syzbot and other bots reported that we have to enable user copy to/from skb->head. [1]
We can prevent access to skb_shared_info, which is a nice improvement over standard kmem_cache.
Layout of these kmem_cache objects is:
< SKB_SMALL_HEAD_HEADROOM >< struct skb_shared_info >
usercopy: Kernel memory overwrite attempt detected to SLUB object 'skbuff_small_head' (offset 32, size 20)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102 !
[...]
LKFT also reported this problem on today's Linux next-20230209.
Link: https://lore.kernel.org/linux-next/CA+G9fYs-i-c2KTSA7Ai4ES_ZESY1ZnM=Zuo8P1jN... Reported-by: Linux Kernel Functional Testing lkft@linaro.org
Fixes: bf9f1baa279f ("net: add dedicated kmem_cache for typical/small skb->head") Reported-by: syzbot syzkaller@googlegroups.com Signed-off-by: Eric Dumazet edumazet@google.com
Tested-by: Linux Kernel Functional Testing lkft@linaro.org
Thanks for providing a quick fix.
-- Linaro LKFT https://lkft.linaro.org