linux-kernel - Re: [PATCH net 1/2] af_unix: Fix uninit-value in __unix_walk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240703024248.99131-1-kuniyu@amazon.com>
Date: Tue, 2 Jul 2024 19:42:48 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <syoshida@...hat.com>
CC: <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
	<kuniyu@...zon.com>, <linux-kernel@...r.kernel.org>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>, <syzkaller@...glegroups.com>
Subject: Re: [PATCH net 1/2] af_unix: Fix uninit-value in __unix_walk_scc()

From: Shigeru Yoshida <syoshida@...hat.com>
Date: Wed,  3 Jul 2024 01:04:27 +0900
> KMSAN reported uninit-value access in __unix_walk_scc() [1].
> 
> In the list_for_each_entry_reverse() loop, when the vertex's index
> equals it's scc_index, the loop uses the variable vertex as a
> temporary variable that points to a vertex in scc. And when the loop
> is finished, the variable vertex points to the list head, in this case
> scc, which is a local variable on the stack (more precisely, it's not
> even scc and might underflow the call stack of __unix_walk_scc():
> container_of(&scc, struct unix_vertex, scc_entry)).
> 
> However, the variable vertex is used under the label prev_vertex. So
> if the edge_stack is not empty and the function jumps to the
> prev_vertex label, the function will access invalid data on the
> stack. This causes the uninit-value access issue.
> 
> Fix this by introducing a new temporary variable for the loop.
> 
> [1]
> BUG: KMSAN: uninit-value in __unix_walk_scc net/unix/garbage.c:478 [inline]
> BUG: KMSAN: uninit-value in unix_walk_scc net/unix/garbage.c:526 [inline]
> BUG: KMSAN: uninit-value in __unix_gc+0x2589/0x3c20 net/unix/garbage.c:584
>  __unix_walk_scc net/unix/garbage.c:478 [inline]
>  unix_walk_scc net/unix/garbage.c:526 [inline]
>  __unix_gc+0x2589/0x3c20 net/unix/garbage.c:584
>  process_one_work kernel/workqueue.c:3231 [inline]
>  process_scheduled_works+0xade/0x1bf0 kernel/workqueue.c:3312
>  worker_thread+0xeb6/0x15b0 kernel/workqueue.c:3393
>  kthread+0x3c4/0x530 kernel/kthread.c:389
>  ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> 
> Uninit was stored to memory at:
>  unix_walk_scc net/unix/garbage.c:526 [inline]
>  __unix_gc+0x2adf/0x3c20 net/unix/garbage.c:584
>  process_one_work kernel/workqueue.c:3231 [inline]
>  process_scheduled_works+0xade/0x1bf0 kernel/workqueue.c:3312
>  worker_thread+0xeb6/0x15b0 kernel/workqueue.c:3393
>  kthread+0x3c4/0x530 kernel/kthread.c:389
>  ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> 
> Local variable entries created at:
>  ref_tracker_free+0x48/0xf30 lib/ref_tracker.c:222
>  netdev_tracker_free include/linux/netdevice.h:4058 [inline]
>  netdev_put include/linux/netdevice.h:4075 [inline]
>  dev_put include/linux/netdevice.h:4101 [inline]
>  update_gid_event_work_handler+0xaa/0x1b0 drivers/infiniband/core/roce_gid_mgmt.c:813
> 
> CPU: 1 PID: 12763 Comm: kworker/u8:31 Not tainted 6.10.0-rc4-00217-g35bb670d65fc #32
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
> Workqueue: events_unbound __unix_gc
> 
> Fixes: 3484f063172d ("af_unix: Detect Strongly Connected Components.")
> Reported-by: syzkaller <syzkaller@...glegroups.com>
> Signed-off-by: Shigeru Yoshida <syoshida@...hat.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>

Thanks!