Taehee Yoo 67a9c94317 net: validate lwtstate->data before returning from skb_tunnel_info()
skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info
type without validation. lwtstate->data can have various types such as
mpls_iptunnel_encap, etc and these are not compatible.
So skb_tunnel_info() should validate before returning that pointer.

Splat looks like:
BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan]
Read of size 2 at addr ffff888106ec2698 by task ping/811

CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195
Call Trace:
 dump_stack_lvl+0x56/0x7b
 print_address_description.constprop.8.cold.13+0x13/0x2ee
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 kasan_report.cold.14+0x83/0xdf
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 vxlan_get_route+0x418/0x4b0 [vxlan]
 [ ... ]
 vxlan_xmit_one+0x148b/0x32b0 [vxlan]
 [ ... ]
 vxlan_xmit+0x25c5/0x4780 [vxlan]
 [ ... ]
 dev_hard_start_xmit+0x1ae/0x6e0
 __dev_queue_xmit+0x1f39/0x31a0
 [ ... ]
 neigh_xmit+0x2f9/0x940
 mpls_xmit+0x911/0x1600 [mpls_iptunnel]
 lwtunnel_xmit+0x18f/0x450
 ip_finish_output2+0x867/0x2040
 [ ... ]

Fixes: 61adedf3e3f1 ("route: move lwtunnel state to dst_entry")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-07-09 13:55:53 -07:00
..
2021-07-01 13:19:48 -07:00
2021-06-11 13:32:46 -07:00
2019-01-23 11:18:00 -08:00
2021-06-28 13:06:12 -07:00
2020-05-05 13:23:29 -07:00
2021-04-19 12:25:11 +02:00
2019-12-09 10:36:44 -08:00
2020-06-22 21:12:44 -07:00
2021-03-30 13:29:39 -07:00
2018-09-13 09:04:58 -07:00
2019-12-09 10:36:44 -08:00
2020-03-04 13:25:55 -08:00
2021-05-17 15:29:35 -07:00
2018-05-16 07:23:35 +02:00
2019-04-22 21:47:25 -07:00
2019-10-05 16:29:00 -07:00
2021-06-29 11:28:21 -07:00
2020-06-18 20:46:23 -07:00
2019-12-09 10:28:43 -08:00