[PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1

All of lore.kernel.org
 help / color / mirror / Atom feed

* [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1
@ 2024-11-19  2:05 Xiangyu Chen
  2024-11-19 12:31   ` Sasha Levin
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Xiangyu Chen @ 2024-11-19  2:05 UTC (permalink / raw)
  To: edumazet, gregkh; +Cc: stable, xiangyu.chen

From: Xiangyu Chen <xiangyu.chen@windriver.com>

Following series is a backport of CVE-2024-36915

The fix is "nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies"
This required 1 extra commit to make sure the picks are clean:
net: add copy_safe_from_sockptr() helper


Eric Dumazet (2):
  net: add copy_safe_from_sockptr() helper
  nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies

 include/linux/sockptr.h | 25 +++++++++++++++++++++++++
 net/nfc/llcp_sock.c     | 12 ++++++------
 2 files changed, 31 insertions(+), 6 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper
@ 2024-11-19 12:31   ` Sasha Levin
  0 siblings, 0 replies; 6+ messages in thread
From: Xiangyu Chen @ 2024-11-19  2:05 UTC (permalink / raw)
  To: edumazet, gregkh; +Cc: stable, xiangyu.chen

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 6309863b31dd80317cd7d6824820b44e254e2a9c ]

copy_from_sockptr() helper is unsafe, unless callers
did the prior check against user provided optlen.

Too many callers get this wrong, lets add a helper to
fix them and avoid future copy/paste bugs.

Instead of :

   if (optlen < sizeof(opt)) {
       err = -EINVAL;
       break;
   }
   if (copy_from_sockptr(&opt, optval, sizeof(opt)) {
       err = -EFAULT;
       break;
   }

Use :

   err = copy_safe_from_sockptr(&opt, sizeof(opt),
                                optval, optlen);
   if (err)
       break;

Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20240408082845.3957374-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 7a87441c9651 ("nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
---
 include/linux/sockptr.h | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h
index bae5e2369b4f..1c1a5d926b17 100644
--- a/include/linux/sockptr.h
+++ b/include/linux/sockptr.h
@@ -50,11 +50,36 @@ static inline int copy_from_sockptr_offset(void *dst, sockptr_t src,
 	return 0;
 }
 
+/* Deprecated.
+ * This is unsafe, unless caller checked user provided optlen.
+ * Prefer copy_safe_from_sockptr() instead.
+ */
 static inline int copy_from_sockptr(void *dst, sockptr_t src, size_t size)
 {
 	return copy_from_sockptr_offset(dst, src, 0, size);
 }
 
+/**
+ * copy_safe_from_sockptr: copy a struct from sockptr
+ * @dst:   Destination address, in kernel space. This buffer must be @ksize
+ *         bytes long.
+ * @ksize: Size of @dst struct.
+ * @optval: Source address. (in user or kernel space)
+ * @optlen: Size of @optval data.
+ *
+ * Returns:
+ *  * -EINVAL: @optlen < @ksize
+ *  * -EFAULT: access to userspace failed.
+ *  * 0 : @ksize bytes were copied
+ */
+static inline int copy_safe_from_sockptr(void *dst, size_t ksize,
+					 sockptr_t optval, unsigned int optlen)
+{
+	if (optlen < ksize)
+		return -EINVAL;
+	return copy_from_sockptr(dst, optval, ksize);
+}
+
 static inline int copy_to_sockptr_offset(sockptr_t dst, size_t offset,
 		const void *src, size_t size)
 {
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper
@ 2024-11-19 12:31   ` Sasha Levin
  0 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2024-11-19 12:31 UTC (permalink / raw)
  To: stable; +Cc: Xiangyu Chen, Sasha Levin

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 6309863b31dd80317cd7d6824820b44e254e2a9c

WARNING: Author mismatch between patch and upstream commit:
Backport author: Xiangyu Chen <xiangyu.chen@eng.windriver.com>
Commit author: Eric Dumazet <edumazet@google.com>

Commit in newer trees:

|-----------------|----------------------------------------------|
| 6.11.y          |  Present (exact SHA1)                        |
| 6.6.y           |  Present (different SHA1: ae7f73e64e9b)      |
| 6.1.y           |  Not found                                   |
|-----------------|----------------------------------------------|

Note: The patch differs from the upstream commit:
---
--- -	2024-11-19 01:37:21.875695197 -0500
+++ /tmp/tmp.N75ESVdFIm	2024-11-19 01:37:21.870628258 -0500
@@ -1,3 +1,5 @@
+[ Upstream commit 6309863b31dd80317cd7d6824820b44e254e2a9c ]
+
 copy_from_sockptr() helper is unsafe, unless callers
 did the prior check against user provided optlen.
 
@@ -25,12 +27,15 @@
 Signed-off-by: Eric Dumazet <edumazet@google.com>
 Link: https://lore.kernel.org/r/20240408082845.3957374-2-edumazet@google.com
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 7a87441c9651 ("nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
 ---
  include/linux/sockptr.h | 25 +++++++++++++++++++++++++
  1 file changed, 25 insertions(+)
 
 diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h
-index 307961b41541a..317200cd3a603 100644
+index bae5e2369b4f..1c1a5d926b17 100644
 --- a/include/linux/sockptr.h
 +++ b/include/linux/sockptr.h
 @@ -50,11 +50,36 @@ static inline int copy_from_sockptr_offset(void *dst, sockptr_t src,
@@ -67,6 +72,9 @@
 +	return copy_from_sockptr(dst, optval, ksize);
 +}
 +
- static inline int copy_struct_from_sockptr(void *dst, size_t ksize,
- 		sockptr_t src, size_t usize)
+ static inline int copy_to_sockptr_offset(sockptr_t dst, size_t offset,
+ 		const void *src, size_t size)
  {
+-- 
+2.43.0
+
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |

^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH 6.1.y 2/2] nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
@ 2024-11-19 12:31   ` Sasha Levin
  0 siblings, 0 replies; 6+ messages in thread
From: Xiangyu Chen @ 2024-11-19  2:05 UTC (permalink / raw)
  To: edumazet, gregkh; +Cc: stable, xiangyu.chen

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 7a87441c9651ba37842f4809224aca13a554a26f ]

syzbot reported unsafe calls to copy_from_sockptr() [1]

Use copy_safe_from_sockptr() instead.

[1]

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
 BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]
 BUG: KASAN: slab-out-of-bounds in nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255
Read of size 4 at addr ffff88801caa1ec3 by task syz-executor459/5078

CPU: 0 PID: 5078 Comm: syz-executor459 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
  __dump_stack lib/dump_stack.c:88 [inline]
  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
  print_address_description mm/kasan/report.c:377 [inline]
  print_report+0x169/0x550 mm/kasan/report.c:488
  kasan_report+0x143/0x180 mm/kasan/report.c:601
  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
  copy_from_sockptr include/linux/sockptr.h:55 [inline]
  nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255
  do_sock_setsockopt+0x3b1/0x720 net/socket.c:2311
  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334
  __do_sys_setsockopt net/socket.c:2343 [inline]
  __se_sys_setsockopt net/socket.c:2340 [inline]
  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340
 do_syscall_64+0xfd/0x240
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f7fac07fd89
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff660eb788 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7fac07fd89
RDX: 0000000000000000 RSI: 0000000000000118 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000020000a80 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20240408082845.3957374-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
---
 net/nfc/llcp_sock.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 645677f84dba..cd0fd26196b8 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -252,10 +252,10 @@ static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt),
+					     optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt > LLCP_MAX_RW) {
 			err = -EINVAL;
@@ -274,10 +274,10 @@ static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
 			break;
 		}
 
-		if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
-			err = -EFAULT;
+		err = copy_safe_from_sockptr(&opt, sizeof(opt),
+					     optval, optlen);
+		if (err)
 			break;
-		}
 
 		if (opt > LLCP_MAX_MIUX) {
 			err = -EINVAL;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: [PATCH 6.1.y 2/2] nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
@ 2024-11-19 12:31   ` Sasha Levin
  0 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2024-11-19 12:31 UTC (permalink / raw)
  To: stable; +Cc: Xiangyu Chen, Sasha Levin

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 7a87441c9651ba37842f4809224aca13a554a26f

WARNING: Author mismatch between patch and upstream commit:
Backport author: Xiangyu Chen <xiangyu.chen@eng.windriver.com>
Commit author: Eric Dumazet <edumazet@google.com>

Commit in newer trees:

|-----------------|----------------------------------------------|
| 6.11.y          |  Present (exact SHA1)                        |
| 6.6.y           |  Present (different SHA1: 0f1061332030)      |
| 6.1.y           |  Not found                                   |
|-----------------|----------------------------------------------|

Note: The patch differs from the upstream commit:
---
--- -	2024-11-19 01:54:59.787740708 -0500
+++ /tmp/tmp.ibDHk7fa1x	2024-11-19 01:54:59.783429415 -0500
@@ -1,3 +1,5 @@
+[ Upstream commit 7a87441c9651ba37842f4809224aca13a554a26f ]
+
 syzbot reported unsafe calls to copy_from_sockptr() [1]
 
 Use copy_safe_from_sockptr() instead.
@@ -42,12 +44,14 @@
 Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
 Link: https://lore.kernel.org/r/20240408082845.3957374-4-edumazet@google.com
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
 ---
  net/nfc/llcp_sock.c | 12 ++++++------
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
-index 819157bbb5a2c..d5344563e525c 100644
+index 645677f84dba..cd0fd26196b8 100644
 --- a/net/nfc/llcp_sock.c
 +++ b/net/nfc/llcp_sock.c
 @@ -252,10 +252,10 @@ static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
@@ -78,3 +82,6 @@
  
  		if (opt > LLCP_MAX_MIUX) {
  			err = -EINVAL;
+-- 
+2.43.0
+
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1
  2024-11-19  2:05 [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Xiangyu Chen
  2024-11-19 12:31   ` Sasha Levin
  2024-11-19 12:31   ` Sasha Levin
@ 2024-11-19 13:10 ` Greg KH
  2 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2024-11-19 13:10 UTC (permalink / raw)
  To: Xiangyu Chen; +Cc: edumazet, stable, xiangyu.chen

On Tue, Nov 19, 2024 at 10:05:35AM +0800, Xiangyu Chen wrote:
> From: Xiangyu Chen <xiangyu.chen@windriver.com>
> 
> Following series is a backport of CVE-2024-36915
> 
> The fix is "nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies"
> This required 1 extra commit to make sure the picks are clean:
> net: add copy_safe_from_sockptr() helper
> 
> 
> Eric Dumazet (2):
>   net: add copy_safe_from_sockptr() helper
>   nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
> 
>  include/linux/sockptr.h | 25 +++++++++++++++++++++++++
>  net/nfc/llcp_sock.c     | 12 ++++++------
>  2 files changed, 31 insertions(+), 6 deletions(-)
> 
> -- 
> 2.43.0
> 
> 

Now queued up, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2024-11-19 13:10 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-11-19  2:05 [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Xiangyu Chen
2024-11-19  2:05 ` [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper Xiangyu Chen
2024-11-19 12:31   ` Sasha Levin
2024-11-19  2:05 ` [PATCH 6.1.y 2/2] nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies Xiangyu Chen
2024-11-19 12:31   ` Sasha Levin
2024-11-19 13:10 ` [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Greg KH

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.