From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752297AbdEEMSF (ORCPT <rfc822;w@1wt.eu>);
        Fri, 5 May 2017 08:18:05 -0400
Received: from mail-yw0-f172.google.com ([209.85.161.172]:35647 "EHLO
        mail-yw0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751383AbdEEMSD (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 5 May 2017 08:18:03 -0400
MIME-Version: 1.0
In-Reply-To: <20170505091105.GA9813@secunet.com>
References: <CAAeHK+xqxvEWMXS9sDNi2seUqFzJkijKJhivB8JDehpCJvBAaw@mail.gmail.com>
 <20170505091105.GA9813@secunet.com>
From: Andrey Konovalov <andreyknvl@google.com>
Date: Fri, 5 May 2017 14:18:01 +0200
Message-ID: <CAAeHK+xjbBPqHgBwBEK8=p7zUNCA144GqDSJMwUvz-1NFNQWxw@mail.gmail.com>
Subject: Re: net/key: slab-out-of-bounds in pfkey_compile_policy
To: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>,
        netdev <netdev@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>,
        Dmitry Vyukov <dvyukov@google.com>, Kostya Serebryany <kcc@google.com>,
        Eric Dumazet <edumazet@google.com>,
        Cong Wang <xiyou.wangcong@gmail.com>,
        syzkaller <syzkaller@googlegroups.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, May 5, 2017 at 11:11 AM, Steffen Klassert
<steffen.klassert@secunet.com> wrote:
> On Tue, May 02, 2017 at 06:45:03PM +0200, Andrey Konovalov wrote:
>> Hi,
>>
>> I've got the following error report while fuzzing the kernel with syzkaller.
>>
>> On commit d3b5d35290d729a2518af00feca867385a1b08fa (4.11).
>>
>> A reproducer and .config are attached.
>>
>> ==================================================================
>> BUG: KASAN: slab-out-of-bounds in pfkey_compile_policy+0x8e6/0xd40 at
>> addr ffff88006701f798
>> Read of size 1280 by task a.out/4181
>
>
> This bug was introduced twelve years ago...
>
> This patch is based just on code review, I don't have an option to
> function test this. But I see that we now exit with -EINVAL before the
> memcpy that causes the slab-out-of-bounds when using your reproducer,
> so it should at least fix the bug.

Hi Steffen,

This patch fixes the issue for me.

Thanks!

Tested-by: Andrey Konovalov <andreyknvl@google.com>

>
> Subject: [PATCH RFC] af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
>
> The sadb_x_sec_len is stored in the unit 'byte divided by eight'.
> So we have to multiply this value by eight before we can do
> size checks. Otherwise we may get a slab-out-of-bounds when
> we memcpy the user sec_ctx.
>
> Fixes: df71837d502 ("[LSM-IPSec]: Security association restriction.")
> Reported-by: Andrey Konovalov <andreyknvl@google.com>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
> ---
>  net/key/af_key.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/key/af_key.c b/net/key/af_key.c
> index c1950bb..512dc43 100644
> --- a/net/key/af_key.c
> +++ b/net/key/af_key.c
> @@ -3285,7 +3285,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
>                 p += pol->sadb_x_policy_len*8;
>                 sec_ctx = (struct sadb_x_sec_ctx *)p;
>                 if (len < pol->sadb_x_policy_len*8 +
> -                   sec_ctx->sadb_x_sec_len) {
> +                   sec_ctx->sadb_x_sec_len*8) {
>                         *dir = -EINVAL;
>                         goto out;
>                 }
> --
> 2.7.4
>
>