From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Neil Horman <nhorman@tuxdriver.com>,
Vlad Yasevich <vyasevich@gmail.com>,
netdev <netdev@vger.kernel.org>,
linux-sctp@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
David Miller <davem@davemloft.net>,
syzkaller <syzkaller@googlegroups.com>,
Kostya Serebryany <kcc@google.com>,
Alexander Potapenko <glider@google.com>,
Sasha Levin <sasha.levin@oracle.com>,
Eric Dumazet <edumazet@google.com>
Subject: Re: [PATCH net] sctp: fix copying more bytes than expected in sctp_add_bind_addr
Date: Mon, 7 Mar 2016 17:00:08 -0300 [thread overview]
Message-ID: <20160307200008.GJ31743@localhost.localdomain> (raw)
In-Reply-To: <CACT4Y+bqn=qWoBiXdV_d1wtedKza4_Nu2uFe4Bui70OPAVGi3A@mail.gmail.com>
On Mon, Mar 07, 2016 at 08:56:08PM +0100, Dmitry Vyukov wrote:
> I kept the patch applied.
Then Dave, please consider applying this patch.
Thanks.
> On Mon, Mar 7, 2016 at 8:51 PM, Marcelo Ricardo Leitner
> <marcelo.leitner@gmail.com> wrote:
> > On Mon, Mar 07, 2016 at 08:45:20PM +0100, Dmitry Vyukov wrote:
> >> Yes, it is. I never saw this bug again. Forgot to update this thread. Sorry.
> >
> > Cool, thanks. The patch isn't applied yet, so either some other patch
> > fixed it and this patch not necessary anymore or you kept the patch
> > applied. Please confirm which one :-)
> >
> >> On Mon, Mar 7, 2016 at 8:44 PM, Marcelo Ricardo Leitner
> >> <marcelo.leitner@gmail.com> wrote:
> >> > On Tue, Jan 26, 2016 at 02:28:48PM +0100, Dmitry Vyukov wrote:
> >> >> On Mon, Jan 25, 2016 at 6:52 PM, Marcelo Ricardo Leitner
> >> >> <marcelo.leitner@gmail.com> wrote:
> >> >> > Great. Dmitry, please give this a run. Local tests looked good but who
> >> >> > knows what syzkaller may find.
> >> >>
> >> >> Now running with this patch.
> >> >
> >> > Hi Dmitry, do you remember if this one succeeded?
> >> >
> >> >> > Thanks
> >> >> >
> >> >> > --8<--
> >> >> >
> >> >> > Dmitry reported that sctp_add_bind_addr may read more bytes than
> >> >> > expected in case the parameter is a IPv4 addr supplied by the user
> >> >> > through calls such as sctp_bindx_add(), because it always copies
> >> >> > sizeof(union sctp_addr) while the buffer may be just a struct
> >> >> > sockaddr_in, which is smaller.
> >> >> >
> >> >> > This patch then fixes it by limiting the memcpy to the min between the
> >> >> > union size and a (new parameter) provided addr size. Where possible this
> >> >> > parameter still is the size of that union, except for reading from
> >> >> > user-provided buffers, which then it accounts for protocol type.
> >> >> >
> >> >> > Reported-by: Dmitry Vyukov <dvyukov@google.com>
> >> >> > Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
> >> >> > ---
> >> >> > include/net/sctp/structs.h | 2 +-
> >> >> > net/sctp/bind_addr.c | 14 ++++++++------
> >> >> > net/sctp/protocol.c | 1 +
> >> >> > net/sctp/sm_make_chunk.c | 2 +-
> >> >> > net/sctp/socket.c | 5 +++--
> >> >> > 5 files changed, 14 insertions(+), 10 deletions(-)
> >> >> >
> >> >> > diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
> >> >> > index 20e72129be1ce0063eeafcbaadcee1f37e0c614c..97ba8a8c466f5c50bdc87ec578792e56553baa91 100644
> >> >> > --- a/include/net/sctp/structs.h
> >> >> > +++ b/include/net/sctp/structs.h
> >> >> > @@ -1099,7 +1099,7 @@ int sctp_bind_addr_dup(struct sctp_bind_addr *dest,
> >> >> > const struct sctp_bind_addr *src,
> >> >> > gfp_t gfp);
> >> >> > int sctp_add_bind_addr(struct sctp_bind_addr *, union sctp_addr *,
> >> >> > - __u8 addr_state, gfp_t gfp);
> >> >> > + int new_size, __u8 addr_state, gfp_t gfp);
> >> >> > int sctp_del_bind_addr(struct sctp_bind_addr *, union sctp_addr *);
> >> >> > int sctp_bind_addr_match(struct sctp_bind_addr *, const union sctp_addr *,
> >> >> > struct sctp_sock *);
> >> >> > diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
> >> >> > index 871cdf9567e6bc9c13cb1077dc6866a67e6e4367..80129d10a0af9c33e7348b79d010b9e5e948e584 100644
> >> >> > --- a/net/sctp/bind_addr.c
> >> >> > +++ b/net/sctp/bind_addr.c
> >> >> > @@ -111,7 +111,8 @@ int sctp_bind_addr_dup(struct sctp_bind_addr *dest,
> >> >> > dest->port = src->port;
> >> >> >
> >> >> > list_for_each_entry(addr, &src->address_list, list) {
> >> >> > - error = sctp_add_bind_addr(dest, &addr->a, 1, gfp);
> >> >> > + error = sctp_add_bind_addr(dest, &addr->a, sizeof(addr->a),
> >> >> > + 1, gfp);
> >> >> > if (error < 0)
> >> >> > break;
> >> >> > }
> >> >> > @@ -150,7 +151,7 @@ void sctp_bind_addr_free(struct sctp_bind_addr *bp)
> >> >> >
> >> >> > /* Add an address to the bind address list in the SCTP_bind_addr structure. */
> >> >> > int sctp_add_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *new,
> >> >> > - __u8 addr_state, gfp_t gfp)
> >> >> > + int new_size, __u8 addr_state, gfp_t gfp)
> >> >> > {
> >> >> > struct sctp_sockaddr_entry *addr;
> >> >> >
> >> >> > @@ -159,7 +160,7 @@ int sctp_add_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *new,
> >> >> > if (!addr)
> >> >> > return -ENOMEM;
> >> >> >
> >> >> > - memcpy(&addr->a, new, sizeof(*new));
> >> >> > + memcpy(&addr->a, new, min_t(size_t, sizeof(*new), new_size));
> >> >> >
> >> >> > /* Fix up the port if it has not yet been set.
> >> >> > * Both v4 and v6 have the port at the same offset.
> >> >> > @@ -291,7 +292,8 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
> >> >> > }
> >> >> >
> >> >> > af->from_addr_param(&addr, rawaddr, htons(port), 0);
> >> >> > - retval = sctp_add_bind_addr(bp, &addr, SCTP_ADDR_SRC, gfp);
> >> >> > + retval = sctp_add_bind_addr(bp, &addr, sizeof(addr),
> >> >> > + SCTP_ADDR_SRC, gfp);
> >> >> > if (retval) {
> >> >> > /* Can't finish building the list, clean up. */
> >> >> > sctp_bind_addr_clean(bp);
> >> >> > @@ -453,8 +455,8 @@ static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest,
> >> >> > (((AF_INET6 == addr->sa.sa_family) &&
> >> >> > (flags & SCTP_ADDR6_ALLOWED) &&
> >> >> > (flags & SCTP_ADDR6_PEERSUPP))))
> >> >> > - error = sctp_add_bind_addr(dest, addr, SCTP_ADDR_SRC,
> >> >> > - gfp);
> >> >> > + error = sctp_add_bind_addr(dest, addr, sizeof(addr),
> >> >> > + SCTP_ADDR_SRC, gfp);
> >> >> > }
> >> >> >
> >> >> > return error;
> >> >> > diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
> >> >> > index ab0d538a74ed593571cfaef02cd1bb7ce872abe6..2fb609008311f51344704d82f21b4de9f08253da 100644
> >> >> > --- a/net/sctp/protocol.c
> >> >> > +++ b/net/sctp/protocol.c
> >> >> > @@ -214,6 +214,7 @@ int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *bp,
> >> >> > (copy_flags & SCTP_ADDR6_ALLOWED) &&
> >> >> > (copy_flags & SCTP_ADDR6_PEERSUPP)))) {
> >> >> > error = sctp_add_bind_addr(bp, &addr->a,
> >> >> > + sizeof(addr->a),
> >> >> > SCTP_ADDR_SRC, GFP_ATOMIC);
> >> >> > if (error)
> >> >> > goto end_copy;
> >> >> > diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
> >> >> > index 5d6a03fad3789a12290f5f14c5a7efa69c98f41a..1b91e9760fe514db6d89457e1d5da9e02800745e 100644
> >> >> > --- a/net/sctp/sm_make_chunk.c
> >> >> > +++ b/net/sctp/sm_make_chunk.c
> >> >> > @@ -1830,7 +1830,7 @@ no_hmac:
> >> >> > /* Also, add the destination address. */
> >> >> > if (list_empty(&retval->base.bind_addr.address_list)) {
> >> >> > sctp_add_bind_addr(&retval->base.bind_addr, &chunk->dest,
> >> >> > - SCTP_ADDR_SRC, GFP_ATOMIC);
> >> >> > + sizeof(chunk->dest), SCTP_ADDR_SRC, GFP_ATOMIC);
> >> >> > }
> >> >> >
> >> >> > retval->next_tsn = retval->c.initial_tsn;
> >> >> > diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> >> >> > index 5ca2ebfe0be83882fcb841de6fa8029b6455ef85..213be3821a1d49e0c469c4ad4e9ff055a03205c5 100644
> >> >> > --- a/net/sctp/socket.c
> >> >> > +++ b/net/sctp/socket.c
> >> >> > @@ -386,7 +386,8 @@ static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
> >> >> > /* Add the address to the bind address list.
> >> >> > * Use GFP_ATOMIC since BHs will be disabled.
> >> >> > */
> >> >> > - ret = sctp_add_bind_addr(bp, addr, SCTP_ADDR_SRC, GFP_ATOMIC);
> >> >> > + ret = sctp_add_bind_addr(bp, addr, af->sockaddr_len,
> >> >> > + SCTP_ADDR_SRC, GFP_ATOMIC);
> >> >> >
> >> >> > /* Copy back into socket for getsockname() use. */
> >> >> > if (!ret) {
> >> >> > @@ -576,7 +577,7 @@ static int sctp_send_asconf_add_ip(struct sock *sk,
> >> >> > addr = addr_buf;
> >> >> > af = sctp_get_af_specific(addr->v4.sin_family);
> >> >> > memcpy(&saveaddr, addr, af->sockaddr_len);
> >> >> > - retval = sctp_add_bind_addr(bp, &saveaddr,
> >> >> > + retval = sctp_add_bind_addr(bp, &saveaddr, sizeof(saveaddr),
> >> >> > SCTP_ADDR_NEW, GFP_ATOMIC);
> >> >> > addr_buf += af->sockaddr_len;
> >> >> > }
> >> >> > --
> >> >> > 2.5.0
> >> >> >
> >> >> --
> >> >> To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
> >> >> the body of a message to majordomo@vger.kernel.org
> >> >> More majordomo info at http://vger.kernel.org/majordomo-info.html
> >> >>
> >> --
> >> To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
> >> the body of a message to majordomo@vger.kernel.org
> >> More majordomo info at http://vger.kernel.org/majordomo-info.html
> >>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
next prev parent reply other threads:[~2016-03-07 20:00 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-25 14:02 net/sctp: out-of-bounds access in sctp_add_bind_addr Dmitry Vyukov
2016-01-25 14:31 ` Neil Horman
2016-01-25 14:42 ` Dmitry Vyukov
2016-01-25 14:48 ` Marcelo Ricardo Leitner
2016-01-25 16:05 ` Neil Horman
2016-01-25 16:16 ` Marcelo Ricardo Leitner
2016-01-25 17:29 ` Neil Horman
2016-01-25 17:52 ` [PATCH net] sctp: fix copying more bytes than expected " Marcelo Ricardo Leitner
2016-01-26 13:28 ` Dmitry Vyukov
2016-03-07 19:44 ` Marcelo Ricardo Leitner
2016-03-07 19:45 ` Dmitry Vyukov
2016-03-07 19:51 ` Marcelo Ricardo Leitner
2016-03-07 19:56 ` Dmitry Vyukov
2016-03-07 20:00 ` Marcelo Ricardo Leitner [this message]
2016-03-07 20:21 ` David Miller
-- strict thread matches above, loose matches on Subject: below --
2016-03-07 21:17 Marcelo Ricardo Leitner
2016-03-07 23:17 ` kbuild test robot
2016-03-07 23:27 ` Marcelo Ricardo Leitner
2016-03-08 4:15 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160307200008.GJ31743@localhost.localdomain \
--to=marcelo.leitner@gmail.com \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=glider@google.com \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sctp@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=vyasevich@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).