【openEuler20.03】IPvlan模块skb->mac_header访问越界

==================================================================
BUG: KASAN: use-after-free in ether_addr_equal include/linux/etherdevice.h:329 [inline]
BUG: KASAN: use-after-free in ipvlan_xmit_mode_l2+0xd8/0x340 drivers/net/ipvlan/ipvlan_core.c:715
Read of size 4 at addr ffff4f2d954b19ff by task syz-executor.2/31195

CPU: 3 PID: 31195 Comm: syz-executor.2 Not tainted 5.10.0 #7
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132
show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b4/0x248 lib/dump_stack.c:118
print_address_description.constprop.0+0x28/0x48c mm/kasan/report.c:387
__kasan_report mm/kasan/report.c:547 [inline]
kasan_report+0x118/0x210 mm/kasan/report.c:564
check_memory_region_inline mm/kasan/generic.c:187 [inline]
__asan_load4+0x98/0xc0 mm/kasan/generic.c:252
ether_addr_equal include/linux/etherdevice.h:329 [inline]
ipvlan_xmit_mode_l2+0xd8/0x340 drivers/net/ipvlan/ipvlan_core.c:715
ipvlan_queue_xmit+0x2a4/0x3f0 drivers/net/ipvlan/ipvlan_core.c:834
ipvlan_start_xmit+0x3c/0x130 drivers/net/ipvlan/ipvlan_main.c:295
__netdev_start_xmit include/linux/netdevice.h:4839 [inline]
netdev_start_xmit include/linux/netdevice.h:4853 [inline]
__dev_direct_xmit+0x394/0x610 net/core/dev.c:4240
dev_direct_xmit include/linux/netdevice.h:2911 [inline]
packet_direct_xmit+0xf8/0x1e4 net/packet/af_packet.c:243
packet_snd+0xb54/0x164c net/packet/af_packet.c:3022
packet_sendmsg+0x84/0xa0 net/packet/af_packet.c:3054
sock_sendmsg_nosec net/socket.c:653 [inline]
sock_sendmsg+0x8c/0xe0 net/socket.c:673
__sys_sendto+0x1c4/0x29c net/socket.c:1983
__do_sys_sendto net/socket.c:1995 [inline]
__se_sys_sendto net/socket.c:1991 [inline]
__arm64_sys_sendto+0x84/0xa0 net/socket.c:1991
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155
do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217
el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683

Allocated by task 27910:
kasan_save_stack+0x24/0x50 mm/kasan/common.c:48
kasan_set_track mm/kasan/common.c:56 [inline]
__kasan_kmalloc mm/kasan/common.c:479 [inline]
__kasan_kmalloc.constprop.0+0x110/0x13c mm/kasan/common.c:449
kasan_kmalloc+0xc/0x14 mm/kasan/common.c:493
kmem_cache_alloc_node_trace+0x238/0x930 mm/slub.c:2978
kmalloc_node include/linux/slab.h:581 [inline]
kzalloc_node include/linux/slab.h:686 [inline]
__get_vm_area_node+0x12c/0x214 mm/vmalloc.c:2436
__vmalloc_node_range+0x180/0x354 mm/vmalloc.c:3024
__vmalloc_node mm/vmalloc.c:3085 [inline]
vzalloc+0x114/0x1d0 mm/vmalloc.c:3155
alloc_counters.isra.0+0x38/0x300 net/ipv6/netfilter/ip6_tables.c:817
copy_entries_to_user.isra.0+0x30/0x440 net/ipv6/netfilter/ip6_tables.c:839
get_entries+0x2ec/0x330 net/ipv6/netfilter/ip6_tables.c:1041
do_ip6t_get_ctl+0x22c/0x414 net/ipv6/netfilter/ip6_tables.c:1672
nf_getsockopt+0x80/0xd4 net/netfilter/nf_sockopt.c:116
ipv6_getsockopt+0x264/0x394 net/ipv6/ipv6_sockglue.c:1488
tcp_getsockopt+0x7c/0xdc net/ipv4/tcp.c:3996
sock_common_getsockopt+0x70/0x84 net/core/sock.c:3228
__sys_getsockopt+0x168/0x390 net/socket.c:2164
__do_sys_getsockopt net/socket.c:2179 [inline]
__se_sys_getsockopt net/socket.c:2176 [inline]
__arm64_sys_getsockopt+0x74/0x90 net/socket.c:2176
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155
do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217
el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683

GVP openEuler/kernel
关闭

内容风险标识

评论 (3)

GVPopenEuler/kernel关闭

内容风险标识