* [PATCH v2 0/3] xfrm/compat: syzbot-found fixes
@ 2020-11-02 16:14 Dmitry Safonov
2020-11-02 16:14 ` [PATCH v2 1/3] xfrm/compat: Translate by copying XFRMA_UNSPEC attribute Dmitry Safonov
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Dmitry Safonov @ 2020-11-02 16:14 UTC (permalink / raw)
To: linux-kernel
Cc: Dmitry Safonov, Dmitry Safonov, Steffen Klassert,
David S. Miller, Jakub Kicinski, Herbert Xu, Hillf Danton,
netdev
v2: Added "Fixes" tags to the patches.
WARN_ON() for XFRMA_UNSPEC translation which likely no-one except
syzkaller uses; properly zerofy tail-padding for 64-bit attribute;
don't use __GFP_ZERO as the memory is initialized during translation.
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Hillf Danton <hdanton@sina.com>
Cc: netdev@vger.kernel.org
Thanks,
Dmitry
Dmitry Safonov (3):
xfrm/compat: Translate by copying XFRMA_UNSPEC attribute
xfrm/compat: memset(0) 64-bit padding at right place
xfrm/compat: Don't allocate memory with __GFP_ZERO
net/xfrm/xfrm_compat.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
base-commit: 3cea11cd5e3b00d91caf0b4730194039b45c5891
--
2.28.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2 1/3] xfrm/compat: Translate by copying XFRMA_UNSPEC attribute
2020-11-02 16:14 [PATCH v2 0/3] xfrm/compat: syzbot-found fixes Dmitry Safonov
@ 2020-11-02 16:14 ` Dmitry Safonov
2020-11-02 16:14 ` [PATCH v2 2/3] xfrm/compat: memset(0) 64-bit padding at right place Dmitry Safonov
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Dmitry Safonov @ 2020-11-02 16:14 UTC (permalink / raw)
To: linux-kernel
Cc: Dmitry Safonov, Dmitry Safonov, Steffen Klassert,
David S. Miller, Jakub Kicinski, Herbert Xu, Hillf Danton,
netdev, syzbot+a7e701c8385bd8543074
xfrm_xlate32() translates 64-bit message provided by kernel to be sent
for 32-bit listener (acknowledge or monitor). Translator code doesn't
expect XFRMA_UNSPEC attribute as it doesn't know its payload.
Kernel never attaches such attribute, but a user can.
I've searched if any opensource does it and the answer is no.
Nothing on github and google finds only tfcproject that has such code
commented-out.
What will happen if a user sends a netlink message with XFRMA_UNSPEC
attribute? Ipsec code ignores this attribute. But if there is a
monitor-process or 32-bit user requested ack - kernel will try to
translate such message and will hit WARN_ONCE() in xfrm_xlate64_attr().
Deal with XFRMA_UNSPEC by copying the attribute payload with
xfrm_nla_cpy(). In result, the default switch-case in xfrm_xlate64_attr()
becomes an unused code. Leave those 3 lines in case a new xfrm attribute
will be added.
Fixes: 5461fc0c8d9f ("xfrm/compat: Add 64=>32-bit messages translator")
Reported-by: syzbot+a7e701c8385bd8543074@syzkaller.appspotmail.com
Signed-off-by: Dmitry Safonov <dima@arista.com>
---
net/xfrm/xfrm_compat.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
index e28f0c9ecd6a..17edbf935e35 100644
--- a/net/xfrm/xfrm_compat.c
+++ b/net/xfrm/xfrm_compat.c
@@ -234,6 +234,7 @@ static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src)
case XFRMA_PAD:
/* Ignore */
return 0;
+ case XFRMA_UNSPEC:
case XFRMA_ALG_AUTH:
case XFRMA_ALG_CRYPT:
case XFRMA_ALG_COMP:
--
2.28.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v2 2/3] xfrm/compat: memset(0) 64-bit padding at right place
2020-11-02 16:14 [PATCH v2 0/3] xfrm/compat: syzbot-found fixes Dmitry Safonov
2020-11-02 16:14 ` [PATCH v2 1/3] xfrm/compat: Translate by copying XFRMA_UNSPEC attribute Dmitry Safonov
@ 2020-11-02 16:14 ` Dmitry Safonov
2020-11-02 16:14 ` [PATCH v2 3/3] xfrm/compat: Don't allocate memory with __GFP_ZERO Dmitry Safonov
2020-11-10 6:35 ` [PATCH v2 0/3] xfrm/compat: syzbot-found fixes Steffen Klassert
3 siblings, 0 replies; 5+ messages in thread
From: Dmitry Safonov @ 2020-11-02 16:14 UTC (permalink / raw)
To: linux-kernel
Cc: Dmitry Safonov, Dmitry Safonov, Steffen Klassert,
David S. Miller, Jakub Kicinski, Herbert Xu, Hillf Danton,
netdev, syzbot+c43831072e7df506a646
32-bit messages translated by xfrm_compat can have attributes attached.
For all, but XFRMA_SA, XFRMA_POLICY the size of payload is the same
in 32-bit UABI and 64-bit UABI. For XFRMA_SA (struct xfrm_usersa_info)
and XFRMA_POLICY (struct xfrm_userpolicy_info) it's only tail-padding
that is present in 64-bit payload, but not in 32-bit.
The proper size for destination nlattr is already calculated by
xfrm_user_rcv_calculate_len64() and allocated with kvmalloc().
xfrm_attr_cpy32() copies 32-bit copy_len into 64-bit attribute
translated payload, zero-filling possible padding for SA/POLICY.
Due to a typo, *pos already has 64-bit payload size, in a result next
memset(0) is called on the memory after the translated attribute, not on
the tail-padding of it.
Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
Reported-by: syzbot+c43831072e7df506a646@syzkaller.appspotmail.com
Signed-off-by: Dmitry Safonov <dima@arista.com>
---
net/xfrm/xfrm_compat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
index 17edbf935e35..556e9f33b815 100644
--- a/net/xfrm/xfrm_compat.c
+++ b/net/xfrm/xfrm_compat.c
@@ -388,7 +388,7 @@ static int xfrm_attr_cpy32(void *dst, size_t *pos, const struct nlattr *src,
memcpy(nla, src, nla_attr_size(copy_len));
nla->nla_len = nla_attr_size(payload);
- *pos += nla_attr_size(payload);
+ *pos += nla_attr_size(copy_len);
nlmsg->nlmsg_len += nla->nla_len;
memset(dst + *pos, 0, payload - copy_len);
--
2.28.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v2 3/3] xfrm/compat: Don't allocate memory with __GFP_ZERO
2020-11-02 16:14 [PATCH v2 0/3] xfrm/compat: syzbot-found fixes Dmitry Safonov
2020-11-02 16:14 ` [PATCH v2 1/3] xfrm/compat: Translate by copying XFRMA_UNSPEC attribute Dmitry Safonov
2020-11-02 16:14 ` [PATCH v2 2/3] xfrm/compat: memset(0) 64-bit padding at right place Dmitry Safonov
@ 2020-11-02 16:14 ` Dmitry Safonov
2020-11-10 6:35 ` [PATCH v2 0/3] xfrm/compat: syzbot-found fixes Steffen Klassert
3 siblings, 0 replies; 5+ messages in thread
From: Dmitry Safonov @ 2020-11-02 16:14 UTC (permalink / raw)
To: linux-kernel
Cc: Dmitry Safonov, Dmitry Safonov, Steffen Klassert,
David S. Miller, Jakub Kicinski, Herbert Xu, Hillf Danton,
netdev
32-bit to 64-bit messages translator zerofies needed paddings in the
translation, the rest is the actual payload.
Don't allocate zero pages as they are not needed.
Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
Signed-off-by: Dmitry Safonov <dima@arista.com>
---
net/xfrm/xfrm_compat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
index 556e9f33b815..d8e8a11ca845 100644
--- a/net/xfrm/xfrm_compat.c
+++ b/net/xfrm/xfrm_compat.c
@@ -564,7 +564,7 @@ static struct nlmsghdr *xfrm_user_rcv_msg_compat(const struct nlmsghdr *h32,
return NULL;
len += NLMSG_HDRLEN;
- h64 = kvmalloc(len, GFP_KERNEL | __GFP_ZERO);
+ h64 = kvmalloc(len, GFP_KERNEL);
if (!h64)
return ERR_PTR(-ENOMEM);
--
2.28.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2 0/3] xfrm/compat: syzbot-found fixes
2020-11-02 16:14 [PATCH v2 0/3] xfrm/compat: syzbot-found fixes Dmitry Safonov
` (2 preceding siblings ...)
2020-11-02 16:14 ` [PATCH v2 3/3] xfrm/compat: Don't allocate memory with __GFP_ZERO Dmitry Safonov
@ 2020-11-10 6:35 ` Steffen Klassert
3 siblings, 0 replies; 5+ messages in thread
From: Steffen Klassert @ 2020-11-10 6:35 UTC (permalink / raw)
To: Dmitry Safonov
Cc: linux-kernel, Dmitry Safonov, David S. Miller, Jakub Kicinski,
Herbert Xu, Hillf Danton, netdev
On Mon, Nov 02, 2020 at 04:14:44PM +0000, Dmitry Safonov wrote:
> v2: Added "Fixes" tags to the patches.
>
> WARN_ON() for XFRMA_UNSPEC translation which likely no-one except
> syzkaller uses; properly zerofy tail-padding for 64-bit attribute;
> don't use __GFP_ZERO as the memory is initialized during translation.
>
> Cc: Steffen Klassert <steffen.klassert@secunet.com>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Herbert Xu <herbert@gondor.apana.org.au>
> Cc: Hillf Danton <hdanton@sina.com>
> Cc: netdev@vger.kernel.org
>
> Thanks,
> Dmitry
>
> Dmitry Safonov (3):
> xfrm/compat: Translate by copying XFRMA_UNSPEC attribute
> xfrm/compat: memset(0) 64-bit padding at right place
> xfrm/compat: Don't allocate memory with __GFP_ZERO
Series applied, thanks a lot Dmitry!
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-11-10 6:36 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-02 16:14 [PATCH v2 0/3] xfrm/compat: syzbot-found fixes Dmitry Safonov
2020-11-02 16:14 ` [PATCH v2 1/3] xfrm/compat: Translate by copying XFRMA_UNSPEC attribute Dmitry Safonov
2020-11-02 16:14 ` [PATCH v2 2/3] xfrm/compat: memset(0) 64-bit padding at right place Dmitry Safonov
2020-11-02 16:14 ` [PATCH v2 3/3] xfrm/compat: Don't allocate memory with __GFP_ZERO Dmitry Safonov
2020-11-10 6:35 ` [PATCH v2 0/3] xfrm/compat: syzbot-found fixes Steffen Klassert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).