bpf_sk_assign_tcp_reqsk() only validates skb->protocol (L3) but does not check the L4 protocol in the IP header. A BPF program can call this kfunc on a UDP skb with a valid TCP listener socket, which will succeed and attach a TCP reqsk to the UDP skb. When the UDP skb enters the UDP receive path, skb_steal_sock() returns the TCP listener from the reqsk. The UDP code then passes this TCP socket to udp_unicast_rcv_skb() -> __udp_enqueue_schedule_skb(), which casts it to udp_sock and accesses UDP-specific fields at invalid offsets, causing a null pointer dereference and kernel panic: BUG: KASAN: null-ptr-deref in __udp_enqueue_schedule_skb+0x19d/0x1df0 Read of size 4 at addr 0000000000000008 by task test_progs/537 CPU: 1 UID: 0 PID: 537 Comm: test_progs Not tainted 7.0.0-rc4+ #46 PREEMPT Call Trace: dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:487) kasan_report (mm/kasan/report.c:597) __kasan_check_read (mm/kasan/shadow.c:32) __udp_enqueue_schedule_skb (net/ipv4/udp.c:1719) udp_queue_rcv_one_skb (net/ipv4/udp.c:2370 net/ipv4/udp.c:2500) udp_queue_rcv_skb (net/ipv4/udp.c:2532) udp_unicast_rcv_skb (net/ipv4/udp.c:2684) __udp4_lib_rcv (net/ipv4/udp.c:2742) udp_rcv (net/ipv4/udp.c:2937) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:209) ip_local_deliver_finish (./include/linux/rcupdate.h:879 net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:265) __netif_receive_skb_one_core (net/core/dev.c:6164 (discriminator 4)) __netif_receive_skb (net/core/dev.c:6280) Fix this by checking the IP header's protocol field in bpf_sk_assign_tcp_reqsk() and rejecting non-TCP skbs with -EINVAL. Note that for IPv6, the nexthdr check does not walk extension headers. This is uncommon for TCP SYN packets in practice, and keeping it simple was agreed upon by Kuniyuki Iwashima. Fixes: e472f88891ab ("bpf: tcp: Support arbitrary SYN Cookie.") Reviewed-by: Kuniyuki Iwashima Signed-off-by: Jiayuan Chen --- net/core/filter.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 78b548158fb05..523a63584cba0 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -12247,15 +12247,31 @@ __bpf_kfunc int bpf_sk_assign_tcp_reqsk(struct __sk_buff *s, struct sock *sk, return -ENETUNREACH; switch (skb->protocol) { - case htons(ETH_P_IP): + case htons(ETH_P_IP): { + struct iphdr *iph, _iph; + + iph = skb_header_pointer(skb, skb_network_offset(skb), + sizeof(*iph), &_iph); + if (!iph || iph->protocol != IPPROTO_TCP) + return -EINVAL; + ops = &tcp_request_sock_ops; min_mss = 536; break; + } #if IS_BUILTIN(CONFIG_IPV6) - case htons(ETH_P_IPV6): + case htons(ETH_P_IPV6): { + struct ipv6hdr *ip6h, _ip6h; + + ip6h = skb_header_pointer(skb, skb_network_offset(skb), + sizeof(*ip6h), &_ip6h); + if (!ip6h || ip6h->nexthdr != IPPROTO_TCP) + return -EINVAL; + ops = &tcp6_request_sock_ops; min_mss = IPV6_MIN_MTU - 60; break; + } #endif default: return -EINVAL; -- 2.43.0