From: Shu-Chun Weng <scw@google.com>
To: Laurent Vivier <laurent@vivier.eu>
Cc: Riku Voipio <riku.voipio@iki.fi>,
qemu-devel@nongnu.org, Shu-Chun Weng <scw@google.com>
Subject: [PATCH] Fix unsigned integer underflow in fd-trans.c
Date: Thu, 17 Oct 2019 17:19:20 -0700 [thread overview]
Message-ID: <20191018001920.178283-1-scw@google.com> (raw)
In any of these `*_for_each_*` functions, the last entry in the buffer (so the
"remaining length in the buffer" `len` is equal to the length of the
entry `nlmsg_len`/`nla_len`/etc) has size that is not a multiple of the
alignment, the aligned lengths `*_ALIGN(*_len)` will be greater than `len`.
Since `len` is unsigned (`size_t`), it underflows and the loop will read
pass the buffer.
This may manifest as random EINVAL or EOPNOTSUPP error on IO or network
system calls.
Signed-off-by: Shu-Chun Weng <scw@google.com>
---
linux-user/fd-trans.c | 51 +++++++++++++++++++++++++++++++++----------
1 file changed, 40 insertions(+), 11 deletions(-)
diff --git a/linux-user/fd-trans.c b/linux-user/fd-trans.c
index 60077ce531..9b92386abf 100644
--- a/linux-user/fd-trans.c
+++ b/linux-user/fd-trans.c
@@ -279,6 +279,7 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
(struct nlmsghdr *))
{
uint32_t nlmsg_len;
+ uint32_t aligned_nlmsg_len;
abi_long ret;
while (len > sizeof(struct nlmsghdr)) {
@@ -312,8 +313,13 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
break;
}
tswap_nlmsghdr(nlh);
- len -= NLMSG_ALIGN(nlmsg_len);
- nlh = (struct nlmsghdr *)(((char*)nlh) + NLMSG_ALIGN(nlmsg_len));
+
+ aligned_nlmsg_len = NLMSG_ALIGN(nlmsg_len);
+ if (aligned_nlmsg_len >= len) {
+ break;
+ }
+ len -= aligned_nlmsg_len;
+ nlh = (struct nlmsghdr *)(((char*)nlh) + aligned_nlmsg_len);
}
return 0;
}
@@ -323,6 +329,7 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
abi_long (*target_to_host_nlmsg)
(struct nlmsghdr *))
{
+ uint32_t aligned_nlmsg_len;
int ret;
while (len > sizeof(struct nlmsghdr)) {
@@ -349,8 +356,13 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
return ret;
}
}
- len -= NLMSG_ALIGN(nlh->nlmsg_len);
- nlh = (struct nlmsghdr *)(((char *)nlh) + NLMSG_ALIGN(nlh->nlmsg_len));
+
+ aligned_nlmsg_len = NLMSG_ALIGN(nlh->nlmsg_len);
+ if (aligned_nlmsg_len >= len) {
+ break;
+ }
+ len -= aligned_nlmsg_len;
+ nlh = (struct nlmsghdr *)(((char *)nlh) + aligned_nlmsg_len);
}
return 0;
}
@@ -363,6 +375,7 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
void *context))
{
unsigned short nla_len;
+ unsigned short aligned_nla_len;
abi_long ret;
while (len > sizeof(struct nlattr)) {
@@ -377,8 +390,13 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
if (ret < 0) {
return ret;
}
- len -= NLA_ALIGN(nla_len);
- nlattr = (struct nlattr *)(((char *)nlattr) + NLA_ALIGN(nla_len));
+
+ aligned_nla_len = NLA_ALIGN(nla_len);
+ if (aligned_nla_len >= len) {
+ break;
+ }
+ len -= aligned_nla_len;
+ nlattr = (struct nlattr *)(((char *)nlattr) + aligned_nla_len);
}
return 0;
}
@@ -389,6 +407,7 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
(struct rtattr *))
{
unsigned short rta_len;
+ unsigned short aligned_rta_len;
abi_long ret;
while (len > sizeof(struct rtattr)) {
@@ -403,8 +422,13 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
if (ret < 0) {
return ret;
}
- len -= RTA_ALIGN(rta_len);
- rtattr = (struct rtattr *)(((char *)rtattr) + RTA_ALIGN(rta_len));
+
+ aligned_rta_len = RTA_ALIGN(rta_len);
+ if (aligned_rta_len >= len) {
+ break;
+ }
+ len -= aligned_rta_len;
+ rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
}
return 0;
}
@@ -1058,6 +1082,7 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
abi_long (*target_to_host_rtattr)
(struct rtattr *))
{
+ unsigned short aligned_rta_len;
abi_long ret;
while (len >= sizeof(struct rtattr)) {
@@ -1071,9 +1096,13 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
if (ret < 0) {
return ret;
}
- len -= RTA_ALIGN(rtattr->rta_len);
- rtattr = (struct rtattr *)(((char *)rtattr) +
- RTA_ALIGN(rtattr->rta_len));
+
+ aligned_rta_len = RTA_ALIGN(rtattr->rta_len);
+ if (aligned_rta_len >= len) {
+ break;
+ }
+ len -= aligned_rta_len;
+ rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
}
return 0;
}
--
2.23.0.866.gb869b98d4c-goog
next reply other threads:[~2019-10-18 0:20 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-18 0:19 Shu-Chun Weng [this message]
2019-10-18 7:26 ` [PATCH] Fix unsigned integer underflow in fd-trans.c Laurent Vivier
2019-10-18 18:18 ` Shu-Chun Weng
2019-10-18 18:27 ` Shu-Chun Weng
2019-10-18 18:54 ` Laurent Vivier
2019-10-21 9:34 ` Laurent Vivier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191018001920.178283-1-scw@google.com \
--to=scw@google.com \
--cc=laurent@vivier.eu \
--cc=qemu-devel@nongnu.org \
--cc=riku.voipio@iki.fi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).