[PATCH net-next] scm: add user copy checks to put_cmsg()

[PATCH net-next] scm: add user copy checks to put_cmsg()

[Eric Dumazet]

This is a followup of commit 2558b8039d05 ("net: use a bounce
buffer for copying skb->mark")

x86 and powerpc define user_access_begin, meaning
that they are not able to perform user copy checks
when using user_write_access_begin() / unsafe_copy_to_user()
and friends [1]

Instead of waiting bugs to trigger on other arches,
add a check_object_size() in put_cmsg() to make sure
that new code tested on x86 with CONFIG_HARDENED_USERCOPY=y
will perform more security checks.

[1] We can not generically call check_object_size() from
unsafe_copy_to_user() because UACCESS is enabled at this point.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Kees Cook <keescook@chromium.org>
---
 net/core/scm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/scm.c b/net/core/scm.c
index 5c356f0dee30c3edaa57b49176cce021d5248cd7..acb7d776fa6ec29cdd9ae7d3a9970384c887ac75 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -229,6 +229,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
 	if (msg->msg_control_is_user) {
 		struct cmsghdr __user *cm = msg->msg_control_user;
 
+		check_object_size(data, cmlen - sizeof(*cm), true);
+
 		if (!user_write_access_begin(cm, cmlen))
 			goto efault;
 
-- 
2.39.2.637.g21b0678d19-goog

Re: [PATCH net-next] scm: add user copy checks to put_cmsg()

[Kees Cook]

On Fri, Feb 17, 2023 at 06:24:54PM +0000, Eric Dumazet wrote:
> This is a followup of commit 2558b8039d05 ("net: use a bounce
> buffer for copying skb->mark")
> 
> x86 and powerpc define user_access_begin, meaning
> that they are not able to perform user copy checks
> when using user_write_access_begin() / unsafe_copy_to_user()
> and friends [1]
> 
> Instead of waiting bugs to trigger on other arches,
> add a check_object_size() in put_cmsg() to make sure
> that new code tested on x86 with CONFIG_HARDENED_USERCOPY=y
> will perform more security checks.
> 
> [1] We can not generically call check_object_size() from
> unsafe_copy_to_user() because UACCESS is enabled at this point.
> 
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Thanks!

Acked-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook

Re: [PATCH net-next] scm: add user copy checks to put_cmsg()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (master)
by David S. Miller <davem@davemloft.net>:

On Fri, 17 Feb 2023 18:24:54 +0000 you wrote:
> This is a followup of commit 2558b8039d05 ("net: use a bounce
> buffer for copying skb->mark")
> 
> x86 and powerpc define user_access_begin, meaning
> that they are not able to perform user copy checks
> when using user_write_access_begin() / unsafe_copy_to_user()
> and friends [1]
> 
> [...]

Here is the summary with links:
  - [net-next] scm: add user copy checks to put_cmsg()
    https://git.kernel.org/netdev/net-next/c/5f1eb1ff58ea

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html