Mohamed Khalfella 2ea35288c8 skbuff: skb_segment, Call zero copy functions before using skbuff frags ... Commit bf5c25d608 ("skbuff: in skb_segment, call zerocopy functions once per nskb") added the call to zero copy functions in skb_segment(). The change introduced a bug in skb_segment() because skb_orphan_frags() may possibly change the number of fragments or allocate new fragments altogether leaving nrfrags and frag to point to the old values. This can cause a panic with stacktrace like the one below. [ 193.894380] BUG: kernel NULL pointer dereference, address: 00000000000000bc [ 193.895273] CPU: 13 PID: 18164 Comm: vh-net-17428 Kdump: loaded Tainted: G O 5.15.123+ #26 [ 193.903919] RIP: 0010:skb_segment+0xb0e/0x12f0 [ 194.021892] Call Trace: [ 194.027422] <TASK> [ 194.072861] tcp_gso_segment+0x107/0x540 [ 194.082031] inet_gso_segment+0x15c/0x3d0 [ 194.090783] skb_mac_gso_segment+0x9f/0x110 [ 194.095016] __skb_gso_segment+0xc1/0x190 [ 194.103131] netem_enqueue+0x290/0xb10 [sch_netem] [ 194.107071] dev_qdisc_enqueue+0x16/0x70 [ 194.110884] __dev_queue_xmit+0x63b/0xb30 [ 194.121670] bond_start_xmit+0x159/0x380 [bonding] [ 194.128506] dev_hard_start_xmit+0xc3/0x1e0 [ 194.131787] __dev_queue_xmit+0x8a0/0xb30 [ 194.138225] macvlan_start_xmit+0x4f/0x100 [macvlan] [ 194.141477] dev_hard_start_xmit+0xc3/0x1e0 [ 194.144622] sch_direct_xmit+0xe3/0x280 [ 194.147748] __dev_queue_xmit+0x54a/0xb30 [ 194.154131] tap_get_user+0x2a8/0x9c0 [tap] [ 194.157358] tap_sendmsg+0x52/0x8e0 [tap] [ 194.167049] handle_tx_zerocopy+0x14e/0x4c0 [vhost_net] [ 194.173631] handle_tx+0xcd/0xe0 [vhost_net] [ 194.176959] vhost_worker+0x76/0xb0 [vhost] [ 194.183667] kthread+0x118/0x140 [ 194.190358] ret_from_fork+0x1f/0x30 [ 194.193670] </TASK> In this case calling skb_orphan_frags() updated nr_frags leaving nrfrags local variable in skb_segment() stale. This resulted in the code hitting i >= nrfrags prematurely and trying to move to next frag_skb using list_skb pointer, which was NULL, and caused kernel panic. Move the call to zero copy functions before using frags and nr_frags. Fixes: bf5c25d608 ("skbuff: in skb_segment, call zerocopy functions once per nskb") Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com> Reported-by: Amit Goyal <agoyal@purestorage.com> Cc: stable@vger.kernel.org Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2023-09-01 08:09:07 +01:00
..
bpf_sk_storage.c	bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing	2023-07-27 10:07:56 -07:00
datagram.c	net: datagram: fix data-races in datagram_poll()	2023-05-10 19:06:49 -07:00
dev_addr_lists_test.c	kunit: Use KUNIT_EXPECT_MEMEQ macro	2022-10-27 02:40:14 -06:00
dev_addr_lists.c	net: extract a few internals from netdevice.h	2022-04-07 20:32:09 -07:00
dev_ioctl.c	net: omit ndo_hwtstamp_get() call when possible in dev_set_hwtstamp_phylib()	2023-08-06 13:25:10 +01:00
dev.c	net: Make consumed action consistent in sch_handle_egress	2023-08-28 10:18:03 +01:00
dev.h	net-sysctl: factor-out rpm mask manipulation helpers	2023-02-09 17:45:55 -08:00
drop_monitor.c	net: extend drop reasons for multiple subsystems	2023-04-20 20:20:49 -07:00
dst_cache.c	wireguard: device: reset peer src endpoint when netns exits	2021-11-29 19:50:45 -08:00
dst.c	net: remove unnecessary input parameter 'how' in ifdown function	2023-08-22 13:19:02 +02:00
failover.c	net: failover: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf	2022-12-12 15:18:25 -08:00
fib_notifier.c
fib_rules.c	fib: expand fib_rule_policy	2021-12-16 07:18:35 -08:00
filter.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-10 14:10:53 -07:00
flow_dissector.c	net: flow_dissector: Add IPSEC dissector	2023-08-02 10:09:31 +01:00
flow_offload.c	tc: flower: Enable offload support IPSEC SPI field.	2023-08-02 10:09:32 +01:00
gen_estimator.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
gen_stats.c	net: Remove the obsolte u64_stats_fetch_*_irq() users (net).	2022-10-28 20:13:54 -07:00
gro_cells.c	net: drop the weight argument from netif_napi_add	2022-09-28 18:57:14 -07:00
gro.c	gro: move the tc_ext comparison to a helper	2023-06-18 18:08:35 +01:00
gso.c	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
hwbm.c
link_watch.c	net: linkwatch: only report IF_OPER_LOWERLAYERDOWN if iflink is actually down	2022-11-16 09:45:00 +00:00
lwt_bpf.c	lwt: Fix return values of BPF xmit ops	2023-08-18 16:05:26 +02:00
lwtunnel.c	xfrm: lwtunnel: squelch kernel warning in case XFRM encap type is not available	2022-10-12 10:45:51 +02:00
Makefile	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
neighbour.c	neighbour: switch to standard rcu, instead of rcu_bh	2023-03-21 21:32:18 -07:00
net_namespace.c	lib/ref_tracker: improve printing stats	2023-06-05 15:28:42 -07:00
net-procfs.c	net-sysfs: display two backlog queue len separately	2023-03-22 12:03:52 +01:00
net-sysfs.c	net: move struct netdev_rx_queue out of netdevice.h	2023-08-03 08:38:07 -07:00
net-sysfs.h
net-traces.c	udp6: add a missing call into udp_fail_queue_rcv_skb tracepoint	2023-07-07 09:16:52 +01:00
netclassid_cgroup.c	core: Variable type completion	2022-08-31 09:40:34 +01:00
netdev-genl-gen.c	net: ynl: prefix uAPI header include with uapi/	2023-05-26 10:30:14 +01:00
netdev-genl-gen.h	net: ynl: prefix uAPI header include with uapi/	2023-05-26 10:30:14 +01:00
netdev-genl.c	netdev-genl: use struct genl_info for reply construction	2023-08-15 15:01:03 -07:00
netevent.c	net: core: Correct function name netevent_unregister_notifier() in the kerneldoc	2021-03-28 17:56:56 -07:00
netpoll.c	netpoll: allocate netdev tracker right away	2023-06-15 08:21:11 +01:00
netprio_cgroup.c	bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode	2021-09-13 16:35:58 -07:00
of_net.c	net: Explicitly include correct DT includes	2023-07-27 20:33:16 -07:00
page_pool.c	page_pool: add a lockdep check for recycling in hardirq	2023-08-07 13:05:53 -07:00
pktgen.c	net: introduce and use skb_frag_fill_page_desc()	2023-05-13 19:47:56 +01:00
ptp_classifier.c	ptp: Add generic PTP is_sync() function	2022-03-07 11:31:34 +00:00
request_sock.c
rtnetlink.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-24 10:51:39 -07:00
scm.c	net: annotate data-races around sock->ops	2023-08-09 15:32:43 -07:00
secure_seq.c	tcp: Fix data-races around sysctl knobs related to SYN option.	2022-07-20 10:14:49 +01:00
selftests.c	net: core: constify mac addrs in selftests	2021-10-24 13:59:44 +01:00
skbuff.c	skbuff: skb_segment, Call zero copy functions before using skbuff frags	2023-09-01 08:09:07 +01:00
skmsg.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-10 14:10:53 -07:00
sock_destructor.h	skb_expand_head() adjust skb->truesize incorrectly	2021-10-22 12:35:51 -07:00
sock_diag.c	net: fix __sock_gen_cookie()	2022-11-21 20:36:30 -08:00
sock_map.c	bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t	2023-08-30 09:58:42 +02:00
sock_reuseport.c	soreuseport: Fix socket selection for SO_INCOMING_CPU.	2022-10-25 11:35:16 +02:00
sock.c	net: annotate data-races around sk->sk_bind_phc	2023-09-01 07:27:33 +01:00
stream.c	net: deal with most data-races in sk_wait_event()	2023-05-10 10:03:32 +01:00
sysctl_net_core.c	net/sysctl: Rename kvfree_rcu() to kvfree_rcu_mightsleep()	2023-04-05 13:48:04 +00:00
timestamping.c
tso.c	net: tso: inline tso_count_descs()	2022-12-12 15:04:39 -08:00
utils.c	net: core: inet[46]_pton strlen len types	2022-11-01 21:14:39 -07:00
xdp.c	page_pool: split types and declarations from page_pool.h	2023-08-07 13:05:19 -07:00