From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A94FFC43331 for ; Fri, 27 Mar 2020 07:57:29 +0000 (UTC) Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 73E5620714 for ; Fri, 27 Mar 2020 07:57:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 73E5620714 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ucw.cz Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=cip-dev-bounces@lists.cip-project.org Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 1E2C8875AB; Fri, 27 Mar 2020 07:57:29 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZcnF7TC7_oyQ; Fri, 27 Mar 2020 07:57:27 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by fraxinus.osuosl.org (Postfix) with ESMTP id E6DB387484; Fri, 27 Mar 2020 07:57:27 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id CBC7EC0177; Fri, 27 Mar 2020 07:57:27 +0000 (UTC) Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists.linuxfoundation.org (Postfix) with ESMTP id 99EB7C0177 for ; Fri, 27 Mar 2020 07:57:26 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 84A9388808 for ; Fri, 27 Mar 2020 07:57:26 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J+es8FUazchX for ; Fri, 27 Mar 2020 07:57:24 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from jabberwock.ucw.cz (jabberwock.ucw.cz [46.255.230.98]) by whitealder.osuosl.org (Postfix) with ESMTPS id 8739A88802 for ; Fri, 27 Mar 2020 07:57:24 +0000 (UTC) Received: by jabberwock.ucw.cz (Postfix, from userid 1017) id 163D41C0323; Fri, 27 Mar 2020 08:57:21 +0100 (CET) Date: Fri, 27 Mar 2020 08:57:20 +0100 From: Pavel Machek To: cip-dev@lists.cip-project.org, stable@kernel.org, eperezma@redhat.com, mst@redhat.com, davem@davemloft.net Message-ID: <20200327075720.GA32000@duo.ucw.cz> MIME-Version: 1.0 User-Agent: Mutt/1.10.1 (2018-07-13) Subject: [cip-dev] [PATCH 4.4] vhost: Check docket sk_family instead of call getname X-BeenThere: cip-dev@lists.cip-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============7443118387676941657==" Errors-To: cip-dev-bounces@lists.cip-project.org Sender: "cip-dev" --===============7443118387676941657== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="3MwIy2ne0vdjdPXF" Content-Disposition: inline --3MwIy2ne0vdjdPXF Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable =46rom: Eugenio P=E9rez Doing so, we save one call to get data we already have in the struct. Also, since there is no guarantee that getname use sockaddr_ll parameter beyond its size, we add a little bit of security here. It should do not do beyond MAX_ADDR_LEN, but syzbot found that ax25_getname writes more (72 bytes, the size of full_sockaddr_ax25, versus 20 + 32 bytes of sockaddr_ll + MAX_ADDR_LEN in syzbot repro). Fixes: 3a4d5c94e9593 ("vhost_net: a kernel-level virtio server") Reported-by: syzbot+f2a62d07a5198c819c7b@syzkaller.appspotmail.com Signed-off-by: Eugenio P=E9rez Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller Upstream: 42d84c8490f9f0931786f1623191fcab397c3d64 Signed-off-by: Pavel Machek --- drivers/vhost/net.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) --- Since it is a security problem, I backported the patch to 4.4. I compile tested it on cip test farm, but it was only built for single target, probably due to too big config. diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index 1459dc9fd701..5efac33c29dc 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -815,11 +815,7 @@ static int vhost_net_release(struct inode *inode, stru= ct file *f) =20 static struct socket *get_raw_socket(int fd) { - struct { - struct sockaddr_ll sa; - char buf[MAX_ADDR_LEN]; - } uaddr; - int uaddr_len =3D sizeof uaddr, r; + int r; struct socket *sock =3D sockfd_lookup(fd, &r); =20 if (!sock) @@ -831,12 +827,7 @@ static struct socket *get_raw_socket(int fd) goto err; } =20 - r =3D sock->ops->getname(sock, (struct sockaddr *)&uaddr.sa, - &uaddr_len, 0); - if (r) - goto err; - - if (uaddr.sa.sll_family !=3D AF_PACKET) { + if (sock->sk->sk_family !=3D AF_PACKET) { r =3D -EPFNOSUPPORT; goto err; } --=20 2.20.1 --=20 (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blo= g.html --3MwIy2ne0vdjdPXF Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABECAB0WIQRPfPO7r0eAhk010v0w5/Bqldv68gUCXn2x4AAKCRAw5/Bqldv6 8oU2AKCNW5qsWL5T8Vz4wUtwK8/AmmexKACgxDclkg1le6/s5CIARX+3EOReQ3M= =C/lz -----END PGP SIGNATURE----- --3MwIy2ne0vdjdPXF-- --===============7443118387676941657== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ cip-dev mailing list cip-dev@lists.cip-project.org https://lists.cip-project.org/mailman/listinfo/cip-dev --===============7443118387676941657==--