linux-kernel - Re: [PATCH net] udp: Fix __ip_append_data()'s handling of MSG_SPLICE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1481564.1690909060@warthog.procyon.org.uk>
Date:   Tue, 01 Aug 2023 17:57:40 +0100
From:   David Howells <dhowells@...hat.com>
To:     Willem de Bruijn <willemdebruijn.kernel@...il.com>
Cc:     dhowells@...hat.com, netdev@...r.kernel.org,
        syzbot+f527b971b4bdc8e79f9e@...kaller.appspotmail.com,
        bpf@...r.kernel.org, brauner@...nel.org, davem@...emloft.net,
        dsahern@...nel.org, edumazet@...gle.com, kuba@...nel.org,
        pabeni@...hat.com, axboe@...nel.dk, viro@...iv.linux.org.uk,
        linux-fsdevel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] udp: Fix __ip_append_data()'s handling of MSG_SPLICE_PAGES

Willem de Bruijn <willemdebruijn.kernel@...il.com> wrote:

> copy -= -fraggap definitely seems off. You point out that it even can
> turn length negative?

Yes.  See the logging I posted:

	==>splice_to_socket() 6630
	udp_sendmsg(8,8)
	__ip_append_data(copy=-1,len=8, mtu=8192 skblen=8189 maxfl=8188)
	pagedlen 9 = 9 - 0
	copy -1 = 9 - 0 - 1 - 9
	length 8 -= -1 + 0

Since datalen and transhdrlen cancel, and fraggap is unsigned, if fraggap is
non-zero, copy will be negative.

> The WARN_ON_ONCE, if it can be reached, will be user triggerable.
> Usually for those cases and when there is a viable return with error
> path, that is preferable. But if you prefer to taunt syzbot, ok. We
> can always remove this later.

It shouldn't be possible for length to exceed msg->msg_iter.count (assuming
there is a msg) coming from userspace; further, userspace can't directly
specify MSG_SPLICE_PAGES.

> __ip6_append_data probably needs the same.

Good point.  The arrangement of the code is a bit different, but I think it's
substantially the same in this regard.

David