[5.10,070/129] wireguard: device: check for metadata_dst with skb_valid_dst()

From: Nikolay Aleksandrov <razor@blackwall.org>

From: Nikolay Aleksandrov <razor@blackwall.org>

[ Upstream commit 45ac774c33d834fe9d4de06ab5f1022fe8cd2071 ]

When we try to transmit an skb with md_dst attached through wireguard
we hit a null pointer dereference in wg_xmit() due to the use of
dst_mtu() which calls into dst_blackhole_mtu() which in turn tries to
dereference dst->dev.

Since wireguard doesn't use md_dsts we should use skb_valid_dst(), which
checks for DST_METADATA flag, and if it's set, then falls back to
wireguard's device mtu. That gives us the best chance of transmitting
the packet; otherwise if the blackhole netdev is used we'd get
ETH_MIN_MTU.

 [  263.693506] BUG: kernel NULL pointer dereference, address: 00000000000000e0
 [  263.693908] #PF: supervisor read access in kernel mode
 [  263.694174] #PF: error_code(0x0000) - not-present page
 [  263.694424] PGD 0 P4D 0
 [  263.694653] Oops: 0000 [#1] PREEMPT SMP NOPTI
 [  263.694876] CPU: 5 PID: 951 Comm: mausezahn Kdump: loaded Not tainted 5.18.0-rc1+ #522
 [  263.695190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014
 [  263.695529] RIP: 0010:dst_blackhole_mtu+0x17/0x20
 [  263.695770] Code: 00 00 00 0f 1f 44 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8b 47 10 48 83 e0 fc 8b 40 04 85 c0 75 09 48 8b 07 <8b> 80 e0 00 00 00 c3 66 90 0f 1f 44 00 00 48 89 d7 be 01 00 00 00
 [  263.696339] RSP: 0018:ffffa4a4422fbb28 EFLAGS: 00010246
 [  263.696600] RAX: 0000000000000000 RBX: ffff8ac9c3553000 RCX: 0000000000000000
 [  263.696891] RDX: 0000000000000401 RSI: 00000000fffffe01 RDI: ffffc4a43fb48900
 [  263.697178] RBP: ffffa4a4422fbb90 R08: ffffffff9622635e R09: 0000000000000002
 [  263.697469] R10: ffffffff9b69a6c0 R11: ffffa4a4422fbd0c R12: ffff8ac9d18b1a00
 [  263.697766] R13: ffff8ac9d0ce1840 R14: ffff8ac9d18b1a00 R15: ffff8ac9c3553000
 [  263.698054] FS:  00007f3704c337c0(0000) GS:ffff8acaebf40000(0000) knlGS:0000000000000000
 [  263.698470] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 [  263.698826] CR2: 00000000000000e0 CR3: 0000000117a5c000 CR4: 00000000000006e0
 [  263.699214] Call Trace:
 [  263.699505]  <TASK>
 [  263.699759]  wg_xmit+0x411/0x450
 [  263.700059]  ? bpf_skb_set_tunnel_key+0x46/0x2d0
 [   263.700382]  ? dev_queue_xmit_nit+0x31/0x2b0
 [  263.700719]  dev_hard_start_xmit+0xd9/0x220
 [  263.701047]  __dev_queue_xmit+0x8b9/0xd30
 [  263.701344]  __bpf_redirect+0x1a4/0x380
 [  263.701664]  __dev_queue_xmit+0x83b/0xd30
 [  263.701961]  ? packet_parse_headers+0xb4/0xf0
 [  263.702275]  packet_sendmsg+0x9a8/0x16a0
 [  263.702596]  ? _raw_spin_unlock_irqrestore+0x23/0x40
 [  263.702933]  sock_sendmsg+0x5e/0x60
 [  263.703239]  __sys_sendto+0xf0/0x160
 [  263.703549]  __x64_sys_sendto+0x20/0x30
 [  263.703853]  do_syscall_64+0x3b/0x90
 [  263.704162]  entry_SYSCALL_64_after_hwframe+0x44/0xae
 [  263.704494] RIP: 0033:0x7f3704d50506
 [  263.704789] Code: 48 c7 c0 ff ff ff ff eb b7 66 2e 0f 1f 84 00 00 00 00 00 90 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 72 c3 90 55 48 83 ec 30 44 89 4c 24 2c 4c 89
 [  263.705652] RSP: 002b:00007ffe954b0b88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
 [  263.706141] RAX: ffffffffffffffda RBX: 0000558bb259b490 RCX: 00007f3704d50506
 [  263.706544] RDX: 000000000000004a RSI: 0000558bb259b7b2 RDI: 0000000000000003
 [  263.706952] RBP: 0000000000000000 R08: 00007ffe954b0b90 R09: 0000000000000014
 [  263.707339] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe954b0b90
 [  263.707735] R13: 000000000000004a R14: 0000558bb259b7b2 R15: 0000000000000001
 [  263.708132]  </TASK>
 [  263.708398] Modules linked in: bridge netconsole bonding [last unloaded: bridge]
 [  263.708942] CR2: 00000000000000e0

Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Link: https://github.com/cilium/cilium/issues/19428
Reported-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireguard/device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Message ID	20220504153026.785770112@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Martynas Pumputis <m@lambda.lt>, Nikolay Aleksandrov <razor@blackwall.org>, Daniel Borkmann <daniel@iogearbox.net>, "Jason A. Donenfeld" <Jason@zx2c4.com>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 070/129] wireguard: device: check for metadata_dst with skb_valid_dst() Date: Wed, 4 May 2022 18:44:22 +0200 Message-Id: <20220504153026.785770112@linuxfoundation.org> In-Reply-To: <20220504153021.299025455@linuxfoundation.org> References: <20220504153021.299025455@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/129] lightnvm: disable the subsystem [5.10,003/129] usb: mtu3: fix USB 3.0 dual-role-switch from device to host [5.10,005/129] USB: quirks: add STRING quirk for VCOM device [5.10,006/129] USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS [5.10,009/129] USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions [5.10,013/129] iio: dac: ad5592r: Fix the missing return value. [5.10,016/129] iio: imu: inv_icm42600: Fix I2C init possible nack [5.10,018/129] usb: typec: ucsi: Fix reuse of completion structure [5.10,024/129] usb: dwc3: core: Only handle soft-reset in DCTL [5.10,026/129] usb: cdns3: Fix issue for clear halt endpoint [5.10,028/129] serial: imx: fix overrun interrupts in DMA mode [5.10,029/129] serial: 8250: Also set sticky MCR bits in console restoration [5.10,030/129] serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device [5.10,031/129] arch_topology: Do not set llc_sibling if llc_id is invalid [5.10,036/129] x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests [5.10,038/129] video: fbdev: udlfb: properly check endpoint type [5.10,039/129] arm64: dts: meson: remove CPU opps below 1GHz for G12B boards [5.10,042/129] mtd: rawnand: fix ecc parameters for mt7622 [5.10,044/129] ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue [5.10,045/129] phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe [5.10,046/129] phy: samsung: exynos5250-sata: fix missing device put in probe error paths [5.10,047/129] ARM: OMAP2+: Fix refcount leak in omap_gic_of_init [5.10,048/129] bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific [5.10,051/129] ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name [5.10,053/129] phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe [5.10,054/129] ARM: dts: Fix mmc order for omap3-gta04 [5.10,055/129] ARM: dts: am3517-evm: Fix misc pinmuxing [5.10,056/129] ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 [5.10,057/129] ipvs: correctly print the memory size of ip_vs_conn_tab [5.10,060/129] mtd: fix part field data corruption in mtd_info [5.10,061/129] pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered IRQs in EOI [5.10,062/129] memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode [5.10,065/129] bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook [5.10,066/129] pinctrl: rockchip: fix RK3308 pinmux bits [5.10,069/129] tcp: ensure to use the most recently sent skb when filling the rate sample [5.10,070/129] wireguard: device: check for metadata_dst with skb_valid_dst() [5.10,071/129] sctp: check asoc strreset_chunk in sctp_generate_reconf_event [5.10,072/129] ARM: dts: imx6ull-colibri: fix vqmmc regulator [5.10,076/129] net: hns3: modify the return code of hclge_get_ring_chain_from_mbx [5.10,077/129] net: hns3: add validity check for message data length [5.10,078/129] net: hns3: add return value for mailbox handling in PF [5.10,081/129] ip6_gre: Make o_seqno start from 0 in native mode [5.10,083/129] tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT [5.10,087/129] net: bcmgenet: hide status block before TX timestamping [5.10,089/129] net: dsa: lantiq_gswip: Dont set GSWIP_MII_CFG_RMII_CLK [5.10,092/129] tls: Skip tls_append_frag on zero copy size [5.10,093/129] bnx2x: fix napi API usage sequence [5.10,094/129] net: fec: add missing of_node_put() in fec_enet_init_stop_mode() [5.10,096/129] ibmvnic: fix miscellaneous checks [5.10,097/129] Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits" [5.10,098/129] tcp: fix F-RTO may not work correctly when receiving DSACK [5.10,099/129] ASoC: Intel: soc-acpi: correct device endpoints for max98373 [5.10,106/129] zonefs: Fix management of open zones [5.10,108/129] kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur a... [5.10,111/129] thermal: int340x: Fix attr.show callback prototype [5.10,113/129] perf symbol: Pass is_kallsyms to symbols__fixup_end() [5.10,115/129] tty: n_gsm: fix restart handling via CLD command [5.10,116/129] tty: n_gsm: fix decoupled mux resource [5.10,118/129] tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 [5.10,121/129] tty: n_gsm: fix insufficient txframe size [5.10,123/129] tty: n_gsm: fix missing explicit ldisc flush [5.10,126/129] tty: n_gsm: fix reset fifo race condition [5.10,127/129] tty: n_gsm: fix incorrect UA handling [5.10,128/129] tty: n_gsm: fix software flow control handling [5.10,129/129] perf symbol: Remove arch__symbols__fixup_end()

[5.10,070/129] wireguard: device: check for metadata_dst with skb_valid_dst()

Commit Message

Patch