021-06-04 14:25:14 -07:00
cookie.c	…
cookie.h	…
device.c	wireguard: device: check for metadata_dst with skb_valid_dst()	2022-05-09 09:14:35 +02:00
device.h	wireguard: receive: use ring buffer for incoming handshakes	2021-12-08 09:04:46 +01:00
main.c	wireguard: allowedips: allocate nodes in kmem_cache	2021-06-04 14:25:14 -07:00
messages.h	wireguard: queueing: preserve flow hash across packet scrubbing	2020-05-20 20:55:09 -07:00
netlink.c	netlink: consistently use NLA_POLICY_MIN_LEN()	2020-08-18 12:28:45 -07:00
netlink.h	…
noise.c	wireguard: noise: take lock when removing handshake entry from table	2020-09-09 11:31:37 -07:00
noise.h	wireguard: noise: separate receive counter from send counter	2020-05-20 20:55:09 -07:00
peer.c	wireguard: peer: allocate in kmem_cache	2021-06-04 14:25:14 -07:00
peer.h	wireguard: peer: allocate in kmem_cache	2021-06-04 14:25:14 -07:00
peerlookup.c	wireguard: peerlookup: take lock before checking hash in replace operation	2020-09-09 11:31:38 -07:00
peerlookup.h	…
queueing.c	wireguard: queueing: use CFI-safe ptr_ring cleanup function	2022-04-08 14:24:09 +02:00
queueing.h	wireguard: receive: use ring buffer for incoming handshakes	2021-12-08 09:04:46 +01:00
ratelimiter.c	wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()	2021-12-08 09:04:46 +01:00
ratelimiter.h	…
receive.c	wireguard: receive: drop handshakes if queue lock is contended	2021-12-08 09:04:46 +01:00
send.c	wireguard: queueing: get rid of per-peer ring buffers	2021-02-23 15:59:34 -08:00
socket.c	wireguard: socket: ignore v6 endpoints when ipv6 is disabled	2022-04-08 14:24:09 +02:00
socket.h	…
timers.c	…
timers.h	…
version.h	…