Syzbot found a kernel bug in the ipv6 stack: LINK: https://syzkaller.appspot.com/bug?id=205d6f11d72329ab8d62a610c44c5e7e25415580 The reproducer triggers it by sending an invalid message via sendmmsg() call, which triggers skb_over_panic, and crashes the kernel: skbuff: skb_over_panic: text:ffffffff84647fb4 len:65575 put:65575 head:ffff888109ff0000 data:ffff888109ff0088 tail:0x100af end:0xfec0 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! PREEMPT SMP KASAN CPU: 1 PID: 1818 Comm: repro Not tainted 5.17.0-rc7-dirty #9 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 RIP: 0010:skb_panic+0x173/0x175 RSP: 0018:ffffc900015bf3b8 EFLAGS: 00010282 RAX: 0000000000000090 RBX: ffff88810e848c80 RCX: 0000000000000000 RDX: ffff88810fd84300 RSI: ffffffff814fa5ef RDI: fffff520002b7e69 RBP: ffffc900015bf420 R08: 0000000000000090 R09: 0000000000000000 R10: ffffffff814f55f4 R11: 203a666675626b73 R12: ffffffff855bff80 R13: ffffffff84647fb4 R14: 0000000000010027 R15: ffffffff855bf420 FS: 0000000000c8b3c0(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000040 CR3: 0000000106b68000 CR4: 0000000000150ea0 Call Trace: <TASK> skb_put.cold+0x23/0x23 __ip6_append_data.isra.0.cold+0x396/0xe3a ip6_append_data+0x1e5/0x320 rawv6_sendmsg.cold+0x1618/0x2ba9 inet_sendmsg+0x9e/0xe0 sock_sendmsg+0xd7/0x130 ____sys_sendmsg+0x381/0x8a0 ___sys_sendmsg+0x100/0x170 __sys_sendmmsg+0x26c/0x3b7 __x64_sys_sendmmsg+0xb2/0xbd do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae The reproducer can be found here: LINK: https://syzkaller.appspot.com/text?tag=ReproC&x=1648c83fb00000 This can be fixed by increasing the alloclen in case it is smaller than fraglen in __ip6_append_data(). Cc: David S. Miller <davem@xxxxxxxxxxxxx> Cc: Hideaki YOSHIFUJI <yoshfuji@xxxxxxxxxxxxxx> Cc: David Ahern <dsahern@xxxxxxxxxx> Cc: Jakub Kicinski <kuba@xxxxxxxxxx> Cc: Alexei Starovoitov <ast@xxxxxxxxxx> Cc: Daniel Borkmann <daniel@xxxxxxxxxxxxx> Cc: Andrii Nakryiko <andrii@xxxxxxxxxx> Cc: Martin KaFai Lau <kafai@xxxxxx> Cc: Song Liu <songliubraving@xxxxxx> Cc: Yonghong Song <yhs@xxxxxx> Cc: John Fastabend <john.fastabend@xxxxxxxxx> Cc: KP Singh <kpsingh@xxxxxxxxxx> Cc: netdev@xxxxxxxxxxxxxxx Cc: bpf@xxxxxxxxxxxxxxx Cc: linux-kernel@xxxxxxxxxxxxxxx Cc: stable@xxxxxxxxxxxxxxx Reported-by: syzbot+e223cf47ec8ae183f2a0@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Tadeusz Struk <tadeusz.struk@xxxxxxxxxx> --- net/ipv6/ip6_output.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 4788f6b37053..622345af323e 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1629,6 +1629,13 @@ static int __ip6_append_data(struct sock *sk, err = -EINVAL; goto error; } + if (unlikely(alloclen < fraglen)) { + if (printk_ratelimit()) + pr_warn("%s: wrong alloclen: %d, fraglen: %d", + __func__, alloclen, fraglen); + alloclen = fraglen; + } + if (transhdrlen) { skb = sock_alloc_send_skb(sk, alloclen, (flags & MSG_DONTWAIT), &err); -- 2.35.1
