Commit 64953cd0 authored by Felix Fietkau's avatar Felix Fietkau Committed by Ziyang Xuan
Browse files

net: core: reject skb_copy(_expand) for fraglist GSO skbs 

stable inclusion
from stable-v5.10.217
commit faa83a7797f06cefed86731ba4baa3b4dfdc06c1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U9P7
CVE: CVE-2024-36929

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=faa83a7797f06cefed86731ba4baa3b4dfdc06c1



--------------------------------

[ Upstream commit d091e579b864fa790dd6a0cd537a22c383126681 ]

SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become
invalid. Return NULL if such an skb is passed to skb_copy or
skb_copy_expand, in order to prevent a crash on a potential later
call to skb_gso_segment.

Fixes: 3a1296a3 ("net: Support GRO/GSO fraglist chaining.")
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
parent c6a9bc2d

net/core/skbuff.c

+19 −8
Original line number Diff line number Diff line
@@ -1534,11 +1534,17 @@ static inline int skb_alloc_rx_flag(const struct sk_buff *skb) 


struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)

{

	int headerlen = skb_headroom(skb);

	unsigned int size = skb_end_offset(skb) + skb->data_len;

	struct sk_buff *n = __alloc_skb(size, gfp_mask,

					skb_alloc_rx_flag(skb), NUMA_NO_NODE);

	struct sk_buff *n;

	unsigned int size;

	int headerlen;



	if (WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST))

		return NULL;



	headerlen = skb_headroom(skb);

	size = skb_end_offset(skb) + skb->data_len;

	n = __alloc_skb(size, gfp_mask,

			skb_alloc_rx_flag(skb), NUMA_NO_NODE);

	if (!n)

		return NULL;
@@ -1799,12 +1805,17 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb, 
	/*

	 *	Allocate the copy buffer

	 */

	struct sk_buff *n = __alloc_skb(newheadroom + skb->len + newtailroom,

					gfp_mask, skb_alloc_rx_flag(skb),

					NUMA_NO_NODE);

	int oldheadroom = skb_headroom(skb);

	int head_copy_len, head_copy_off;

	struct sk_buff *n;

	int oldheadroom;



	if (WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST))

		return NULL;



	oldheadroom = skb_headroom(skb);

	n = __alloc_skb(newheadroom + skb->len + newtailroom,

			gfp_mask, skb_alloc_rx_flag(skb),

			NUMA_NO_NODE);

	if (!n)

		return NULL;