netdev - limit allocation size in ieee802154_sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120711221209.GA30506@redhat.com>
Date:	Wed, 11 Jul 2012 18:12:09 -0400
From:	Dave Jones <davej@...hat.com>
To:	netdev@...r.kernel.org
Subject: limit allocation size in ieee802154_sock_sendmsg

Sasha reported this last November (https://lkml.org/lkml/2011/11/22/41)
and I keep walking into it while fuzz testing.

Length of the packet is passed in from userspace, and passed down to the
page allocator unchecked. If the allocation size is bigger than MAX_ORDER,
we get this backtrace from the page allocator.

 WARNING: at mm/page_alloc.c:2298 __alloc_pages_nodemask+0x46d/0xb00()
 Call Trace:
  [<ffffffff81064b2f>] warn_slowpath_common+0x7f/0xc0
  [<ffffffff81064b8a>] warn_slowpath_null+0x1a/0x20
  [<ffffffff8116105d>] __alloc_pages_nodemask+0x46d/0xb00
  [<ffffffff8155ed3b>] ? __alloc_skb+0x4b/0x230
  [<ffffffff810d43dd>] ? trace_hardirqs_on+0xd/0x10
  [<ffffffff816ace3f>] kmalloc_large_node+0x66/0xab
  [<ffffffff811ad9b5>] __kmalloc_node_track_caller+0x1b5/0x200
  [<ffffffff81559701>] ? sock_alloc_send_pskb+0x271/0x3e0
  [<ffffffff8155ed68>] __alloc_skb+0x78/0x230
  [<ffffffff81559701>] sock_alloc_send_pskb+0x271/0x3e0
  [<ffffffff8156d331>] ? dev_getfirstbyhwtype+0x161/0x250
  [<ffffffff8156d1d0>] ? rps_may_expire_flow+0x220/0x220
  [<ffffffff81559885>] sock_alloc_send_skb+0x15/0x20
  [<ffffffffa4a73347>] dgram_sendmsg+0xe7/0x340 [af_802154]
  [<ffffffffa4a72044>] ieee802154_sock_sendmsg+0x14/0x20 [af_802154]
  [<ffffffff81553787>] sock_sendmsg+0x117/0x130
  [<ffffffff810cdb7d>] ? trace_hardirqs_off+0xd/0x10
  [<ffffffff816b81c7>] ? _raw_spin_unlock_irqrestore+0x77/0x80
  [<ffffffff8134312b>] ? debug_object_activate+0x12b/0x1a0
  [<ffffffff816b81c7>] ? _raw_spin_unlock_irqrestore+0x77/0x80
  [<ffffffff81556b60>] sys_sendto+0x140/0x190
  [<ffffffff816c5014>] ? bad_to_user+0x5e/0x80a
  [<ffffffff8133c04e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
  [<ffffffff816c15e9>] system_call_fastpath+0x16/0x1b

Signed-off-by: Dave Jones <davej@...hat.com>

diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 40e606f..1da228a 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -108,6 +108,9 @@ static int ieee802154_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 {
 	struct sock *sk = sock->sk;
 
+	if (len > MAX_ORDER_NR_PAGES * PAGE_SIZE)
+		return -EINVAL;
+
 	return sk->sk_prot->sendmsg(iocb, sk, msg, len);
 }
 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html