[PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[Jason Wang]

We need to validate the number of pages consumed by data_len, otherwise frags
array could be overflowed by userspace. So this patch validate data_len and
return -EMSGSIZE when data_len may occupies more frags than MAX_SKB_FRAGS.

Cc: stable@vger.kernel.org [2.6.27+]
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/core/sock.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index 653f8c0..4ad5fa5 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1599,6 +1599,7 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
 
 	timeo = sock_sndtimeo(sk, noblock);
 	while (1) {
+		int npages;
 		err = sock_error(sk);
 		if (err != 0)
 			goto failure;
@@ -1607,17 +1608,20 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
 		if (sk->sk_shutdown & SEND_SHUTDOWN)
 			goto failure;
 
+		err = -EMSGSIZE;
+		npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+		if (npages > MAX_SKB_FRAGS)
+			goto failure;
+
 		if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
 			skb = alloc_skb(header_len, gfp_mask);
 			if (skb) {
-				int npages;
 				int i;
 
 				/* No pages, we're done... */
 				if (!data_len)
 					break;
 
-				npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
 				skb->truesize += data_len;
 				skb_shinfo(skb)->nr_frags = npages;
 				for (i = 0; i < npages; i++) {

Re: [PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[Eric Dumazet]

On Wed, 2012-05-30 at 13:47 +0800, Jason Wang wrote:
> We need to validate the number of pages consumed by data_len, otherwise frags
> array could be overflowed by userspace. So this patch validate data_len and
> return -EMSGSIZE when data_len may occupies more frags than MAX_SKB_FRAGS.
> 
> Cc: stable@vger.kernel.org [2.6.27+]
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
>  net/core/sock.c |    8 ++++++--
>  1 files changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 653f8c0..4ad5fa5 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -1599,6 +1599,7 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
>  
>  	timeo = sock_sndtimeo(sk, noblock);
>  	while (1) {
> +		int npages;
>  		err = sock_error(sk);
>  		if (err != 0)
>  			goto failure;
> @@ -1607,17 +1608,20 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
>  		if (sk->sk_shutdown & SEND_SHUTDOWN)
>  			goto failure;
>  
> +		err = -EMSGSIZE;
> +		npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
> +		if (npages > MAX_SKB_FRAGS)
> +			goto failure;
> +
>  		if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
>  			skb = alloc_skb(header_len, gfp_mask);
>  			if (skb) {
> -				int npages;
>  				int i;
>  
>  				/* No pages, we're done... */
>  				if (!data_len)
>  					break;
>  
> -				npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
>  				skb->truesize += data_len;
>  				skb_shinfo(skb)->nr_frags = npages;
>  				for (i = 0; i < npages; i++) {
> 


Why doing this test in the while (1) block, it should be done before the
loop...

Or even in the caller, note net/unix/af_unix.c does this right.

        if (len > SKB_MAX_ALLOC)
                data_len = min_t(size_t,
                                 len - SKB_MAX_ALLOC,
                                 MAX_SKB_FRAGS * PAGE_SIZE);

        skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
                                   msg->msg_flags & MSG_DONTWAIT, &err);

Re: [PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Wed, 30 May 2012 08:46:23 +0200

> Why doing this test in the while (1) block, it should be done before the
> loop...
> 
> Or even in the caller, note net/unix/af_unix.c does this right.
> 
>         if (len > SKB_MAX_ALLOC)
>                 data_len = min_t(size_t,
>                                  len - SKB_MAX_ALLOC,
>                                  MAX_SKB_FRAGS * PAGE_SIZE);
> 
>         skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
>                                    msg->msg_flags & MSG_DONTWAIT, &err);

My impression is that the callers should be fixed to.  It makes no sense
to penalize the call sites that get this right.

And yes, if we do check it in sock_alloc_send_pskb() it should be done
at function entry, not inside the loop.

Re: [PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[Jason Wang]

On 05/30/2012 03:02 PM, David Miller wrote:
> From: Eric Dumazet<eric.dumazet@gmail.com>
> Date: Wed, 30 May 2012 08:46:23 +0200
>
>> Why doing this test in the while (1) block, it should be done before the
>> loop...
>>
>> Or even in the caller, note net/unix/af_unix.c does this right.
>>
>>          if (len>  SKB_MAX_ALLOC)
>>                  data_len = min_t(size_t,
>>                                   len - SKB_MAX_ALLOC,
>>                                   MAX_SKB_FRAGS * PAGE_SIZE);
>>
>>          skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
>>                                     msg->msg_flags&  MSG_DONTWAIT,&err);
> My impression is that the callers should be fixed to.  It makes no sense
> to penalize the call sites that get this right.
>
> And yes, if we do check it in sock_alloc_send_pskb() it should be done
> at function entry, not inside the loop.

Sure, so is it ok for me to send a V2 that just do the fixing in 
sock_alloc_sned_pskb() as it's simple and easy to be accepted by stable 
version?

For the fix of callers, I want to post fixes on top as I find there's 
some code duplication of {tun|macvtap|packet}_alloc_skb() and I want to 
unify them to a common helper in sock.c. Then I can fix this issue in 
the new helper.
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[Michael S. Tsirkin]

On Thu, May 31, 2012 at 02:00:14PM +0800, Jason Wang wrote:
> On 05/30/2012 03:02 PM, David Miller wrote:
> >From: Eric Dumazet<eric.dumazet@gmail.com>
> >Date: Wed, 30 May 2012 08:46:23 +0200
> >
> >>Why doing this test in the while (1) block, it should be done before the
> >>loop...
> >>
> >>Or even in the caller, note net/unix/af_unix.c does this right.
> >>
> >>         if (len>  SKB_MAX_ALLOC)
> >>                 data_len = min_t(size_t,
> >>                                  len - SKB_MAX_ALLOC,
> >>                                  MAX_SKB_FRAGS * PAGE_SIZE);
> >>
> >>         skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
> >>                                    msg->msg_flags&  MSG_DONTWAIT,&err);
> >My impression is that the callers should be fixed to.  It makes no sense
> >to penalize the call sites that get this right.
> >
> >And yes, if we do check it in sock_alloc_send_pskb() it should be done
> >at function entry, not inside the loop.
> 
> Sure, so is it ok for me to send a V2 that just do the fixing in
> sock_alloc_sned_pskb() as it's simple and easy to be accepted by
> stable version?
> 
> For the fix of callers, I want to post fixes on top as I find
> there's some code duplication of {tun|macvtap|packet}_alloc_skb()
> and I want to unify them to a common helper in sock.c. Then I can
> fix this issue in the new helper.

Are packet sockets really affected?
If yes the only call site that gets this right is unix sockets?

> >--
> >To unsubscribe from this list: send the line "unsubscribe netdev" in
> >the body of a message to majordomo@vger.kernel.org
> >More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[Jason Wang]

On 05/31/2012 02:02 PM, Michael S. Tsirkin wrote:
> On Thu, May 31, 2012 at 02:00:14PM +0800, Jason Wang wrote:
>> On 05/30/2012 03:02 PM, David Miller wrote:
>>> From: Eric Dumazet<eric.dumazet@gmail.com>
>>> Date: Wed, 30 May 2012 08:46:23 +0200
>>>
>>>> Why doing this test in the while (1) block, it should be done before the
>>>> loop...
>>>>
>>>> Or even in the caller, note net/unix/af_unix.c does this right.
>>>>
>>>>          if (len>   SKB_MAX_ALLOC)
>>>>                  data_len = min_t(size_t,
>>>>                                   len - SKB_MAX_ALLOC,
>>>>                                   MAX_SKB_FRAGS * PAGE_SIZE);
>>>>
>>>>          skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
>>>>                                     msg->msg_flags&   MSG_DONTWAIT,&err);
>>> My impression is that the callers should be fixed to.  It makes no sense
>>> to penalize the call sites that get this right.
>>>
>>> And yes, if we do check it in sock_alloc_send_pskb() it should be done
>>> at function entry, not inside the loop.
>> Sure, so is it ok for me to send a V2 that just do the fixing in
>> sock_alloc_sned_pskb() as it's simple and easy to be accepted by
>> stable version?
>>
>> For the fix of callers, I want to post fixes on top as I find
>> there's some code duplication of {tun|macvtap|packet}_alloc_skb()
>> and I want to unify them to a common helper in sock.c. Then I can
>> fix this issue in the new helper.
> Are packet sockets really affected?
> If yes the only call site that gets this right is unix sockets?

Not affected, only code duplication. It's no harm the check the data_len 
again for packet sockets, so better to unify the code and fix the issue 
in one place?
>
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe netdev" in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[Eric Dumazet]

On Thu, 2012-05-31 at 14:11 +0800, Jason Wang wrote:

> Not affected, only code duplication. It's no harm the check the data_len 
> again for packet sockets, so better to unify the code and fix the issue 
> in one place?

As a matter of fact, we currently allocate order-0 pages, but it could
be nice trying to use order-1 or order-2 pages, on arches where
PAGE_SIZE is so small (4096 bytes)

So lets do this test in sock_alloc_send_pskb() to allow future changes.

af_unix is kind of special, because it tries to lower risk of high order
linear allocation failures. And for small sizes, it wants linear skbs to
have no performance regression (prior kernels were allocating linear
skbs)

Re: [PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

[Jason Wang]

On 05/31/2012 02:20 PM, Eric Dumazet wrote:
> On Thu, 2012-05-31 at 14:11 +0800, Jason Wang wrote:
>
>> Not affected, only code duplication. It's no harm the check the data_len
>> again for packet sockets, so better to unify the code and fix the issue
>> in one place?
> As a matter of fact, we currently allocate order-0 pages, but it could
> be nice trying to use order-1 or order-2 pages, on arches where
> PAGE_SIZE is so small (4096 bytes)
>
> So lets do this test in sock_alloc_send_pskb() to allow future changes.
>
> af_unix is kind of special, because it tries to lower risk of high order
> linear allocation failures. And for small sizes, it wants linear skbs to
> have no performance regression (prior kernels were allocating linear
> skbs)
>

Thanks for the clarification, would post V2.
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/