| Message ID | 20220713181324.14228-2-khalid.masum.92@gmail.com (mailing list archive) |
|---|---|
| State | RFC |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Fix KASAN: slab-out-of-bounds Read in sk_psock_get | expand |
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index 71899e5a5a11..688bee56f90c 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -23,6 +23,7 @@ #include <linux/workqueue.h> #include <linux/syscalls.h> #include <linux/sched/signal.h> +#include <linux/skmsg.h> #include <net/kcm.h> #include <net/netns/generic.h> @@ -2041,7 +2042,7 @@ static int __init kcm_init(void) goto fail; kcm_psockp = kmem_cache_create("kcm_psock_cache", - sizeof(struct kcm_psock), 0, + sizeof(struct sk_psock), 0, SLAB_HWCACHE_ALIGN, NULL); if (!kcm_psockp) goto fail;
`struct sock` has a member `sk_user_data`, which got its memory allocated in `kcm_attach` by `kcm_psock_cache` with the size of `kcm_psock`. Which is not enough when the member is used as `sk_psock` causing out of bound read. Use `sk_psock` size to allocate memory instead for `sk_user_data`. Reported-by: syzbot+1fa91bcd05206ff8cbb5@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=1fa91bcd05206ff8cbb5 Signed-off-by: Khalid Masum <khalid.masum.92@gmail.com> --- net/kcm/kcmsock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)