[PATCH net] amt: refresh cached IP header pointers after MLD/IGMP checks

[Xiang Mei (Microsoft)]

amt_dev_xmit() and amt_update_handler() cache iph/ip6h before calling
ip_mc_check_igmp() / ipv6_mc_check_mld(), which may pskb_may_pull() a
non-linear skb and reallocate skb->head. The stale pointers are then
read (amt_dev_xmit: group.ip{4,6} = iph/ip6h->daddr; amt_update_handler:
ip{,v6}_eth_mc_map()), a slab-use-after-free. tx is reachable by an
unprivileged user whose amt device has SG enabled; rx by a tunnel peer
sending a membership update fragmented across several IP fragments.

Reload iph/ip6h after the check returns, like commit f0e42f0c4337
("ipv6: sit: reload inner IPv6 header after GSO offloads").

tx path:
  BUG: KASAN: slab-use-after-free in amt_dev_xmit (drivers/net/amt.c:1238)
  Read of size 16 by task exploit
   amt_dev_xmit (drivers/net/amt.c:1238)
   dev_hard_start_xmit (net/core/dev.c:3905)
   __dev_queue_xmit (net/core/dev.c:4872)
   packet_sendmsg (net/packet/af_packet.c:3114)

rx path:
  BUG: KASAN: slab-use-after-free in amt_rcv (drivers/net/amt.c:2530)
  Read of size 4 by task exploit
   amt_rcv (drivers/net/amt.c:2530)
   udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
   ip_local_deliver (net/ipv4/ip_input.c:262)
   ip_rcv (net/ipv4/ip_input.c:612)

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Fixes: bc54e49c140b ("amt: add multicast(IGMP) report message handler")
Fixes: b75f7095d4d4 ("amt: add mld report message handler")
Reported-by: AutonomousCodeSecurity@xxxxxxxxxxxxx
Signed-off-by: Xiang Mei (Microsoft) <xmei5@xxxxxxx>
---
 drivers/net/amt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index 951dd10e192b..8bc61c539b0a 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -1210,6 +1210,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 		} else {
 			data = true;
 		}
+		iph = ip_hdr(skb);
 		v6 = false;
 		group.ip4 = iph->daddr;
 #if IS_ENABLED(CONFIG_IPV6)
@@ -1234,6 +1235,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 		} else {
 			data = true;
 		}
+		ip6h = ipv6_hdr(skb);
 		v6 = true;
 		group.ip6 = ip6h->daddr;
 #endif
@@ -2498,6 +2500,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
 			netdev_dbg(amt->dev, "Invalid IGMP\n");
 			return true;
 		}
+		iph = ip_hdr(skb);
 
 		spin_lock_bh(&tunnel->lock);
 		amt_igmp_report_handler(amt, skb, tunnel);
@@ -2517,6 +2520,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
 			netdev_dbg(amt->dev, "Invalid MLD\n");
 			return true;
 		}
+		ip6h = ipv6_hdr(skb);
 
 		spin_lock_bh(&tunnel->lock);
 		amt_mld_report_handler(amt, skb, tunnel);
-- 
2.43.0