netdev - Re: net: heap-out-of-bounds in sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHA+R7PCNuyW7RhbzxPJvnrX0NA1bxDXR8cL58STXrWkwMXXyA@mail.gmail.com>
Date:	Wed, 16 Dec 2015 12:22:34 -0800
From:	Cong Wang <cwang@...pensource.com>
To:	Dmitry Vyukov <dvyukov@...gle.com>
Cc:	Willem de Bruijn <willemb@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Mel Gorman <mgorman@...hsingularity.net>,
	Craig Gallek <kraig@...gle.com>,
	Ying Xue <ying.xue@...driver.com>,
	Hannes Frederic Sowa <hannes@...essinduktion.org>,
	Edward Jee <edjee@...gle.com>,
	Julia Lawall <julia.lawall@...6.fr>,
	netdev <netdev@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>
Subject: Re: net: heap-out-of-bounds in sock_setsockopt

On Wed, Dec 16, 2015 at 11:34 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
> BUG: KASAN: slab-out-of-bounds in sock_setsockopt+0x1284/0x13d0 at
> addr ffff88006563ec10
> Read of size 4 by task syzkaller_execu/4755
> =============================================================================
> BUG RAWv6 (Not tainted): kasan: bad access detected
> -----------------------------------------------------------------------------
> INFO: Allocated in sk_prot_alloc+0x69/0x340 age=17 cpu=3 pid=4755
> [<      none      >] kmem_cache_alloc+0x244/0x2c0 mm/slub.c:2607
> [<      none      >] sk_prot_alloc+0x69/0x340 net/core/sock.c:1343
> [<      none      >] sk_alloc+0x3a/0x6b0 net/core/sock.c:1418
> [<      none      >] inet6_create+0x2c4/0xfd0 net/ipv6/af_inet6.c:170
> [<      none      >] __sock_create+0x37c/0x640 net/socket.c:1162
> [<     inline     >] sock_create net/socket.c:1202
> [<     inline     >] SYSC_socket net/socket.c:1232
> [<      none      >] SyS_socket+0xef/0x1b0 net/socket.c:1212
> [<      none      >] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
>
> Call Trace:
>  [<ffffffff816cec2e>] __asan_report_load4_noabort+0x3e/0x40
> mm/kasan/report.c:294
>  [<ffffffff84affb14>] sock_setsockopt+0x1284/0x13d0 net/core/sock.c:880
>  [<     inline     >] SYSC_setsockopt net/socket.c:1746
>  [<ffffffff84aed7ee>] SyS_setsockopt+0x1fe/0x240 net/socket.c:1729
>  [<ffffffff85c18c76>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185

Hmm, we should exclude the raw socket case, something like the
following, but I am not sure if the check is too strict or not, also
not sure if we should return an error for this raw socket case.

diff --git a/net/core/sock.c b/net/core/sock.c
index 765be83..c26e80a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -872,7 +872,7 @@ int sock_setsockopt(struct socket *sock, int
level, int optname,

                if (val & SOF_TIMESTAMPING_OPT_ID &&
                    !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)) {
-                       if (sk->sk_protocol == IPPROTO_TCP) {
+                       if (sk->sk_protocol == IPPROTO_TCP &&
sk->sk_type == SOCK_STREAM) {
                                if (sk->sk_state != TCP_ESTABLISHED) {
                                        ret = -EINVAL;
                                        break;
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html