From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Alban Browaeys <alban.browaeys@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.12 08/84] net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64
Date: Wed, 19 Jul 2017 11:43:14 +0200 [thread overview]
Message-ID: <20170719092322.697686121@linuxfoundation.org> (raw)
In-Reply-To: <20170719092322.362625377@linuxfoundation.org>
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alban Browaeys <alban.browaeys@gmail.com>
[ Upstream commit 9af9959e142c274f4a30fefb71d97d2b028b337f ]
commit 9256645af098 ("net/core: relax BUILD_BUG_ON in
netdev_stats_to_stats64") made an attempt to read beyond
the size of the source a possibility.
Fix to only copy src size to dest. As dest might be bigger than src.
==================================================================
BUG: KASAN: slab-out-of-bounds in netdev_stats_to_stats64+0xe/0x30 at addr ffff8801be248b20
Read of size 192 by task VBoxNetAdpCtl/6734
CPU: 1 PID: 6734 Comm: VBoxNetAdpCtl Tainted: G O 4.11.4prahal+intel+ #118
Hardware name: LENOVO 20CDCTO1WW/20CDCTO1WW, BIOS GQET52WW (1.32 ) 05/04/2017
Call Trace:
dump_stack+0x63/0x86
kasan_object_err+0x1c/0x70
kasan_report+0x270/0x520
? netdev_stats_to_stats64+0xe/0x30
? sched_clock_cpu+0x1b/0x190
? __module_address+0x3e/0x3b0
? unwind_next_frame+0x1ea/0xb00
check_memory_region+0x13c/0x1a0
memcpy+0x23/0x50
netdev_stats_to_stats64+0xe/0x30
dev_get_stats+0x1b9/0x230
rtnl_fill_stats+0x44/0xc00
? nla_put+0xc6/0x130
rtnl_fill_ifinfo+0xe9e/0x3700
? rtnl_fill_vfinfo+0xde0/0xde0
? sched_clock+0x9/0x10
? sched_clock+0x9/0x10
? sched_clock_local+0x120/0x130
? __module_address+0x3e/0x3b0
? unwind_next_frame+0x1ea/0xb00
? sched_clock+0x9/0x10
? sched_clock+0x9/0x10
? sched_clock_cpu+0x1b/0x190
? VBoxNetAdpLinuxIOCtlUnlocked+0x14b/0x280 [vboxnetadp]
? depot_save_stack+0x1d8/0x4a0
? depot_save_stack+0x34f/0x4a0
? depot_save_stack+0x34f/0x4a0
? save_stack+0xb1/0xd0
? save_stack_trace+0x16/0x20
? save_stack+0x46/0xd0
? kasan_slab_alloc+0x12/0x20
? __kmalloc_node_track_caller+0x10d/0x350
? __kmalloc_reserve.isra.36+0x2c/0xc0
? __alloc_skb+0xd0/0x560
? rtmsg_ifinfo_build_skb+0x61/0x120
? rtmsg_ifinfo.part.25+0x16/0xb0
? rtmsg_ifinfo+0x47/0x70
? register_netdev+0x15/0x30
? vboxNetAdpOsCreate+0xc0/0x1c0 [vboxnetadp]
? vboxNetAdpCreate+0x210/0x400 [vboxnetadp]
? VBoxNetAdpLinuxIOCtlUnlocked+0x14b/0x280 [vboxnetadp]
? do_vfs_ioctl+0x17f/0xff0
? SyS_ioctl+0x74/0x80
? do_syscall_64+0x182/0x390
? __alloc_skb+0xd0/0x560
? __alloc_skb+0xd0/0x560
? save_stack_trace+0x16/0x20
? init_object+0x64/0xa0
? ___slab_alloc+0x1ae/0x5c0
? ___slab_alloc+0x1ae/0x5c0
? __alloc_skb+0xd0/0x560
? sched_clock+0x9/0x10
? kasan_unpoison_shadow+0x35/0x50
? kasan_kmalloc+0xad/0xe0
? __kmalloc_node_track_caller+0x246/0x350
? __alloc_skb+0xd0/0x560
? kasan_unpoison_shadow+0x35/0x50
? memset+0x31/0x40
? __alloc_skb+0x31f/0x560
? napi_consume_skb+0x320/0x320
? br_get_link_af_size_filtered+0xb7/0x120 [bridge]
? if_nlmsg_size+0x440/0x630
rtmsg_ifinfo_build_skb+0x83/0x120
rtmsg_ifinfo.part.25+0x16/0xb0
rtmsg_ifinfo+0x47/0x70
register_netdevice+0xa2b/0xe50
? __kmalloc+0x171/0x2d0
? netdev_change_features+0x80/0x80
register_netdev+0x15/0x30
vboxNetAdpOsCreate+0xc0/0x1c0 [vboxnetadp]
vboxNetAdpCreate+0x210/0x400 [vboxnetadp]
? vboxNetAdpComposeMACAddress+0x1d0/0x1d0 [vboxnetadp]
? kasan_check_write+0x14/0x20
VBoxNetAdpLinuxIOCtlUnlocked+0x14b/0x280 [vboxnetadp]
? VBoxNetAdpLinuxOpen+0x20/0x20 [vboxnetadp]
? lock_acquire+0x11c/0x270
? __audit_syscall_entry+0x2fb/0x660
do_vfs_ioctl+0x17f/0xff0
? __audit_syscall_entry+0x2fb/0x660
? ioctl_preallocate+0x1d0/0x1d0
? __audit_syscall_entry+0x2fb/0x660
? kmem_cache_free+0xb2/0x250
? syscall_trace_enter+0x537/0xd00
? exit_to_usermode_loop+0x100/0x100
SyS_ioctl+0x74/0x80
? do_sys_open+0x350/0x350
? do_vfs_ioctl+0xff0/0xff0
do_syscall_64+0x182/0x390
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7f7e39a1ae07
RSP: 002b:00007ffc6f04c6d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffc6f04c730 RCX: 00007f7e39a1ae07
RDX: 00007ffc6f04c730 RSI: 00000000c0207601 RDI: 0000000000000007
RBP: 00007ffc6f04c700 R08: 00007ffc6f04c780 R09: 0000000000000008
R10: 0000000000000541 R11: 0000000000000206 R12: 0000000000000007
R13: 00000000c0207601 R14: 00007ffc6f04c730 R15: 0000000000000012
Object at ffff8801be248008, in cache kmalloc-4096 size: 4096
Allocated:
PID = 6734
save_stack_trace+0x16/0x20
save_stack+0x46/0xd0
kasan_kmalloc+0xad/0xe0
__kmalloc+0x171/0x2d0
alloc_netdev_mqs+0x8a7/0xbe0
vboxNetAdpOsCreate+0x65/0x1c0 [vboxnetadp]
vboxNetAdpCreate+0x210/0x400 [vboxnetadp]
VBoxNetAdpLinuxIOCtlUnlocked+0x14b/0x280 [vboxnetadp]
do_vfs_ioctl+0x17f/0xff0
SyS_ioctl+0x74/0x80
do_syscall_64+0x182/0x390
return_from_SYSCALL_64+0x0/0x6a
Freed:
PID = 5600
save_stack_trace+0x16/0x20
save_stack+0x46/0xd0
kasan_slab_free+0x73/0xc0
kfree+0xe4/0x220
kvfree+0x25/0x30
single_release+0x74/0xb0
__fput+0x265/0x6b0
____fput+0x9/0x10
task_work_run+0xd5/0x150
exit_to_usermode_loop+0xe2/0x100
do_syscall_64+0x26c/0x390
return_from_SYSCALL_64+0x0/0x6a
Memory state around the buggy address:
ffff8801be248a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801be248b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801be248b80: 00 00 00 00 00 00 00 00 00 00 00 07 fc fc fc fc
^
ffff8801be248c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801be248c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Signed-off-by: Alban Browaeys <alban.browaeys@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7751,7 +7751,7 @@ void netdev_stats_to_stats64(struct rtnl
{
#if BITS_PER_LONG == 64
BUILD_BUG_ON(sizeof(*stats64) < sizeof(*netdev_stats));
- memcpy(stats64, netdev_stats, sizeof(*stats64));
+ memcpy(stats64, netdev_stats, sizeof(*netdev_stats));
/* zero out counters that only exist in rtnl_link_stats64 */
memset((char *)stats64 + sizeof(*netdev_stats), 0,
sizeof(*stats64) - sizeof(*netdev_stats));
next prev parent reply other threads:[~2017-07-19 9:45 UTC|newest]
Thread overview: 106+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-19 9:43 [PATCH 4.12 00/84] 4.12.3-stable review Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 01/84] staging: android: uapi: drop definitions of removed ION_IOC_{FREE,SHARE} ioctls Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 02/84] net/mlx5: Fix driver load error flow when firmware is stuck Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 03/84] net/mlx5: Cancel delayed recovery work when unloading the driver Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 04/84] net/mlx5e: Fix TX carrier errors report in get stats ndo Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 05/84] ipv6: dad: dont remove dynamic addresses if link is down Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 06/84] vxlan: fix hlist corruption Greg Kroah-Hartman
2017-07-19 9:43 ` Greg Kroah-Hartman [this message]
2017-07-19 9:43 ` [PATCH 4.12 09/84] liquidio: fix bug in soft reset failure detection Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 11/84] vrf: fix bug_on triggered by rx when destroying a vrf Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 12/84] virtio-net: fix leaking of ctx array Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 13/84] rds: tcp: use sock_create_lite() to create the accept socket Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 14/84] net/mlx5e: Initialize CEEs getpermhwaddr address buffer to 0xff Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 15/84] cxgb4: fix BUG() on interrupt deallocating path of ULD Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 16/84] tap: convert a mutex to a spinlock Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 17/84] bridge: mdb: fix leak on complete_info ptr on fail path Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 19/84] sfc: dont read beyond unicast address list Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 20/84] Adding asm-prototypes.h for genksyms to generate crc Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 21/84] sed regex in Makefile.build requires line break between exported symbols Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 22/84] Adding the type of " Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 23/84] sparc64: Fix gup_huge_pmd Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 24/84] brcmfmac: Fix a memory leak in error handling path in brcmf_cfg80211_attach Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 25/84] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 26/84] x86/xen/efi: Initialize only the EFI struct members used by Xen Greg Kroah-Hartman
2017-07-19 9:43 ` Greg Kroah-Hartman
2017-07-19 10:37 ` Daniel Kiper
2017-07-19 10:37 ` Daniel Kiper
2017-07-19 11:12 ` Greg Kroah-Hartman
2017-07-19 11:19 ` Greg Kroah-Hartman
2017-07-19 11:19 ` Greg Kroah-Hartman
2017-07-19 11:57 ` Daniel Kiper
2017-07-19 11:57 ` Daniel Kiper
2017-07-19 11:28 ` Daniel Kiper
2017-07-19 11:28 ` Daniel Kiper
2017-07-19 11:12 ` Greg Kroah-Hartman
2017-07-20 8:39 ` Ingo Molnar
2017-07-20 8:39 ` Ingo Molnar
2017-07-20 9:16 ` Greg Kroah-Hartman
2017-07-20 9:16 ` Greg Kroah-Hartman
2017-07-20 9:41 ` Ingo Molnar
2017-07-20 9:41 ` Ingo Molnar
2017-07-20 9:41 ` Ingo Molnar
2017-07-20 12:33 ` Daniel Kiper
2017-07-20 12:33 ` Daniel Kiper
2017-07-20 12:33 ` Daniel Kiper
2017-07-21 6:32 ` Juergen Gross
2017-07-21 6:32 ` Juergen Gross
2017-07-21 6:32 ` Juergen Gross
2017-07-19 9:43 ` [PATCH 4.12 27/84] efi: Process the MEMATTR table only if EFI_MEMMAP is enabled Greg Kroah-Hartman
2017-07-19 9:43 ` Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 28/84] cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 29/84] cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 30/84] cfg80211: Check if PMKID attribute is of expected size Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 31/84] cfg80211: Check if NAN service ID " Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 32/84] drm/amdgpu/gfx6: properly cache mc_arb_ramcfg Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 33/84] KVM: ARM64: fix phy counter access failure in guest Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 34/84] KVM: PPC: Book3S: Fix typo in XICS-on-XIVE state saving code Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 35/84] kvm-vfio: Decouple only when we match a group Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 36/84] irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 37/84] parisc: Report SIGSEGV instead of SIGBUS when running out of stack Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 38/84] parisc: use compat_sys_keyctl() Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 39/84] parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 40/84] parisc/mm: Ensure IRQs are off in switch_mm() Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 41/84] tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 42/84] compiler, clang: always inline when CONFIG_OPTIMIZE_INLINING is disabled Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 43/84] thp, mm: fix crash due race in MADV_FREE handling Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 44/84] kernel/extable.c: mark core_kernel_text notrace Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 45/84] mm/list_lru.c: fix list_lru_count_node() to be race free Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 46/84] fs/dcache.c: fix spin lockup issue on nlru->lock Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 47/84] checkpatch: silence perl 5.26.0 unescaped left brace warnings Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 48/84] binfmt_elf: use ELF_ET_DYN_BASE only for PIE Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 49/84] arm: move ELF_ET_DYN_BASE to 4MB Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 50/84] arm64: move ELF_ET_DYN_BASE to 4GB / 4MB Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 51/84] powerpc: " Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 52/84] s390: reduce ELF_ET_DYN_BASE Greg Kroah-Hartman
2017-07-19 9:43 ` [PATCH 4.12 53/84] exec: Limit arg stack to at most 75% of _STK_LIM Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 54/84] powerpc/kexec: Fix radix to hash kexec due to IAMR/AMOR Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 55/84] ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 56/84] arm64: Preventing READ_IMPLIES_EXEC propagation Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 57/84] vt: fix unchecked __put_user() in tioclinux ioctls Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 58/84] rcu: Add memory barriers for NOCB leader wakeup Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 59/84] nvmem: core: fix leaks on registration errors Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 60/84] Drivers: hv: vmbus: Close timing hole that can corrupt per-cpu page Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 61/84] mnt: In umount propagation reparent in a separate pass Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 62/84] mnt: In propgate_umount handle visiting mounts in any order Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 63/84] mnt: Make propagate_umount less slow for overlapping mount propagation trees Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 64/84] selftests/capabilities: Fix the test_execve test Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 67/84] crypto: atmel - only treat EBUSY as transient if backlog Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 68/84] crypto: sha1-ssse3 - Disable avx2 Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 71/84] KEYS: DH: validate __spare field Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 72/84] sched/headers/uapi: Fix linux/sched/types.h userspace compilation errors Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 73/84] sched/topology: Fix building of overlapping sched-groups Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 74/84] sched/topology: Optimize build_group_mask() Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 75/84] sched/topology: Fix overlapping sched_group_mask Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 76/84] PM / wakeirq: Convert to SRCU Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 77/84] pstore: Fix leaked pstore_record in pstore_get_backend_records() Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 79/84] ALSA: hda/realtek - change the location for one of two front microphones Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 80/84] PM / QoS: return -EINVAL for bogus strings Greg Kroah-Hartman
2017-07-19 9:44 ` [PATCH 4.12 84/84] kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS Greg Kroah-Hartman
[not found] ` <596f88cd.48b4df0a.797d0.d5e3@mx.google.com>
2017-07-19 16:36 ` [PATCH 4.12 00/84] 4.12.3-stable review Shuah Khan
2017-07-22 15:47 ` Kevin Hilman
2017-07-24 9:11 ` Sjoerd Simons
[not found] ` <7hfudosc1k.fsf@baylibre.com>
2017-08-01 8:21 ` Jan Lübbe
2017-07-19 20:35 ` Guenter Roeck
2017-07-20 5:06 ` Greg Kroah-Hartman
2017-07-19 23:37 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170719092322.697686121@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alban.browaeys@gmail.com \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.