From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Alban Browaeys <alban.browaeys@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.11 20/88] net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64
Date: Wed, 19 Jul 2017 12:07:42 +0200 [thread overview]
Message-ID: <20170719100823.614090408@linuxfoundation.org> (raw)
In-Reply-To: <20170719100820.364094938@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alban Browaeys <alban.browaeys@gmail.com>
[ Upstream commit 9af9959e142c274f4a30fefb71d97d2b028b337f ]
commit 9256645af098 ("net/core: relax BUILD_BUG_ON in
netdev_stats_to_stats64") made an attempt to read beyond
the size of the source a possibility.
Fix to only copy src size to dest. As dest might be bigger than src.
==================================================================
BUG: KASAN: slab-out-of-bounds in netdev_stats_to_stats64+0xe/0x30 at addr ffff8801be248b20
Read of size 192 by task VBoxNetAdpCtl/6734
CPU: 1 PID: 6734 Comm: VBoxNetAdpCtl Tainted: G O 4.11.4prahal+intel+ #118
Hardware name: LENOVO 20CDCTO1WW/20CDCTO1WW, BIOS GQET52WW (1.32 ) 05/04/2017
Call Trace:
dump_stack+0x63/0x86
kasan_object_err+0x1c/0x70
kasan_report+0x270/0x520
? netdev_stats_to_stats64+0xe/0x30
? sched_clock_cpu+0x1b/0x190
? __module_address+0x3e/0x3b0
? unwind_next_frame+0x1ea/0xb00
check_memory_region+0x13c/0x1a0
memcpy+0x23/0x50
netdev_stats_to_stats64+0xe/0x30
dev_get_stats+0x1b9/0x230
rtnl_fill_stats+0x44/0xc00
? nla_put+0xc6/0x130
rtnl_fill_ifinfo+0xe9e/0x3700
? rtnl_fill_vfinfo+0xde0/0xde0
? sched_clock+0x9/0x10
? sched_clock+0x9/0x10
? sched_clock_local+0x120/0x130
? __module_address+0x3e/0x3b0
? unwind_next_frame+0x1ea/0xb00
? sched_clock+0x9/0x10
? sched_clock+0x9/0x10
? sched_clock_cpu+0x1b/0x190
? VBoxNetAdpLinuxIOCtlUnlocked+0x14b/0x280 [vboxnetadp]
? depot_save_stack+0x1d8/0x4a0
? depot_save_stack+0x34f/0x4a0
? depot_save_stack+0x34f/0x4a0
? save_stack+0xb1/0xd0
? save_stack_trace+0x16/0x20
? save_stack+0x46/0xd0
? kasan_slab_alloc+0x12/0x20
? __kmalloc_node_track_caller+0x10d/0x350
? __kmalloc_reserve.isra.36+0x2c/0xc0
? __alloc_skb+0xd0/0x560
? rtmsg_ifinfo_build_skb+0x61/0x120
? rtmsg_ifinfo.part.25+0x16/0xb0
? rtmsg_ifinfo+0x47/0x70
? register_netdev+0x15/0x30
? vboxNetAdpOsCreate+0xc0/0x1c0 [vboxnetadp]
? vboxNetAdpCreate+0x210/0x400 [vboxnetadp]
? VBoxNetAdpLinuxIOCtlUnlocked+0x14b/0x280 [vboxnetadp]
? do_vfs_ioctl+0x17f/0xff0
? SyS_ioctl+0x74/0x80
? do_syscall_64+0x182/0x390
? __alloc_skb+0xd0/0x560
? __alloc_skb+0xd0/0x560
? save_stack_trace+0x16/0x20
? init_object+0x64/0xa0
? ___slab_alloc+0x1ae/0x5c0
? ___slab_alloc+0x1ae/0x5c0
? __alloc_skb+0xd0/0x560
? sched_clock+0x9/0x10
? kasan_unpoison_shadow+0x35/0x50
? kasan_kmalloc+0xad/0xe0
? __kmalloc_node_track_caller+0x246/0x350
? __alloc_skb+0xd0/0x560
? kasan_unpoison_shadow+0x35/0x50
? memset+0x31/0x40
? __alloc_skb+0x31f/0x560
? napi_consume_skb+0x320/0x320
? br_get_link_af_size_filtered+0xb7/0x120 [bridge]
? if_nlmsg_size+0x440/0x630
rtmsg_ifinfo_build_skb+0x83/0x120
rtmsg_ifinfo.part.25+0x16/0xb0
rtmsg_ifinfo+0x47/0x70
register_netdevice+0xa2b/0xe50
? __kmalloc+0x171/0x2d0
? netdev_change_features+0x80/0x80
register_netdev+0x15/0x30
vboxNetAdpOsCreate+0xc0/0x1c0 [vboxnetadp]
vboxNetAdpCreate+0x210/0x400 [vboxnetadp]
? vboxNetAdpComposeMACAddress+0x1d0/0x1d0 [vboxnetadp]
? kasan_check_write+0x14/0x20
VBoxNetAdpLinuxIOCtlUnlocked+0x14b/0x280 [vboxnetadp]
? VBoxNetAdpLinuxOpen+0x20/0x20 [vboxnetadp]
? lock_acquire+0x11c/0x270
? __audit_syscall_entry+0x2fb/0x660
do_vfs_ioctl+0x17f/0xff0
? __audit_syscall_entry+0x2fb/0x660
? ioctl_preallocate+0x1d0/0x1d0
? __audit_syscall_entry+0x2fb/0x660
? kmem_cache_free+0xb2/0x250
? syscall_trace_enter+0x537/0xd00
? exit_to_usermode_loop+0x100/0x100
SyS_ioctl+0x74/0x80
? do_sys_open+0x350/0x350
? do_vfs_ioctl+0xff0/0xff0
do_syscall_64+0x182/0x390
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7f7e39a1ae07
RSP: 002b:00007ffc6f04c6d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffc6f04c730 RCX: 00007f7e39a1ae07
RDX: 00007ffc6f04c730 RSI: 00000000c0207601 RDI: 0000000000000007
RBP: 00007ffc6f04c700 R08: 00007ffc6f04c780 R09: 0000000000000008
R10: 0000000000000541 R11: 0000000000000206 R12: 0000000000000007
R13: 00000000c0207601 R14: 00007ffc6f04c730 R15: 0000000000000012
Object at ffff8801be248008, in cache kmalloc-4096 size: 4096
Allocated:
PID = 6734
save_stack_trace+0x16/0x20
save_stack+0x46/0xd0
kasan_kmalloc+0xad/0xe0
__kmalloc+0x171/0x2d0
alloc_netdev_mqs+0x8a7/0xbe0
vboxNetAdpOsCreate+0x65/0x1c0 [vboxnetadp]
vboxNetAdpCreate+0x210/0x400 [vboxnetadp]
VBoxNetAdpLinuxIOCtlUnlocked+0x14b/0x280 [vboxnetadp]
do_vfs_ioctl+0x17f/0xff0
SyS_ioctl+0x74/0x80
do_syscall_64+0x182/0x390
return_from_SYSCALL_64+0x0/0x6a
Freed:
PID = 5600
save_stack_trace+0x16/0x20
save_stack+0x46/0xd0
kasan_slab_free+0x73/0xc0
kfree+0xe4/0x220
kvfree+0x25/0x30
single_release+0x74/0xb0
__fput+0x265/0x6b0
____fput+0x9/0x10
task_work_run+0xd5/0x150
exit_to_usermode_loop+0xe2/0x100
do_syscall_64+0x26c/0x390
return_from_SYSCALL_64+0x0/0x6a
Memory state around the buggy address:
ffff8801be248a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801be248b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801be248b80: 00 00 00 00 00 00 00 00 00 00 00 07 fc fc fc fc
^
ffff8801be248c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801be248c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Signed-off-by: Alban Browaeys <alban.browaeys@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7591,7 +7591,7 @@ void netdev_stats_to_stats64(struct rtnl
{
#if BITS_PER_LONG == 64
BUILD_BUG_ON(sizeof(*stats64) < sizeof(*netdev_stats));
- memcpy(stats64, netdev_stats, sizeof(*stats64));
+ memcpy(stats64, netdev_stats, sizeof(*netdev_stats));
/* zero out counters that only exist in rtnl_link_stats64 */
memset((char *)stats64 + sizeof(*netdev_stats), 0,
sizeof(*stats64) - sizeof(*netdev_stats));
next prev parent reply other threads:[~2017-07-19 10:09 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-19 10:07 [PATCH 4.11 00/88] 4.11.12-stable review Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 01/88] net/phy: micrel: configure intterupts after autoneg workaround Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 02/88] ipv6: avoid unregistering inet6_dev for loopback Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 03/88] netvsc: dont access netdev->num_rx_queues directly Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 04/88] sfc: Fix MCDI command size for filter operations Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 06/88] net: dp83640: Avoid NULL pointer dereference Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 07/88] tcp: reset sk_rx_dst in tcp_disconnect() Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 08/88] net: prevent sign extension in dev_get_stats() Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 09/88] virtio-net: serialize tx routine during reset Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 10/88] net: sched: Fix one possible panic when no destroy callback Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 11/88] mlxsw: spectrum_router: Fix NULL pointer dereference Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 12/88] rocker: move dereference before free Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 13/88] bpf: prevent leaking pointer via xadd on unpriviledged Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 15/88] net/mlx5: Cancel delayed recovery work when unloading the driver Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 16/88] net/mlx5e: Fix TX carrier errors report in get stats ndo Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 17/88] ipv6: dad: dont remove dynamic addresses if link is down Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 18/88] vxlan: fix hlist corruption Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 19/88] geneve: " Greg Kroah-Hartman
2017-07-19 10:07 ` Greg Kroah-Hartman [this message]
2017-07-19 10:07 ` [PATCH 4.11 21/88] liquidio: fix bug in soft reset failure detection Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 23/88] vrf: fix bug_on triggered by rx when destroying a vrf Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 24/88] rds: tcp: use sock_create_lite() to create the accept socket Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 25/88] net/mlx5e: Initialize CEEs getpermhwaddr address buffer to 0xff Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 26/88] cxgb4: fix BUG() on interrupt deallocating path of ULD Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 27/88] tap: convert a mutex to a spinlock Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 28/88] bridge: mdb: fix leak on complete_info ptr on fail path Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 30/88] sfc: dont read beyond unicast address list Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 31/88] Adding asm-prototypes.h for genksyms to generate crc Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 32/88] sed regex in Makefile.build requires line break between exported symbols Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 33/88] Adding the type of " Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 34/88] sparc64: Fix gup_huge_pmd Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 35/88] block: Fix a blk_exit_rl() regression Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 36/88] brcmfmac: Fix a memory leak in error handling path in brcmf_cfg80211_attach Greg Kroah-Hartman
2017-07-19 10:07 ` [PATCH 4.11 37/88] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 38/88] efi: Process the MEMATTR table only if EFI_MEMMAP is enabled Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 39/88] cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 40/88] cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 41/88] cfg80211: Check if PMKID attribute is of expected size Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 42/88] cfg80211: Check if NAN service ID " Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 43/88] drm/amdgpu/gfx6: properly cache mc_arb_ramcfg Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 44/88] irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 45/88] parisc: Report SIGSEGV instead of SIGBUS when running out of stack Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 46/88] parisc: use compat_sys_keyctl() Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 47/88] parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 48/88] parisc/mm: Ensure IRQs are off in switch_mm() Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 49/88] tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 50/88] thp, mm: fix crash due race in MADV_FREE handling Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 51/88] kernel/extable.c: mark core_kernel_text notrace Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 52/88] mm/list_lru.c: fix list_lru_count_node() to be race free Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 53/88] fs/dcache.c: fix spin lockup issue on nlru->lock Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 54/88] checkpatch: silence perl 5.26.0 unescaped left brace warnings Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 55/88] binfmt_elf: use ELF_ET_DYN_BASE only for PIE Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 56/88] arm: move ELF_ET_DYN_BASE to 4MB Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 57/88] arm64: move ELF_ET_DYN_BASE to 4GB / 4MB Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 58/88] powerpc: " Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 59/88] s390: reduce ELF_ET_DYN_BASE Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 60/88] exec: Limit arg stack to at most 75% of _STK_LIM Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 61/88] powerpc/kexec: Fix radix to hash kexec due to IAMR/AMOR Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 62/88] ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 63/88] arm64: Preventing READ_IMPLIES_EXEC propagation Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 64/88] vt: fix unchecked __put_user() in tioclinux ioctls Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 65/88] rcu: Add memory barriers for NOCB leader wakeup Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 66/88] nvmem: core: fix leaks on registration errors Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 67/88] Drivers: hv: vmbus: Close timing hole that can corrupt per-cpu page Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 68/88] mnt: In umount propagation reparent in a separate pass Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 69/88] mnt: In propgate_umount handle visiting mounts in any order Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 70/88] mnt: Make propagate_umount less slow for overlapping mount propagation trees Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 71/88] selftests/capabilities: Fix the test_execve test Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 74/88] crypto: atmel - only treat EBUSY as transient if backlog Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 75/88] crypto: sha1-ssse3 - Disable avx2 Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 78/88] sched/fair, cpumask: Export for_each_cpu_wrap() Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 79/88] sched/topology: Fix building of overlapping sched-groups Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 80/88] sched/topology: Optimize build_group_mask() Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 81/88] sched/topology: Fix overlapping sched_group_mask Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 82/88] PM / wakeirq: Convert to SRCU Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 84/88] PM / QoS: return -EINVAL for bogus strings Greg Kroah-Hartman
2017-07-19 10:08 ` [PATCH 4.11 88/88] kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS Greg Kroah-Hartman
2017-07-19 10:27 ` [PATCH 4.11 00/88] 4.11.12-stable review Greg Kroah-Hartman
2017-07-19 20:34 ` Guenter Roeck
2017-07-19 23:38 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170719100823.614090408@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alban.browaeys@gmail.com \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox