All of lore.kernel.org
 help / color / mirror / Atom feed
From: Peilin Ye <yepeilin.cs@gmail.com>
To: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Wensong Zhang <wensong@linux-vs.org>,
	coreteam@netfilter.org, Florian Westphal <fw@strlen.de>,
	LKML <linux-kernel@vger.kernel.org>,
	Jozsef Kadlecsik <kadlec@netfilter.org>,
	lvs-devel@vger.kernel.org, Julian Anastasov <ja@ssi.bg>,
	Simon Horman <horms@verge.net.au>,
	NetFilter <netfilter-devel@vger.kernel.org>,
	Linux Kernel Network Developers <netdev@vger.kernel.org>,
	Jakub Kicinski <kuba@kernel.org>,
	syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
	linux-kernel-mentees@lists.linuxfoundation.org,
	"David S. Miller" <davem@davemloft.net>,
	Pablo Neira Ayuso <pablo@netfilter.org>
Subject: Re: [Linux-kernel-mentees] [PATCH net] ipvs: Fix uninit-value in do_ip_vs_set_ctl()
Date: Tue, 11 Aug 2020 01:09:29 -0400	[thread overview]
Message-ID: <20200811050929.GA821443@PWN> (raw)
In-Reply-To: <CAM_iQpWsQubVJ-AYaLHujHwz68+nsHBcbgbf8XPMEPD=Vu+zaA@mail.gmail.com>

On Mon, Aug 10, 2020 at 08:57:19PM -0700, Cong Wang wrote:
> On Mon, Aug 10, 2020 at 3:10 PM Peilin Ye <yepeilin.cs@gmail.com> wrote:
> >
> > do_ip_vs_set_ctl() is referencing uninitialized stack value when `len` is
> > zero. Fix it.
> 
> Which exact 'cmd' is it here?
> 
> I _guess_ it is one of those uninitialized in set_arglen[], which is 0.

Yes, it was `IP_VS_SO_SET_NONE`, implicitly initialized to zero.

> But if that is the case, should it be initialized to
> sizeof(struct ip_vs_service_user) instead because ip_vs_copy_usvc_compat()
> is called anyway. Or, maybe we should just ban len==0 case.

I see. I think the latter would be easier, but we cannot ban all of
them, since the function does something with `IP_VS_SO_SET_FLUSH`, which
is a `len == 0` case.

Maybe we do something like this?

@@ -2432,6 +2432,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)

 	if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
 		return -EINVAL;
+	if (len == 0 && cmd != IP_VS_SO_SET_FLUSH)
+		return -EINVAL;
 	if (len != set_arglen[CMDID(cmd)]) {
 		IP_VS_DBG(1, "set_ctl: len %u != %u\n",
 			  len, set_arglen[CMDID(cmd)]);
@@ -2547,9 +2549,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		break;
 	case IP_VS_SO_SET_DELDEST:
 		ret = ip_vs_del_dest(svc, &udest);
-		break;
-	default:
-		ret = -EINVAL;
 	}

   out_unlock:

Thank you,
Peilin Ye

> In either case, it does not look like you fix it correctly.
> 
> Thanks.
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

WARNING: multiple messages have this Message-ID (diff)
From: Peilin Ye <yepeilin.cs@gmail.com>
To: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Wensong Zhang <wensong@linux-vs.org>,
	Simon Horman <horms@verge.net.au>, Julian Anastasov <ja@ssi.bg>,
	Pablo Neira Ayuso <pablo@netfilter.org>,
	Jozsef Kadlecsik <kadlec@netfilter.org>,
	Florian Westphal <fw@strlen.de>,
	"David S. Miller" <davem@davemloft.net>,
	Jakub Kicinski <kuba@kernel.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Linux Kernel Network Developers <netdev@vger.kernel.org>,
	lvs-devel@vger.kernel.org,
	NetFilter <netfilter-devel@vger.kernel.org>,
	coreteam@netfilter.org,
	linux-kernel-mentees@lists.linuxfoundation.org,
	syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
	LKML <linux-kernel@vger.kernel.org>
Subject: Re: [Linux-kernel-mentees] [PATCH net] ipvs: Fix uninit-value in do_ip_vs_set_ctl()
Date: Tue, 11 Aug 2020 01:09:29 -0400	[thread overview]
Message-ID: <20200811050929.GA821443@PWN> (raw)
In-Reply-To: <CAM_iQpWsQubVJ-AYaLHujHwz68+nsHBcbgbf8XPMEPD=Vu+zaA@mail.gmail.com>

On Mon, Aug 10, 2020 at 08:57:19PM -0700, Cong Wang wrote:
> On Mon, Aug 10, 2020 at 3:10 PM Peilin Ye <yepeilin.cs@gmail.com> wrote:
> >
> > do_ip_vs_set_ctl() is referencing uninitialized stack value when `len` is
> > zero. Fix it.
> 
> Which exact 'cmd' is it here?
> 
> I _guess_ it is one of those uninitialized in set_arglen[], which is 0.

Yes, it was `IP_VS_SO_SET_NONE`, implicitly initialized to zero.

> But if that is the case, should it be initialized to
> sizeof(struct ip_vs_service_user) instead because ip_vs_copy_usvc_compat()
> is called anyway. Or, maybe we should just ban len==0 case.

I see. I think the latter would be easier, but we cannot ban all of
them, since the function does something with `IP_VS_SO_SET_FLUSH`, which
is a `len == 0` case.

Maybe we do something like this?

@@ -2432,6 +2432,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)

 	if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
 		return -EINVAL;
+	if (len == 0 && cmd != IP_VS_SO_SET_FLUSH)
+		return -EINVAL;
 	if (len != set_arglen[CMDID(cmd)]) {
 		IP_VS_DBG(1, "set_ctl: len %u != %u\n",
 			  len, set_arglen[CMDID(cmd)]);
@@ -2547,9 +2549,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		break;
 	case IP_VS_SO_SET_DELDEST:
 		ret = ip_vs_del_dest(svc, &udest);
-		break;
-	default:
-		ret = -EINVAL;
 	}

   out_unlock:

Thank you,
Peilin Ye

> In either case, it does not look like you fix it correctly.
> 
> Thanks.

  reply	other threads:[~2020-08-11  5:09 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-10 22:07 [Linux-kernel-mentees] [PATCH net] ipvs: Fix uninit-value in do_ip_vs_set_ctl() Peilin Ye
2020-08-10 22:07 ` Peilin Ye
2020-08-11  3:57 ` Cong Wang
2020-08-11  3:57   ` Cong Wang
2020-08-11  5:09   ` Peilin Ye [this message]
2020-08-11  5:09     ` Peilin Ye
2020-08-11  6:58     ` Julian Anastasov
2020-08-11  6:58       ` Julian Anastasov
2020-08-11  7:19       ` Peilin Ye
2020-08-11  7:19         ` Peilin Ye
2020-08-11  7:46 ` [Linux-kernel-mentees] [PATCH net-next v2] " Peilin Ye
2020-08-11  7:46   ` Peilin Ye
2020-08-11 10:29   ` Julian Anastasov
2020-08-11 10:29     ` Julian Anastasov
2020-08-11 10:29     ` Julian Anastasov
2020-08-11 12:59     ` Simon Horman
2020-08-11 12:59       ` Simon Horman
2020-08-13  1:28       ` Pablo Neira Ayuso
2020-08-13  1:28         ` Pablo Neira Ayuso
2020-08-28 17:21   ` Pablo Neira Ayuso
2020-08-28 17:21     ` Pablo Neira Ayuso

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200811050929.GA821443@PWN \
    --to=yepeilin.cs@gmail.com \
    --cc=coreteam@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=fw@strlen.de \
    --cc=horms@verge.net.au \
    --cc=ja@ssi.bg \
    --cc=kadlec@netfilter.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel-mentees@lists.linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lvs-devel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=wensong@linux-vs.org \
    --cc=xiyou.wangcong@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.