From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Herbert Xu <herbert@gondor.apana.org.au>,
Steffen Klassert <steffen.klassert@secunet.com>
Subject: [PATCH 4.13 41/43] ipsec: Fix aborted xfrm policy dump crash
Date: Tue, 31 Oct 2017 10:56:01 +0100 [thread overview]
Message-ID: <20171031095532.133886751@linuxfoundation.org> (raw)
In-Reply-To: <20171031095530.520746935@linuxfoundation.org>
4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 1137b5e2529a8f5ca8ee709288ecba3e68044df2 upstream.
An independent security researcher, Mohamed Ghannam, has reported
this vulnerability to Beyond Security's SecuriTeam Secure Disclosure
program.
The xfrm_dump_policy_done function expects xfrm_dump_policy to
have been called at least once or it will crash. This can be
triggered if a dump fails because the target socket's receive
buffer is full.
This patch fixes it by using the cb->start mechanism to ensure that
the initialisation is always done regardless of the buffer situation.
Fixes: 12a169e7d8f4 ("ipsec: Put dumpers on the dump list")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_user.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1684,32 +1684,34 @@ static int dump_one_policy(struct xfrm_p
static int xfrm_dump_policy_done(struct netlink_callback *cb)
{
- struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
+ struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
struct net *net = sock_net(cb->skb->sk);
xfrm_policy_walk_done(walk, net);
return 0;
}
+static int xfrm_dump_policy_start(struct netlink_callback *cb)
+{
+ struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
+
+ BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args));
+
+ xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
+ return 0;
+}
+
static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
{
struct net *net = sock_net(skb->sk);
- struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
+ struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
struct xfrm_dump_info info;
- BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
- sizeof(cb->args) - sizeof(cb->args[0]));
-
info.in_skb = cb->skb;
info.out_skb = skb;
info.nlmsg_seq = cb->nlh->nlmsg_seq;
info.nlmsg_flags = NLM_F_MULTI;
- if (!cb->args[0]) {
- cb->args[0] = 1;
- xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
- }
-
(void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
return skb->len;
@@ -2467,6 +2469,7 @@ static const struct nla_policy xfrma_spd
static const struct xfrm_link {
int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
+ int (*start)(struct netlink_callback *);
int (*dump)(struct sk_buff *, struct netlink_callback *);
int (*done)(struct netlink_callback *);
const struct nla_policy *nla_pol;
@@ -2480,6 +2483,7 @@ static const struct xfrm_link {
[XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy },
[XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy },
[XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
+ .start = xfrm_dump_policy_start,
.dump = xfrm_dump_policy,
.done = xfrm_dump_policy_done },
[XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
@@ -2532,6 +2536,7 @@ static int xfrm_user_rcv_msg(struct sk_b
{
struct netlink_dump_control c = {
+ .start = link->start,
.dump = link->dump,
.done = link->done,
};
next prev parent reply other threads:[~2017-10-31 9:59 UTC|newest]
Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-31 9:55 [PATCH 4.13 00/43] 4.13.11-stable review Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 01/43] workqueue: replace pool->manager_arb mutex with a flag Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 03/43] ALSA: hda/realtek - Add support for ALC236/ALC3204 Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 04/43] ALSA: hda - fix headset mic problem for Dell machines with alc236 Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 05/43] ceph: unlock dangling spinlock in try_flush_caps() Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 06/43] Fix tracing sample code warning Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 07/43] KVM: PPC: Fix oops when checking KVM_CAP_PPC_HTM Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 08/43] KVM: PPC: Book3S HV: POWER9 more doorbell fixes Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 09/43] KVM: PPC: Book3S: Protect kvmppc_gpa_to_ua() with SRCU Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 10/43] s390/kvm: fix detection of guest machine checks Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 11/43] nbd: handle interrupted sendmsg with a sndtimeo set Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 12/43] spi: uapi: spidev: add missing ioctl header Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 13/43] spi: a3700: Return correct value on timeout detection Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 14/43] spi: bcm-qspi: Fix use after free in bcm_qspi_probe() in error path Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 15/43] spi: armada-3700: Fix failing commands with quad-SPI Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 16/43] ovl: add NULL check in ovl_alloc_inode Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 17/43] ovl: fix EIO from lookup of non-indexed upper Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 18/43] ovl: handle ENOENT on index lookup Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 19/43] ovl: do not cleanup unsupported index entries Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 20/43] fuse: fix READDIRPLUS skipping an entry Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 21/43] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 22/43] xen: fix booting ballooned down hvm guest Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 23/43] cifs: Select all required crypto modules Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 25/43] Input: elan_i2c - add ELAN0611 to the ACPI table Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 26/43] Input: gtco - fix potential out-of-bound access Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 27/43] Fix encryption labels and lengths for SMB3.1.1 Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 28/43] SMB3: Validate negotiate request must always be signed Greg Kroah-Hartman
2017-10-31 13:02 ` Thomas Backlund
2017-11-01 15:17 ` Greg Kroah-Hartman
2017-11-01 15:18 ` Greg Kroah-Hartman
2018-01-04 2:15 ` Srivatsa S. Bhat
2018-01-18 21:25 ` Srivatsa S. Bhat
2018-01-19 13:23 ` Aurélien Aptel
2018-01-30 3:31 ` Srivatsa S. Bhat
2018-02-27 3:44 ` Srivatsa S. Bhat
2018-02-27 8:54 ` Greg Kroah-Hartman
2018-02-27 9:22 ` Srivatsa S. Bhat
2018-02-27 12:40 ` Greg Kroah-Hartman
2018-02-27 17:45 ` Srivatsa S. Bhat
2018-02-27 17:55 ` Steve French
2018-02-27 17:56 ` Steve French
2018-02-27 18:33 ` Srivatsa S. Bhat
2018-03-12 2:37 ` Steve French
2018-03-13 9:21 ` Greg Kroah-Hartman
2018-03-13 15:21 ` Steve French
2018-03-16 13:32 ` Greg Kroah-Hartman
2018-03-16 16:19 ` Steve French
2018-03-22 2:02 ` Steve French
2018-03-22 5:12 ` Srivatsa S. Bhat
2018-03-22 5:15 ` Srivatsa S. Bhat
2018-03-22 10:32 ` Greg Kroah-Hartman
2018-03-22 19:14 ` Pavel Shilovsky
2018-03-01 20:12 ` Steve French
2018-03-01 20:51 ` Srivatsa S. Bhat
2017-10-31 9:55 ` [PATCH 4.13 29/43] assoc_array: Fix a buggy node-splitting case Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 30/43] scsi: zfcp: fix erp_action use-before-initialize in REC action trace Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 31/43] scsi: aacraid: Fix controller initialization failure Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 32/43] scsi: qla2xxx: Initialize Work element before requesting IRQs Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 33/43] scsi: sg: Re-fix off by one in sg_fill_request_table() Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 34/43] x86/cpu/AMD: Apply the Erratum 688 fix when the BIOS doesnt Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 35/43] drm/amd/powerplay: fix uninitialized variable Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 36/43] drm/i915/perf: fix perf enable/disable ioctls with 32bits userspace Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 37/43] can: sun4i: fix loopback mode Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 38/43] can: kvaser_usb: Correct return value in printout Greg Kroah-Hartman
2017-10-31 9:55 ` [PATCH 4.13 39/43] can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages Greg Kroah-Hartman
2017-10-31 9:56 ` [PATCH 4.13 40/43] cfg80211: fix connect/disconnect edge cases Greg Kroah-Hartman
2017-10-31 9:56 ` Greg Kroah-Hartman [this message]
2017-10-31 9:56 ` [PATCH 4.13 42/43] regulator: fan53555: fix I2C device ids Greg Kroah-Hartman
2017-10-31 17:20 ` [PATCH 4.13 00/43] 4.13.11-stable review Guenter Roeck
2017-11-01 15:21 ` Greg Kroah-Hartman
2017-10-31 20:04 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171031095532.133886751@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).