From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Hulk Robot <hulkci@huawei.com>,
YueHaibing <yuehaibing@huawei.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
Steffen Klassert <steffen.klassert@secunet.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 42/53] xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink
Date: Thu, 23 May 2019 21:06:06 +0200 [thread overview]
Message-ID: <20190523181717.615518046@linuxfoundation.org> (raw)
In-Reply-To: <20190523181710.981455400@linuxfoundation.org>
[ Upstream commit b805d78d300bcf2c83d6df7da0c818b0fee41427 ]
UBSAN report this:
UBSAN: Undefined behaviour in net/xfrm/xfrm_policy.c:1289:24
index 6 is out of range for type 'unsigned int [6]'
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.162-514.55.6.9.x86_64+ #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
0000000000000000 1466cf39b41b23c9 ffff8801f6b07a58 ffffffff81cb35f4
0000000041b58ab3 ffffffff83230f9c ffffffff81cb34e0 ffff8801f6b07a80
ffff8801f6b07a20 1466cf39b41b23c9 ffffffff851706e0 ffff8801f6b07ae8
Call Trace:
<IRQ> [<ffffffff81cb35f4>] __dump_stack lib/dump_stack.c:15 [inline]
<IRQ> [<ffffffff81cb35f4>] dump_stack+0x114/0x1a0 lib/dump_stack.c:51
[<ffffffff81d94225>] ubsan_epilogue+0x12/0x8f lib/ubsan.c:164
[<ffffffff81d954db>] __ubsan_handle_out_of_bounds+0x16e/0x1b2 lib/ubsan.c:382
[<ffffffff82a25acd>] __xfrm_policy_unlink+0x3dd/0x5b0 net/xfrm/xfrm_policy.c:1289
[<ffffffff82a2e572>] xfrm_policy_delete+0x52/0xb0 net/xfrm/xfrm_policy.c:1309
[<ffffffff82a3319b>] xfrm_policy_timer+0x30b/0x590 net/xfrm/xfrm_policy.c:243
[<ffffffff813d3927>] call_timer_fn+0x237/0x990 kernel/time/timer.c:1144
[<ffffffff813d8e7e>] __run_timers kernel/time/timer.c:1218 [inline]
[<ffffffff813d8e7e>] run_timer_softirq+0x6ce/0xb80 kernel/time/timer.c:1401
[<ffffffff8120d6f9>] __do_softirq+0x299/0xe10 kernel/softirq.c:273
[<ffffffff8120e676>] invoke_softirq kernel/softirq.c:350 [inline]
[<ffffffff8120e676>] irq_exit+0x216/0x2c0 kernel/softirq.c:391
[<ffffffff82c5edab>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
[<ffffffff82c5edab>] smp_apic_timer_interrupt+0x8b/0xc0 arch/x86/kernel/apic/apic.c:926
[<ffffffff82c5c985>] apic_timer_interrupt+0xa5/0xb0 arch/x86/entry/entry_64.S:735
<EOI> [<ffffffff81188096>] ? native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:52
[<ffffffff810834d7>] arch_safe_halt arch/x86/include/asm/paravirt.h:111 [inline]
[<ffffffff810834d7>] default_idle+0x27/0x430 arch/x86/kernel/process.c:446
[<ffffffff81085f05>] arch_cpu_idle+0x15/0x20 arch/x86/kernel/process.c:437
[<ffffffff8132abc3>] default_idle_call+0x53/0x90 kernel/sched/idle.c:92
[<ffffffff8132b32d>] cpuidle_idle_call kernel/sched/idle.c:156 [inline]
[<ffffffff8132b32d>] cpu_idle_loop kernel/sched/idle.c:251 [inline]
[<ffffffff8132b32d>] cpu_startup_entry+0x60d/0x9a0 kernel/sched/idle.c:299
[<ffffffff8113e119>] start_secondary+0x3c9/0x560 arch/x86/kernel/smpboot.c:245
The issue is triggered as this:
xfrm_add_policy
-->verify_newpolicy_info //check the index provided by user with XFRM_POLICY_MAX
//In my case, the index is 0x6E6BB6, so it pass the check.
-->xfrm_policy_construct //copy the user's policy and set xfrm_policy_timer
-->xfrm_policy_insert
--> __xfrm_policy_link //use the orgin dir, in my case is 2
--> xfrm_gen_index //generate policy index, there is 0x6E6BB6
then xfrm_policy_timer be fired
xfrm_policy_timer
--> xfrm_policy_id2dir //get dir from (policy index & 7), in my case is 6
--> xfrm_policy_delete
--> __xfrm_policy_unlink //access policy_count[dir], trigger out of range access
Add xfrm_policy_id2dir check in verify_newpolicy_info, make sure the computed dir is
valid, to fix the issue.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: e682adf021be ("xfrm: Try to honor policy index if it's supplied by user")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f6f91c3b2de02..ca5c79bfd9a5e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1344,7 +1344,7 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
ret = verify_policy_dir(p->dir);
if (ret)
return ret;
- if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir))
+ if (p->index && (xfrm_policy_id2dir(p->index) != p->dir))
return -EINVAL;
return 0;
--
2.20.1
next prev parent reply other threads:[~2019-05-23 19:49 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-23 19:05 [PATCH 4.9 00/53] 4.9.179-stable review Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 01/53] net: avoid weird emergency message Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 02/53] net/mlx4_core: Change the error print to info print Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 03/53] ppp: deflate: Fix possible crash in deflate_init Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 04/53] tipc: switch order of device registration to fix a crash Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 05/53] vsock/virtio: free packets during the socket release Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 06/53] tipc: fix modprobe tipc failed after switch order of device registration Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 07/53] vsock/virtio: Initialize core virtio vsock before registering the driver Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 08/53] parisc: Export running_on_qemu symbol for modules Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 09/53] parisc: Skip registering LED when running in QEMU Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 10/53] parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 11/53] stm class: Fix channel free in stm output free path Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 12/53] md: add mddev->pers to avoid potential NULL pointer dereference Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 13/53] intel_th: msu: Fix single mode with IOMMU Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 14/53] p54: drop device reference count if fails to enable device Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 15/53] of: fix clang -Wunsequenced for be32_to_cpu() Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 16/53] cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 17/53] media: ov6650: Fix sensor possibly not detected on probe Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 18/53] NFS4: Fix v4.0 client state corruption when mount Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 19/53] clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 20/53] fuse: fix writepages on 32bit Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 21/53] fuse: honor RLIMIT_FSIZE in fuse_file_fallocate Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 22/53] iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114 Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 23/53] ceph: flush dirty inodes before proceeding with remount Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 24/53] tracing: Fix partial reading of trace events id file Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 25/53] memory: tegra: Fix integer overflow on tick value calculation Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 26/53] perf intel-pt: Fix instructions sampling rate Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 27/53] perf intel-pt: Fix improved sample timestamp Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 28/53] perf intel-pt: Fix sample timestamp wrt non-taken branches Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 29/53] objtool: Allow AR to be overridden with HOSTAR Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 30/53] fbdev: sm712fb: fix brightness control on reboot, dont set SR30 Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 31/53] fbdev: sm712fb: fix VRAM detection, dont set SR70/71/74/75 Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 32/53] fbdev: sm712fb: fix white screen of death on reboot, dont set CR3B-CR3F Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 33/53] fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 34/53] fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping VRAM Greg Kroah-Hartman
2019-05-23 19:05 ` [PATCH 4.9 35/53] fbdev: sm712fb: fix support for 1024x768-16 mode Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 36/53] fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 37/53] fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 38/53] PCI: Mark Atheros AR9462 to avoid bus reset Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 39/53] PCI: Factor out pcie_retrain_link() function Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 40/53] PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 41/53] dm delay: fix a crash when invalid device is specified Greg Kroah-Hartman
2019-05-23 19:06 ` Greg Kroah-Hartman [this message]
2019-05-23 19:06 ` [PATCH 4.9 43/53] xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 44/53] vti4: ipip tunnel deregistration fixes Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 45/53] xfrm4: Fix uninitialized memory read in _decode_session4 Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 46/53] mac80211: Fix kernel panic due to use of txq after free Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 47/53] KVM: arm/arm64: Ensure vcpu target is unset on reset failure Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 48/53] power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 49/53] ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 50/53] perf bench numa: Add define for RUSAGE_THREAD if not present Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 51/53] Revert "Dont jump to compute_result state from check_result state" Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 52/53] md/raid: raid5 preserve the writeback action after the parity check Greg Kroah-Hartman
2019-05-23 19:06 ` [PATCH 4.9 53/53] btrfs: Honour FITRIM range constraints during free space trim Greg Kroah-Hartman
2019-05-24 5:28 ` [PATCH 4.9 00/53] 4.9.179-stable review kernelci.org bot
2019-05-24 8:43 ` Naresh Kamboju
2019-05-24 11:04 ` Jon Hunter
2019-05-24 18:56 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190523181717.615518046@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=hulkci@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
--cc=yuehaibing@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).