Vasily Averin e3c39d893b net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet ... commit 54970a2fbb673f090b7f02d7f57b10b2e0707155 upstream. syzbot reproduces BUG_ON in skb_checksum_help(): tun creates (bogus) skb with huge partial-checksummed area and small ip packet inside. Then ip_rcv trims the skb based on size of internal ip packet, after that csum offset points beyond of trimmed skb. Then checksum_tg() called via netfilter hook triggers BUG_ON: offset = skb_checksum_start_offset(skb); BUG_ON(offset >= skb_headlen(skb)); To work around the problem this patch forces pskb_trim_rcsum_slow() to return -EINVAL in described scenario. It allows its callers to drop such kind of packets. Link: https://syzkaller.appspot.com/bug?id=b419a5ca95062664fe1a60b764621eb4526e2cd0 Reported-by: syzbot+7010af67ced6105e5ab6@syzkaller.appspotmail.com Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Acked-by: Willem de Bruijn <willemb@google.com> Link: https://lore.kernel.org/r/1b2494af-2c56-8ee2-7bc0-923fcad1cdf8@virtuozzo.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-04-12 12:51:20 +08:00
..
Makefile	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
bpf_sk_storage.c	bpf: Switch bpf_map ref counter to atomic64_t so bpf_map_inc() never fails	2021-03-16 16:43:58 +08:00
datagram.c	net: use indirect call wrappers for skb_copy_datagram_iter()	2021-03-16 16:27:16 +08:00
datagram.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
dev.c	net: rps using pvipi	2021-03-19 08:24:58 +00:00
dev_addr_lists.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
dev_ioctl.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
devlink.c	devlink: Hold rtnl lock while reading netdev attributes	2021-03-16 16:41:51 +08:00
drop_monitor.c	drop_monitor: work around gcc-10 stringop-overflow warning	2021-03-16 16:27:46 +08:00
dst.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
dst_cache.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
ethtool.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
failover.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
fib_notifier.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
fib_rules.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
filter.c	merge bpf_jiffies64 api from 5576b991e9c1a11d2cc21c4b94fc75ec27603896	2021-03-16 16:43:59 +08:00
flow_dissector.c	flow_dissector: Drop BPF flow dissector prog ref on netns cleanup	2021-03-16 16:28:20 +08:00
flow_offload.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
gen_estimator.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
gen_stats.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
gro_cells.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
hwbm.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
link_watch.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
lwt_bpf.c	lwt: Disable BH too in run_lwt_bpf()	2021-03-16 16:43:20 +08:00
lwtunnel.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
neighbour.c	Exempt multicast addresses from five-second neighbor lifetime	2021-03-16 16:41:04 +08:00
net-procfs.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
net-sysfs.c	net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc	2021-04-12 12:51:08 +08:00
net-sysfs.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
net-traces.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
net_namespace.c	merge bpf_get_netns_cookie from f318903c0bf42448b4c884732df2bbb0ef7a2284.	2021-03-16 16:43:59 +08:00
netclassid_cgroup.c	cgroup, netclassid: remove double cond_resched	2021-03-16 16:27:30 +08:00
netevent.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
netpoll.c	net: Have netpoll bring-up DSA management interface	2021-03-16 16:41:06 +08:00
netprio_cgroup.c	netprio_cgroup: Fix unlimited memory leak of v2 cgroups	2021-03-16 16:27:49 +08:00
page_pool.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
pktgen.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
ptp_classifier.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
request_sock.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
rtnetlink.c	rtnetlink: Fix memory(net_device) leak when ->newlink fails	2021-03-16 16:32:42 +08:00
scm.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
secure_seq.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
skbuff.c	net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet	2021-04-12 12:51:20 +08:00
skmsg.c	bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self	2021-03-16 16:41:24 +08:00
sock.c	socket: don't clear SOCK_TSTAMP_NEW when SO_TIMESTAMPNS is disabled	2021-03-16 16:39:27 +08:00
sock_diag.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
sock_map.c	bpf: sockmap: Require attach_bpf_fd when detaching a program	2021-03-16 16:32:59 +08:00
sock_reuseport.c	udp: Copy has_conns in reuseport_grow().	2021-03-16 16:32:43 +08:00
stream.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
sysctl_net_core.c	bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()	2021-03-16 16:31:38 +08:00
timestamping.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
tso.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
utils.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
xdp.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00