* [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1
@ 2024-11-19 2:05 Xiangyu Chen
2024-11-19 2:05 ` [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper Xiangyu Chen
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Xiangyu Chen @ 2024-11-19 2:05 UTC (permalink / raw)
To: edumazet, gregkh; +Cc: stable, xiangyu.chen
From: Xiangyu Chen <xiangyu.chen@windriver.com>
Following series is a backport of CVE-2024-36915
The fix is "nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies"
This required 1 extra commit to make sure the picks are clean:
net: add copy_safe_from_sockptr() helper
Eric Dumazet (2):
net: add copy_safe_from_sockptr() helper
nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
include/linux/sockptr.h | 25 +++++++++++++++++++++++++
net/nfc/llcp_sock.c | 12 ++++++------
2 files changed, 31 insertions(+), 6 deletions(-)
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper
2024-11-19 2:05 [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Xiangyu Chen
@ 2024-11-19 2:05 ` Xiangyu Chen
2024-11-19 12:31 ` Sasha Levin
2024-11-19 2:05 ` [PATCH 6.1.y 2/2] nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies Xiangyu Chen
2024-11-19 13:10 ` [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Greg KH
2 siblings, 1 reply; 6+ messages in thread
From: Xiangyu Chen @ 2024-11-19 2:05 UTC (permalink / raw)
To: edumazet, gregkh; +Cc: stable, xiangyu.chen
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 6309863b31dd80317cd7d6824820b44e254e2a9c ]
copy_from_sockptr() helper is unsafe, unless callers
did the prior check against user provided optlen.
Too many callers get this wrong, lets add a helper to
fix them and avoid future copy/paste bugs.
Instead of :
if (optlen < sizeof(opt)) {
err = -EINVAL;
break;
}
if (copy_from_sockptr(&opt, optval, sizeof(opt)) {
err = -EFAULT;
break;
}
Use :
err = copy_safe_from_sockptr(&opt, sizeof(opt),
optval, optlen);
if (err)
break;
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20240408082845.3957374-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 7a87441c9651 ("nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
---
include/linux/sockptr.h | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h
index bae5e2369b4f..1c1a5d926b17 100644
--- a/include/linux/sockptr.h
+++ b/include/linux/sockptr.h
@@ -50,11 +50,36 @@ static inline int copy_from_sockptr_offset(void *dst, sockptr_t src,
return 0;
}
+/* Deprecated.
+ * This is unsafe, unless caller checked user provided optlen.
+ * Prefer copy_safe_from_sockptr() instead.
+ */
static inline int copy_from_sockptr(void *dst, sockptr_t src, size_t size)
{
return copy_from_sockptr_offset(dst, src, 0, size);
}
+/**
+ * copy_safe_from_sockptr: copy a struct from sockptr
+ * @dst: Destination address, in kernel space. This buffer must be @ksize
+ * bytes long.
+ * @ksize: Size of @dst struct.
+ * @optval: Source address. (in user or kernel space)
+ * @optlen: Size of @optval data.
+ *
+ * Returns:
+ * * -EINVAL: @optlen < @ksize
+ * * -EFAULT: access to userspace failed.
+ * * 0 : @ksize bytes were copied
+ */
+static inline int copy_safe_from_sockptr(void *dst, size_t ksize,
+ sockptr_t optval, unsigned int optlen)
+{
+ if (optlen < ksize)
+ return -EINVAL;
+ return copy_from_sockptr(dst, optval, ksize);
+}
+
static inline int copy_to_sockptr_offset(sockptr_t dst, size_t offset,
const void *src, size_t size)
{
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 6.1.y 2/2] nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
2024-11-19 2:05 [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Xiangyu Chen
2024-11-19 2:05 ` [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper Xiangyu Chen
@ 2024-11-19 2:05 ` Xiangyu Chen
2024-11-19 12:31 ` Sasha Levin
2024-11-19 13:10 ` [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Greg KH
2 siblings, 1 reply; 6+ messages in thread
From: Xiangyu Chen @ 2024-11-19 2:05 UTC (permalink / raw)
To: edumazet, gregkh; +Cc: stable, xiangyu.chen
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 7a87441c9651ba37842f4809224aca13a554a26f ]
syzbot reported unsafe calls to copy_from_sockptr() [1]
Use copy_safe_from_sockptr() instead.
[1]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]
BUG: KASAN: slab-out-of-bounds in nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255
Read of size 4 at addr ffff88801caa1ec3 by task syz-executor459/5078
CPU: 0 PID: 5078 Comm: syz-executor459 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
copy_from_sockptr include/linux/sockptr.h:55 [inline]
nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255
do_sock_setsockopt+0x3b1/0x720 net/socket.c:2311
__sys_setsockopt+0x1ae/0x250 net/socket.c:2334
__do_sys_setsockopt net/socket.c:2343 [inline]
__se_sys_setsockopt net/socket.c:2340 [inline]
__x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340
do_syscall_64+0xfd/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f7fac07fd89
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff660eb788 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7fac07fd89
RDX: 0000000000000000 RSI: 0000000000000118 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000020000a80 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20240408082845.3957374-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
---
net/nfc/llcp_sock.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 645677f84dba..cd0fd26196b8 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -252,10 +252,10 @@ static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
break;
}
- if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
- err = -EFAULT;
+ err = copy_safe_from_sockptr(&opt, sizeof(opt),
+ optval, optlen);
+ if (err)
break;
- }
if (opt > LLCP_MAX_RW) {
err = -EINVAL;
@@ -274,10 +274,10 @@ static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
break;
}
- if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
- err = -EFAULT;
+ err = copy_safe_from_sockptr(&opt, sizeof(opt),
+ optval, optlen);
+ if (err)
break;
- }
if (opt > LLCP_MAX_MIUX) {
err = -EINVAL;
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 6.1.y 2/2] nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
2024-11-19 2:05 ` [PATCH 6.1.y 2/2] nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies Xiangyu Chen
@ 2024-11-19 12:31 ` Sasha Levin
0 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2024-11-19 12:31 UTC (permalink / raw)
To: stable; +Cc: Xiangyu Chen, Sasha Levin
[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 7a87441c9651ba37842f4809224aca13a554a26f
WARNING: Author mismatch between patch and upstream commit:
Backport author: Xiangyu Chen <xiangyu.chen@eng.windriver.com>
Commit author: Eric Dumazet <edumazet@google.com>
Commit in newer trees:
|-----------------|----------------------------------------------|
| 6.11.y | Present (exact SHA1) |
| 6.6.y | Present (different SHA1: 0f1061332030) |
| 6.1.y | Not found |
|-----------------|----------------------------------------------|
Note: The patch differs from the upstream commit:
---
--- - 2024-11-19 01:54:59.787740708 -0500
+++ /tmp/tmp.ibDHk7fa1x 2024-11-19 01:54:59.783429415 -0500
@@ -1,3 +1,5 @@
+[ Upstream commit 7a87441c9651ba37842f4809224aca13a554a26f ]
+
syzbot reported unsafe calls to copy_from_sockptr() [1]
Use copy_safe_from_sockptr() instead.
@@ -42,12 +44,14 @@
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20240408082845.3957374-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
---
net/nfc/llcp_sock.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
-index 819157bbb5a2c..d5344563e525c 100644
+index 645677f84dba..cd0fd26196b8 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -252,10 +252,10 @@ static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
@@ -78,3 +82,6 @@
if (opt > LLCP_MAX_MIUX) {
err = -EINVAL;
+--
+2.43.0
+
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y | Success | Success |
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper
2024-11-19 2:05 ` [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper Xiangyu Chen
@ 2024-11-19 12:31 ` Sasha Levin
0 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2024-11-19 12:31 UTC (permalink / raw)
To: stable; +Cc: Xiangyu Chen, Sasha Levin
[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 6309863b31dd80317cd7d6824820b44e254e2a9c
WARNING: Author mismatch between patch and upstream commit:
Backport author: Xiangyu Chen <xiangyu.chen@eng.windriver.com>
Commit author: Eric Dumazet <edumazet@google.com>
Commit in newer trees:
|-----------------|----------------------------------------------|
| 6.11.y | Present (exact SHA1) |
| 6.6.y | Present (different SHA1: ae7f73e64e9b) |
| 6.1.y | Not found |
|-----------------|----------------------------------------------|
Note: The patch differs from the upstream commit:
---
--- - 2024-11-19 01:37:21.875695197 -0500
+++ /tmp/tmp.N75ESVdFIm 2024-11-19 01:37:21.870628258 -0500
@@ -1,3 +1,5 @@
+[ Upstream commit 6309863b31dd80317cd7d6824820b44e254e2a9c ]
+
copy_from_sockptr() helper is unsafe, unless callers
did the prior check against user provided optlen.
@@ -25,12 +27,15 @@
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20240408082845.3957374-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 7a87441c9651 ("nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
---
include/linux/sockptr.h | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h
-index 307961b41541a..317200cd3a603 100644
+index bae5e2369b4f..1c1a5d926b17 100644
--- a/include/linux/sockptr.h
+++ b/include/linux/sockptr.h
@@ -50,11 +50,36 @@ static inline int copy_from_sockptr_offset(void *dst, sockptr_t src,
@@ -67,6 +72,9 @@
+ return copy_from_sockptr(dst, optval, ksize);
+}
+
- static inline int copy_struct_from_sockptr(void *dst, size_t ksize,
- sockptr_t src, size_t usize)
+ static inline int copy_to_sockptr_offset(sockptr_t dst, size_t offset,
+ const void *src, size_t size)
{
+--
+2.43.0
+
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y | Success | Success |
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1
2024-11-19 2:05 [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Xiangyu Chen
2024-11-19 2:05 ` [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper Xiangyu Chen
2024-11-19 2:05 ` [PATCH 6.1.y 2/2] nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies Xiangyu Chen
@ 2024-11-19 13:10 ` Greg KH
2 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2024-11-19 13:10 UTC (permalink / raw)
To: Xiangyu Chen; +Cc: edumazet, stable, xiangyu.chen
On Tue, Nov 19, 2024 at 10:05:35AM +0800, Xiangyu Chen wrote:
> From: Xiangyu Chen <xiangyu.chen@windriver.com>
>
> Following series is a backport of CVE-2024-36915
>
> The fix is "nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies"
> This required 1 extra commit to make sure the picks are clean:
> net: add copy_safe_from_sockptr() helper
>
>
> Eric Dumazet (2):
> net: add copy_safe_from_sockptr() helper
> nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
>
> include/linux/sockptr.h | 25 +++++++++++++++++++++++++
> net/nfc/llcp_sock.c | 12 ++++++------
> 2 files changed, 31 insertions(+), 6 deletions(-)
>
> --
> 2.43.0
>
>
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-11-19 13:10 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-11-19 2:05 [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Xiangyu Chen
2024-11-19 2:05 ` [PATCH 6.1.y 1/2] net: add copy_safe_from_sockptr() helper Xiangyu Chen
2024-11-19 12:31 ` Sasha Levin
2024-11-19 2:05 ` [PATCH 6.1.y 2/2] nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies Xiangyu Chen
2024-11-19 12:31 ` Sasha Levin
2024-11-19 13:10 ` [PATCH 6.1.y 0/2] Backport fix of CVE-2024-36915 to 6.1 Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox