lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20220903043749.3102675-1-keescook@chromium.org> Date: Fri, 2 Sep 2022 21:37:49 -0700 From: Kees Cook <keescook@...omium.org> To: Jakub Kicinski <kuba@...nel.org> Cc: Kees Cook <keescook@...omium.org>, Pablo Neira Ayuso <pablo@...filter.org>, Jozsef Kadlecsik <kadlec@...filter.org>, Florian Westphal <fw@...len.de>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>, syzbot <syzkaller@...glegroups.com>, netfilter-devel@...r.kernel.org, coreteam@...filter.org, netdev@...r.kernel.org, Oliver Hartkopp <socketcan@...tkopp.net>, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org Subject: [PATCH v4] netlink: Bounds-check struct nlmsgerr creation In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(), switch from __nlmsg_put to nlmsg_put(), and explain the bounds check for dealing with the memcpy() across a composite flexible array struct. Avoids this future run-time warning: memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" at net/netlink/af_netlink.c:2447 (size 16) Cc: Jakub Kicinski <kuba@...nel.org> Cc: Pablo Neira Ayuso <pablo@...filter.org> Cc: Jozsef Kadlecsik <kadlec@...filter.org> Cc: Florian Westphal <fw@...len.de> Cc: "David S. Miller" <davem@...emloft.net> Cc: Eric Dumazet <edumazet@...gle.com> Cc: Paolo Abeni <pabeni@...hat.com> Cc: syzbot <syzkaller@...glegroups.com> Cc: netfilter-devel@...r.kernel.org Cc: coreteam@...filter.org Cc: netdev@...r.kernel.org Signed-off-by: Kees Cook <keescook@...omium.org> Link: https://lore.kernel.org/r/20220901071336.1418572-1-keescook@chromium.org --- v4: - switch to nlmsg_put() instead of __nlmsg_put() (kuba) v3: https://lore.kernel.org/lkml/20220901071336.1418572-1-keescook@chromium.org v2: https://lore.kernel.org/lkml/20220901064858.1417126-1-keescook@chromium.org v1: https://lore.kernel.org/lkml/20220901030610.1121299-3-keescook@chromium.org --- net/netfilter/ipset/ip_set_core.c | 8 +++++--- net/netlink/af_netlink.c | 8 +++++--- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c index 16ae92054baa..6b31746f9be3 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -1719,11 +1719,13 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb, skb2 = nlmsg_new(payload, GFP_KERNEL); if (!skb2) return -ENOMEM; - rep = __nlmsg_put(skb2, NETLINK_CB(skb).portid, - nlh->nlmsg_seq, NLMSG_ERROR, payload, 0); + rep = nlmsg_put(skb2, NETLINK_CB(skb).portid, + nlh->nlmsg_seq, NLMSG_ERROR, payload, 0); errmsg = nlmsg_data(rep); errmsg->error = ret; - memcpy(&errmsg->msg, nlh, nlh->nlmsg_len); + unsafe_memcpy(&errmsg->msg, nlh, nlh->nlmsg_len, + /* Bounds checked by the skb layer. */); + cmdattr = (void *)&errmsg->msg + min_len; ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr, diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index f89ba302ac6e..a662e8a5ff84 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -2494,11 +2494,13 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err, return; } - rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, - NLMSG_ERROR, payload, flags); + rep = nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, + NLMSG_ERROR, payload, flags); errmsg = nlmsg_data(rep); errmsg->error = err; - memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh)); + unsafe_memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) + ? nlh->nlmsg_len : sizeof(*nlh), + /* Bounds checked by the skb layer. */); if (tlvlen) netlink_ack_tlv_fill(in_skb, skb, nlh, err, extack); -- 2.34.1
Powered by blists - more mailing lists