linux-kernel - Re: [PATCH] do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240122104344.egvhl4m4xiakuq55@quack3>
Date: Mon, 22 Jan 2024 11:43:44 +0100
From: Jan Kara <jack@...e.cz>
To: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
Cc: Chuck Lever <chuck.lever@...cle.com>, Jeff Layton <jlayton@...nel.org>,
	Amir Goldstein <amir73il@...il.com>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
	linux-fsdevel@...r.kernel.org, linux-nfs@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	syzbot+09b349b3066c2e0b1e96@...kaller.appspotmail.com
Subject: Re: [PATCH] do_sys_name_to_handle(): use kzalloc() to fix
 kernel-infoleak

On Fri 19-01-24 07:39:06, Nikita Zhandarovich wrote:
> syzbot identified a kernel information leak vulnerability in
> do_sys_name_to_handle() and issued the following report [1].
> 
> [1]
> "BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
> BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40
>  instrument_copy_to_user include/linux/instrumented.h:114 [inline]
>  _copy_to_user+0xbc/0x100 lib/usercopy.c:40
>  copy_to_user include/linux/uaccess.h:191 [inline]
>  do_sys_name_to_handle fs/fhandle.c:73 [inline]
>  __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]
>  __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94
>  __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94
>  ...
> 
> Uninit was created at:
>  slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
>  slab_alloc_node mm/slub.c:3478 [inline]
>  __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517
>  __do_kmalloc_node mm/slab_common.c:1006 [inline]
>  __kmalloc+0x121/0x3c0 mm/slab_common.c:1020
>  kmalloc include/linux/slab.h:604 [inline]
>  do_sys_name_to_handle fs/fhandle.c:39 [inline]
>  __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]
>  __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94
>  __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94
>  ...
> 
> Bytes 18-19 of 20 are uninitialized
> Memory access of size 20 starts at ffff888128a46380
> Data copied to user address 0000000020000240"
> 
> Per Chuck Lever's suggestion, use kzalloc() instead of kmalloc() to
> solve the problem.
> 
> Fixes: 990d6c2d7aee ("vfs: Add name to file handle conversion support")
> Suggested-by: Chuck Lever III <chuck.lever@...cle.com>
> Reported-and-tested-by: syzbot+09b349b3066c2e0b1e96@...kaller.appspotmail.com
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>

Makes sense. Feel free to add:

Reviewed-by: Jan Kara <jack@...e.cz>

								Honza

> ---
> Link to Chuck's suggestion: 
> https://lore.kernel.org/all/B4A8D625-6997-49C8-B105-B2DCFE8C6DDA@oracle.com/
> 
>  fs/fhandle.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/fhandle.c b/fs/fhandle.c
> index 18b3ba8dc8ea..57a12614addf 100644
> --- a/fs/fhandle.c
> +++ b/fs/fhandle.c
> @@ -36,7 +36,7 @@ static long do_sys_name_to_handle(const struct path *path,
>  	if (f_handle.handle_bytes > MAX_HANDLE_SZ)
>  		return -EINVAL;
>  
> -	handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
> +	handle = kzalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
>  			 GFP_KERNEL);
>  	if (!handle)
>  		return -ENOMEM;
> -- 
> 2.25.1
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR