| Message ID | 20220713063204.6294-2-khalid.masum.92@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fix KASAN: slab-out-of-bounds Read in sk_psock_get | expand |
On Wed, Jul 13, 2022 at 12:32:04PM +0600, Khalid Masum wrote: > `struct sock` has a member `sk_user_data`, which got its memory allocated > in `kcm_attach` by `kcm_psock_cache` with the size of `kcm_psock`. Which > is not enough when the member is used as `sk_psock` causing out of bound > read. > > Use `sk_psock` size to allocate memory instead for `sk_user_data`. > > Reported-by: syzbot+1fa91bcd05206ff8cbb5@syzkaller.appspotmail.com > Signed-off-by: Khalid Masum <khalid.masum.92@gmail.com> > --- > net/kcm/kcmsock.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) What commit id does this fix? thanks, greg k-h
On Wed, 13 Jul 2022 12:32:04 +0600 Khalid Masum wrote: > `struct sock` has a member `sk_user_data`, which got its memory allocated > in `kcm_attach` by `kcm_psock_cache` with the size of `kcm_psock`. Which > is not enough when the member is used as `sk_psock` causing out of bound > read. > > Use `sk_psock` size to allocate memory instead for `sk_user_data`. > > Reported-by: syzbot+1fa91bcd05206ff8cbb5@syzkaller.appspotmail.com > Signed-off-by: Khalid Masum <khalid.masum.92@gmail.com> Odd CC list, it looks like a netdev problem but netdev@ is not copied. We had an other parson looking at this on netdev. Is this happening when legit kernel socket gets mixed with BPF sockmap? Does this fix work? https://lore.kernel.org/netdev/165030056960.5073.6664402939918720250.stgit@oracle-102.nfsv4.dev/
On Thu, Jul 14, 2022 at 12:16 AM Jakub Kicinski <kuba@kernel.org> wrote: > > On Wed, 13 Jul 2022 12:32:04 +0600 Khalid Masum wrote: > > `struct sock` has a member `sk_user_data`, which got its memory allocated > > in `kcm_attach` by `kcm_psock_cache` with the size of `kcm_psock`. Which > > is not enough when the member is used as `sk_psock` causing out of bound > > read. > > > > Use `sk_psock` size to allocate memory instead for `sk_user_data`. > > > > Reported-by: syzbot+1fa91bcd05206ff8cbb5@syzkaller.appspotmail.com > > Signed-off-by: Khalid Masum <khalid.masum.92@gmail.com> > > Odd CC list, it looks like a netdev problem but netdev@ is not copied. I am sorry for the inconvenience. I resent the patch with netdev in CC here: https://lore.kernel.org/netdev/20220713181324.14228-2-khalid.masum.92@gmail.com/ > We had an other parson looking at this on netdev. Is this happening > when legit kernel socket gets mixed with BPF sockmap? > > Does this fix work? I will take a look at it. > https://lore.kernel.org/netdev/165030056960.5073.6664402939918720250.stgit@oracle-102.nfsv4.dev/ Thanks, Khalid Masum
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index 71899e5a5a11..688bee56f90c 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -23,6 +23,7 @@ #include <linux/workqueue.h> #include <linux/syscalls.h> #include <linux/sched/signal.h> +#include <linux/skmsg.h> #include <net/kcm.h> #include <net/netns/generic.h> @@ -2041,7 +2042,7 @@ static int __init kcm_init(void) goto fail; kcm_psockp = kmem_cache_create("kcm_psock_cache", - sizeof(struct kcm_psock), 0, + sizeof(struct sk_psock), 0, SLAB_HWCACHE_ALIGN, NULL); if (!kcm_psockp) goto fail;
`struct sock` has a member `sk_user_data`, which got its memory allocated in `kcm_attach` by `kcm_psock_cache` with the size of `kcm_psock`. Which is not enough when the member is used as `sk_psock` causing out of bound read. Use `sk_psock` size to allocate memory instead for `sk_user_data`. Reported-by: syzbot+1fa91bcd05206ff8cbb5@syzkaller.appspotmail.com Signed-off-by: Khalid Masum <khalid.masum.92@gmail.com> --- net/kcm/kcmsock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)