• Eric Dumazet's avatar
    ipv6: make icmp6_send() robust against null skb->dev · 8d933670
    Eric Dumazet authored
    syzbot was able to crash one host with the following stack trace :
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] PREEMPT SMP KASAN
    CPU: 0 PID: 8625 Comm: syz-executor4 Not tainted 4.20.0+ #8
    RIP: 0010:dev_net include/linux/netdevice.h:2169 [inline]
    RIP: 0010:icmp6_send+0x116/0x2d30 net/ipv6/icmp.c:426
    This is because a RX packet found socket owned by user and
    was stored into socket backlog. Before leaving RCU protected section,
    skb->dev was cleared in __sk_receive_skb(). When socket backlog
    was finally handled at release_sock() time, skb was fed to
    smack_socket_sock_rcv_skb() then icmp6_send()
    We could fix the bug in smack_socket_sock_rcv_skb(), or simply
    make icmp6_send() more robust against such possibility.
    In the future we might provide to icmp6_send() the net pointer
    instead of infering it.
    Fixes: d66a8acb ("Smack: Inform peer that IPv6 traffic has been blocked")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Cc: Piotr Sawicki <p.sawicki2@partner.samsung.com>
    Cc: Casey Schaufler <casey@schaufler-ca.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
icmp.c 26.3 KB