From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vakul Garg Subject: [PATCH net-next] Prevent overflow of sk_msg in sk_msg_clone() Date: Fri, 21 Dec 2018 15:55:46 +0000 Message-ID: <20181221155357.6337-1-vakul.garg@nxp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Cc: "john.fastabend@gmail.com" , "daniel@iogearbox.net" , "davejwatson@fb.com" , "davem@davemloft.net" , Vakul Garg To: "netdev@vger.kernel.org" Return-path: Received: from mail-eopbgr50083.outbound.protection.outlook.com ([40.107.5.83]:63035 "EHLO EUR03-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725790AbeLUP4d (ORCPT ); Fri, 21 Dec 2018 10:56:33 -0500 Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: Fixed function sk_msg_clone() to prevent overflow of 'dst' while adding pages in scatterlist entries. The overflow of 'dst' causes crash in kernel tls module while doing record encryption. Crash fixed by this patch. [ 78.796119] Unable to handle kernel NULL pointer dereference at virtual = address 0000000000000008 [ 78.804900] Mem abort info: [ 78.807683] ESR =3D 0x96000004 [ 78.810744] Exception class =3D DABT (current EL), IL =3D 32 bits [ 78.816677] SET =3D 0, FnV =3D 0 [ 78.819727] EA =3D 0, S1PTW =3D 0 [ 78.822873] Data abort info: [ 78.825759] ISV =3D 0, ISS =3D 0x00000004 [ 78.829600] CM =3D 0, WnR =3D 0 [ 78.832576] user pgtable: 4k pages, 48-bit VAs, pgdp =3D 00000000bf8ee31= 1 [ 78.839195] [0000000000000008] pgd=3D0000000000000000 [ 78.844081] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 78.849642] Modules linked in: tls xt_conntrack ipt_REJECT nf_reject_ipv= 4 ip6table_filter ip6_tables xt_CHECKSUM cpve cpufreq_conservative lm90 ina= 2xx crct10dif_ce [ 78.865377] CPU: 0 PID: 6007 Comm: openssl Not tainted 4.20.0-rc6-01647-= g754d5da63145-dirty #107 [ 78.874149] Hardware name: LS1043A RDB Board (DT) [ 78.878844] pstate: 60000005 (nZCv daif -PAN -UAO) [ 78.883632] pc : scatterwalk_copychunks+0x164/0x1c8 [ 78.888500] lr : scatterwalk_copychunks+0x160/0x1c8 [ 78.893366] sp : ffff00001d04b600 [ 78.896668] x29: ffff00001d04b600 x28: ffff80006814c680 [ 78.901970] x27: 0000000000000000 x26: ffff80006c8de786 [ 78.907272] x25: ffff00001d04b760 x24: 000000000000001a [ 78.912573] x23: 0000000000000006 x22: ffff80006814e440 [ 78.917874] x21: 0000000000000100 x20: 0000000000000000 [ 78.923175] x19: 000081ffffffffff x18: 0000000000000400 [ 78.928476] x17: 0000000000000008 x16: 0000000000000000 [ 78.933778] x15: 0000000000000100 x14: 0000000000000001 [ 78.939079] x13: 0000000000001080 x12: 0000000000000020 [ 78.944381] x11: 0000000000001080 x10: 00000000ffff0002 [ 78.949683] x9 : ffff80006814c248 x8 : 00000000ffff0000 [ 78.954985] x7 : ffff80006814c318 x6 : ffff80006c8de786 [ 78.960286] x5 : 0000000000000f80 x4 : ffff80006c8de000 [ 78.965588] x3 : 0000000000000000 x2 : 0000000000001086 [ 78.970889] x1 : ffff7e0001b74e02 x0 : 0000000000000000 [ 78.976192] Process openssl (pid: 6007, stack limit =3D 0x00000000291367= f9) [ 78.982968] Call trace: [ 78.985406] scatterwalk_copychunks+0x164/0x1c8 [ 78.989927] skcipher_walk_next+0x28c/0x448 [ 78.994099] skcipher_walk_done+0xfc/0x258 [ 78.998187] gcm_encrypt+0x434/0x4c0 [ 79.001758] tls_push_record+0x354/0xa58 [tls] [ 79.006194] bpf_exec_tx_verdict+0x1e4/0x3e8 [tls] [ 79.010978] tls_sw_sendmsg+0x650/0x780 [tls] [ 79.015326] inet_sendmsg+0x2c/0xf8 [ 79.018806] sock_sendmsg+0x18/0x30 [ 79.022284] __sys_sendto+0x104/0x138 [ 79.025935] __arm64_sys_sendto+0x24/0x30 [ 79.029936] el0_svc_common+0x60/0xe8 [ 79.033588] el0_svc_handler+0x2c/0x80 [ 79.037327] el0_svc+0x8/0xc [ 79.040200] Code: 6b01005f 54fff788 940169b1 f9000320 (b9400801) [ 79.046283] ---[ end trace 74db007d069c1cf7 ]--- Signed-off-by: Vakul Garg Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface") --- net/core/skmsg.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 86c9726fced8..26458876d763 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -94,6 +94,9 @@ int sk_msg_clone(struct sock *sk, struct sk_msg *dst, str= uct sk_msg *src, } =20 while (len) { + if (sk_msg_full(dst)) + return -ENOSPC; + sge_len =3D sge->length - off; sge_off =3D sge->offset + off; if (sge_len > len) --=20 2.13.6