Skip to contentSkip to conversation

xfrm: fix xfrm_input/xfrm_tunnel_check oops

PATCH Applied Alexey Dobriyan 3 participants 5 messages Apr 2, 2015 – Apr 7, 2015

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Alexey Dobriyan

author
#0 lore raw

PATCH 1/1 xfrm: fix xfrm_input/xfrm_tunnel_check oops

https://bugzilla.kernel.org/show_bug.cgi?id=95211

Commit 70be6c91c86596ad2b60c73587880b47df170a41
("xfrm: Add xfrm_tunnel_skb_cb to the skb common buffer") added check which dereferences ->outer_mode too early but larval SAs don't have this pointer set (yet). So check for tunnel stuff later.

Mike Noordermeer reported this bug and patiently applied all the debugging.

Technically this is remote-oops-in-interrupt-context type of thing.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000034
IP: [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0
	...
[<ffffffff81500fc6>] ? xfrm4_esp_rcv+0x36/0x70
[<ffffffff814acc9a>] ? ip_local_deliver_finish+0x9a/0x200
[<ffffffff81471b83>] ? __netif_receive_skb_core+0x6f3/0x8f0
	...

RIP [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0

Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by Alexey Dobriyan <[email protected]>

---

Patch is in final testing, I'm sending it opportunistically. Mike, please chim in if this patch didn't help in the end!

 net/xfrm/xfrm_input.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
net/xfrm/xfrm_input.c +5 -5
@@ -238,11 +238,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
 		skb->sp->xvec[skb->sp->len++] = x;
 
-		if (xfrm_tunnel_check(skb, x, family)) {
-			XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
-			goto drop;
-		}
-
 		spin_lock(&x->lock);
 		if (unlikely(x->km.state == XFRM_STATE_ACQ)) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);

@@ -271,6 +266,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
 		spin_unlock(&x->lock);
 
+		if (xfrm_tunnel_check(skb, x, family)) {
+			XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
+			goto drop;
+		}
+
 		seq_hi = htonl(xfrm_replay_seqhi(x, seq));
 
 		XFRM_SKB_CB(skb)->seq.input.low = seq;
maintainer Applied
#1 lore raw
Quoted 19 lines · Alexey Dobriyan

https://bugzilla.kernel.org/show_bug.cgi?id=95211

Commit 70be6c91c86596ad2b60c73587880b47df170a41
("xfrm: Add xfrm_tunnel_skb_cb to the skb common buffer") added check which dereferences ->outer_mode too early but larval SAs don't have this pointer set (yet). So check for tunnel stuff later.

Mike Noordermeer reported this bug and patiently applied all the debugging.

Technically this is remote-oops-in-interrupt-context type of thing.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000034
IP: [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0
	...
[<ffffffff81500fc6>] ? xfrm4_esp_rcv+0x36/0x70
[<ffffffff814acc9a>] ? ip_local_deliver_finish+0x9a/0x200
[<ffffffff81471b83>] ? __netif_receive_skb_core+0x6f3/0x8f0
	...
Quoted 4 lines

RIP [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0

Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by Alexey Dobriyan <[email protected]>

Good catch!

Applied to the ipsec tree, thanks everyone!

author
#2 lore raw
Quoted 20 lines · Steffen Klassert
Quoted 19 lines · Alexey Dobriyan

https://bugzilla.kernel.org/show_bug.cgi?id=95211

Commit 70be6c91c86596ad2b60c73587880b47df170a41
("xfrm: Add xfrm_tunnel_skb_cb to the skb common buffer") added check which dereferences ->outer_mode too early but larval SAs don't have this pointer set (yet). So check for tunnel stuff later.

Mike Noordermeer reported this bug and patiently applied all the debugging.

Technically this is remote-oops-in-interrupt-context type of thing.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000034
IP: [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0
	...
[<ffffffff81500fc6>] ? xfrm4_esp_rcv+0x36/0x70
[<ffffffff814acc9a>] ? ip_local_deliver_finish+0x9a/0x200
[<ffffffff81471b83>] ? __netif_receive_skb_core+0x6f3/0x8f0
	...
Quoted 8 lines
Quoted 4 lines

RIP [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0

Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by Alexey Dobriyan <[email protected]>

Good catch!

Applied to the ipsec tree, thanks everyone!

For the record Mike confirmed that the patch works:
https://bugzilla.kernel.org/show_bug.cgi?id=95211#c20

#3 lore raw
Quoted 24 lines · Alexey Dobriyan
Quoted 23 lines · Steffen Klassert
Quoted 22 lines · Alexey Dobriyan

https://bugzilla.kernel.org/show_bug.cgi?id=95211

Commit 70be6c91c86596ad2b60c73587880b47df170a41
("xfrm: Add xfrm_tunnel_skb_cb to the skb common buffer") added check which dereferences ->outer_mode too early but larval SAs don't have this pointer set (yet). So check for tunnel stuff later.

Mike Noordermeer reported this bug and patiently applied all the debugging.

Technically this is remote-oops-in-interrupt-context type of thing.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000034
IP: [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0
	...
[<ffffffff81500fc6>] ? xfrm4_esp_rcv+0x36/0x70
[<ffffffff814acc9a>] ? ip_local_deliver_finish+0x9a/0x200
[<ffffffff81471b83>] ? __netif_receive_skb_core+0x6f3/0x8f0
	...

RIP [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0

Kernel panic - not syncing: Fatal exception in interrupt
Quoted 8 lines
Quoted 5 lines
Quoted 1 line
Signed-off-by Alexey Dobriyan <[email protected]>

Good catch!

Applied to the ipsec tree, thanks everyone!

For the record Mike confirmed that the patch works:
https://bugzilla.kernel.org/show_bug.cgi?id=95211#c20

Does this only affect configurations that use VTI? It's not clear from the description.

Thanks.

maintainer
#4 lore raw
Quoted 29 lines · Romain Francoise
Quoted 28 lines · Alexey Dobriyan
Quoted 27 lines · Steffen Klassert
Quoted 19 lines · Alexey Dobriyan

https://bugzilla.kernel.org/show_bug.cgi?id=95211

Commit 70be6c91c86596ad2b60c73587880b47df170a41
("xfrm: Add xfrm_tunnel_skb_cb to the skb common buffer") added check which dereferences ->outer_mode too early but larval SAs don't have this pointer set (yet). So check for tunnel stuff later.

Mike Noordermeer reported this bug and patiently applied all the debugging.

Technically this is remote-oops-in-interrupt-context type of thing.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000034
IP: [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0
	...
[<ffffffff81500fc6>] ? xfrm4_esp_rcv+0x36/0x70
[<ffffffff814acc9a>] ? ip_local_deliver_finish+0x9a/0x200
[<ffffffff81471b83>] ? __netif_receive_skb_core+0x6f3/0x8f0
	...
Quoted 4 lines

RIP [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0

Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by Alexey Dobriyan <[email protected]>

Good catch!

Quoted 7 lines
Quoted 4 lines
Quoted 1 line

Applied to the ipsec tree, thanks everyone!

For the record Mike confirmed that the patch works:
https://bugzilla.kernel.org/show_bug.cgi?id=95211#c20

Does this only affect configurations that use VTI? It's not clear from the description.

xfrm_tunnel_check() dereferences outer_mode only if it finds a tunnel pointer, so it affects only vti SAs.