netdev - Re: [stable 3.18 backport v2] netlink: Trim skb to alloc size to avoid MSG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 25 Feb 2019 16:30:11 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Mark Salyzyn <salyzyn@...roid.com>
Cc:     linux-kernel@...r.kernel.org, "Arad, Ronen" <ronen.arad@...el.com>,
        "David S . Miller" <davem@...emloft.net>,
        Dmitry Safonov <dima@...sta.com>,
        David Ahern <dsahern@...il.com>,
        Kirill Tkhai <ktkhai@...tuozzo.com>,
        Andrei Vagin <avagin@...tuozzo.com>,
        Li RongQing <lirongqing@...du.com>, YU Bo <tsu.yubo@...il.com>,
        Denys Vlasenko <dvlasenk@...hat.com>, netdev@...r.kernel.org,
        stable@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>,
        Alexander Potapenko <glider@...gle.com>
Subject: Re: [stable 3.18 backport v2] netlink: Trim skb to alloc size to
 avoid MSG_TRUNC

On Fri, Feb 22, 2019 at 08:03:28AM -0800, Mark Salyzyn wrote:
> From: "Arad, Ronen" <ronen.arad@...el.com>
> 
> Direct this upstream db65a3aaf29ecce2e34271d52e8d2336b97bd9fe sha to
> stable 3.18.  This patch addresses a race condition where a call to
> 
>  nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
>  nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
> 
> one thread in-between another thread:
> 
>  skb = netlink_alloc_skb(sk,
> 
> and
> 
>  skb_reserve(skb, skb_tailroom(skb) -
>              nlk->max_recvmsg_len);
> 
> in netlink_dump.  The result can be a negative value and will cause
> a kernel panic ad BUG at net/core/skbuff.c because the negative value
> turns into an extremely large positive value.
> 
> Original commit:
> 
> netlink_dump() allocates skb based on the calculated min_dump_alloc or
> a per socket max_recvmsg_len.
> min_alloc_size is maximum space required for any single netdev
> attributes as calculated by rtnl_calcit().
> max_recvmsg_len tracks the user provided buffer to netlink_recvmsg.
> It is capped at 16KiB.
> The intention is to avoid small allocations and to minimize the number
> of calls required to obtain dump information for all net devices.
> 
> netlink_dump packs as many small messages as could fit within an skb
> that was sized for the largest single netdev information. The actual
> space available within an skb is larger than what is requested. It could
> be much larger and up to near 2x with align to next power of 2 approach.
> 
> Allowing netlink_dump to use all the space available within the
> allocated skb increases the buffer size a user has to provide to avoid
> truncaion (i.e. MSG_TRUNG flag set).
> 
> It was observed that with many VLANs configured on at least one netdev,
> a larger buffer of near 64KiB was necessary to avoid "Message truncated"
> error in "ip link" or "bridge [-c[ompressvlans]] vlan show" when
> min_alloc_size was only little over 32KiB.
> 
> This patch trims skb to allocated size in order to allow the user to
> avoid truncation with more reasonable buffer size.
> 
> Signed-off-by: Ronen Arad <ronen.arad@...el.com>
> Signed-off-by: David S. Miller <davem@...emloft.net>
> 
> (cherry pick commit db65a3aaf29ecce2e34271d52e8d2336b97bd9fe)
> Signed-off-by: Mark Salyzyn <salyzyn@...roid.com>
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Cc: Ronen Arad <ronen.arad@...el.com>
> Cc: "David S . Miller" <davem@...emloft.net>
> Cc: Dmitry Safonov <dima@...sta.com>
> Cc: David Ahern <dsahern@...il.com>
> Cc: Kirill Tkhai <ktkhai@...tuozzo.com>
> Cc: Andrei Vagin <avagin@...tuozzo.com>
> Cc: Li RongQing <lirongqing@...du.com>
> Cc: YU Bo <tsu.yubo@...il.com>
> Cc: Denys Vlasenko <dvlasenk@...hat.com>
> Cc: netdev@...r.kernel.org
> Cc: linux-kernel@...r.kernel.org
> Cc: stable@...r.kernel.org # 3.18
> ---
>  net/netlink/af_netlink.c | 34 ++++++++++++++++++++++------------
>  1 file changed, 22 insertions(+), 12 deletions(-)

Now queued up, thanks.

greg k-h