From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.1 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 250F5C433E5 for ; Mon, 27 Jul 2020 15:03:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 02B61206E7 for ; Mon, 27 Jul 2020 15:03:23 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="Qoh5rxwE" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730241AbgG0PDW (ORCPT ); Mon, 27 Jul 2020 11:03:22 -0400 Received: from mail.zx2c4.com ([192.95.5.64]:33657 "EHLO mail.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728933AbgG0PDV (ORCPT ); Mon, 27 Jul 2020 11:03:21 -0400 Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 58010e7b; Mon, 27 Jul 2020 14:39:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=date:from:to :cc:subject:message-id:references:mime-version:content-type :in-reply-to; s=mail; bh=e4Ncj5PqOxuE3ONaroBLzrHpd+c=; b=Qoh5rxw E4ipK+7oF4FAXGvGyQT6VIu5cnzAaedp87/f4nZ24qqbi4r0S6rLuYQVbXudh+xO 99wZVZdEftTfV3U58Qyas4D20X9oLmF3+ZOrRcoZGGPBMtw/UBnS5mDFlX53nwQ3 4y+YK+0Lf0FJU2nN2lAvRlVBPPTMG6w4amUbqly/mlHgyL1B4Nf9kT64IIu53y9T u5hByM6CogNFuzrdCCHYLAOIub3eMmAcMs5HlyJpDmEpP3aYT0/5fhT9mzv6s3tJ e3sjwNkGyyDF3HX5B00L9mYUMASGIdL1UuQ+tbrvm+L6NQ0CP4GaybSPFSC1SlZS k03jp9ulXwzPOkw== Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 6d99ea56 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Mon, 27 Jul 2020 14:39:58 +0000 (UTC) Date: Mon, 27 Jul 2020 17:03:10 +0200 From: "Jason A. Donenfeld" To: Christoph Hellwig Cc: "David S. Miller" , Jakub Kicinski , Alexei Starovoitov , Daniel Borkmann , Alexey Kuznetsov , Hideaki YOSHIFUJI , Eric Dumazet , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-sctp@vger.kernel.org, linux-hams@vger.kernel.org, linux-bluetooth@vger.kernel.org, bridge@lists.linux-foundation.org, linux-can@vger.kernel.org, dccp@vger.kernel.org, linux-decnet-user@lists.sourceforge.net, linux-wpan@vger.kernel.org, linux-s390@vger.kernel.org, mptcp@lists.01.org, lvs-devel@vger.kernel.org, rds-devel@oss.oracle.com, linux-afs@lists.infradead.org, tipc-discussion@lists.sourceforge.net, linux-x25@vger.kernel.org Subject: Re: [PATCH 12/26] netfilter: switch nf_setsockopt to sockptr_t Message-ID: <20200727150310.GA1632472@zx2c4.com> References: <20200723060908.50081-1-hch@lst.de> <20200723060908.50081-13-hch@lst.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20200723060908.50081-13-hch@lst.de> Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Hi Christoph, On Thu, Jul 23, 2020 at 08:08:54AM +0200, Christoph Hellwig wrote: > diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c > index da933f99b5d517..42befbf12846c0 100644 > --- a/net/ipv4/ip_sockglue.c > +++ b/net/ipv4/ip_sockglue.c > @@ -1422,7 +1422,8 @@ int ip_setsockopt(struct sock *sk, int level, > optname != IP_IPSEC_POLICY && > optname != IP_XFRM_POLICY && > !ip_mroute_opt(optname)) > - err = nf_setsockopt(sk, PF_INET, optname, optval, optlen); > + err = nf_setsockopt(sk, PF_INET, optname, USER_SOCKPTR(optval), > + optlen); > #endif > return err; > } > diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c > index 4697d09c98dc3e..f2a9680303d8c0 100644 > --- a/net/ipv4/netfilter/ip_tables.c > +++ b/net/ipv4/netfilter/ip_tables.c > @@ -1102,7 +1102,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks, > } > > static int > -do_replace(struct net *net, const void __user *user, unsigned int len) > +do_replace(struct net *net, sockptr_t arg, unsigned int len) > { > int ret; > struct ipt_replace tmp; > @@ -1110,7 +1110,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len) > void *loc_cpu_entry; > struct ipt_entry *iter; > > - if (copy_from_user(&tmp, user, sizeof(tmp)) != 0) > + if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) > return -EFAULT; > > /* overflow check */ > @@ -1126,8 +1126,8 @@ do_replace(struct net *net, const void __user *user, unsigned int len) > return -ENOMEM; > > loc_cpu_entry = newinfo->entries; > - if (copy_from_user(loc_cpu_entry, user + sizeof(tmp), > - tmp.size) != 0) { > + sockptr_advance(arg, sizeof(tmp)); > + if (copy_from_sockptr(loc_cpu_entry, arg, tmp.size) != 0) { > ret = -EFAULT; > goto free_newinfo; > } Something along this path seems to have broken with this patch. An invocation of `iptables -A INPUT -m length --length 1360 -j DROP` now fails, with nf_setsockopt->do_replace->translate_table->check_entry_size_and_hooks: (unsigned char *)e + e->next_offset > limit ==> TRUE resulting in the whole call chain returning -EINVAL. It bisects back to this commit. This is on net-next. Jason