Forwarded: [PATCH] net: skbuff: convert BUG_ON to warning and error return during linearization

[syzbot <syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] net: skbuff: convert BUG_ON to warning and error return during linearization
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


When receiving an SCTP packet that is nonlinear (such as an SCTP GSO packet
constructed with fragments in frag_list), sctp_rcv attempts to linearize
the packet using skb_linearize() if the sk_buff is cloned (e.g.,
tapped by a packet socket or shared) or not recognized as GSO. During
linearization via __skb_linearize() and __pskb_pull_tail(),
skb_copy_bits() fails with -EFAULT due to a discrepancy in frag_list fragment
lengths or readable offsets, triggering a BUG_ON assertion failure.
In production builds, this BUG() results in an invalid opcode oops
and kernel panic, causing an immediate denial of service.

Fix this issue by removing the fatal BUG_ON() assertion in the core
network buffer layer (__pskb_pull_tail) when skb_copy_bits() encounters a
layout or length mismatch. Instead, log a rate-limited error message using
pr_err_ratelimited() and return NULL.

Reported-by: syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f15a6eff7a53f6eb7dc3
Fixes: 90017accff61 ("sctp: support GSO")

Signed-off-by: Gowtham S Bhushan <gowtham398gs@gmail.com>
---
 net/core/skbuff.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 48f676411724..f76fe6972859 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2900,8 +2900,12 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta)
 			return NULL;
 	}
 
-	BUG_ON(skb_copy_bits(skb, skb_headlen(skb),
-			     skb_tail_pointer(skb), delta));
+	if (unlikely((skb_copy_bits(skb, skb_headlen(skb),
+			     skb_tail_pointer(skb), delta))){
+		pr_err_ratelimited("skbuff: length discrepancy"
+				   "detected in %s.\n", __func__);
+		return NULL;
+	}
 
 	/* Optimization: no fragments, no reasons to preestimate
 	 * size of pulled pages. Superb.
-- 
2.56.0