netdev - Re: KASAN: use-after-free Read in __dev_queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 03 Jan 2018 22:53:14 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Eric Dumazet <edumazet@...gle.com>,
        syzbot <syzbot+71d74a5406d02057d559@...kaller.appspotmail.com>
Cc:     alexander.deucher@....com,
        Andrey Konovalov <andreyknvl@...gle.com>,
        Anoob Soman <anoob.soman@...rix.com>, chris@...is-wilson.co.uk,
        David Miller <davem@...emloft.net>, elena.reshetova@...el.com,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Kees Cook <keescook@...omium.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Mike Maloney <maloney@...gle.com>, mchehab@...nel.org,
        netdev <netdev@...r.kernel.org>, rami.rosen@...el.com,
        Sowmini Varadhan <sowmini.varadhan@...cle.com>,
        syzkaller-bugs@...glegroups.com,
        Willem de Bruijn <willemb@...gle.com>
Subject: Re: KASAN: use-after-free Read in __dev_queue_xmit

On Wed, 2018-01-03 at 21:13 -0800, Eric Dumazet wrote:
> Note: all commands must start from beginning of the line in the email body.
> 
> I guess skb_probe_transport_header() should be hardened to reject malicious
> packets given by user space, instead of being gentle.

Although bug triggered for this particular repro is in flow dissector
:/

I will test :

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 15ce300637650e17fcab7e378b20fe7972686d46..544bddf08e13c7f6e47aadc737244c9ba5af56b2 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -976,8 +976,8 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
 out_good:
        ret = true;
 
-       key_control->thoff = (u16)nhoff;
 out:
+       key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
        key_basic->n_proto = proto;
        key_basic->ip_proto = ip_proto;
 
@@ -985,7 +985,6 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
 
 out_bad:
        ret = false;
-       key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
        goto out;
 }
 EXPORT_SYMBOL(__skb_flow_dissect);