netdev - Re: [PATCH net] sctp: use memdup_user instead of vmemdup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Mar 2019 07:24:06 -0400
From:   Neil Horman <nhorman@...driver.com>
To:     Xin Long <lucien.xin@...il.com>
Cc:     network dev <netdev@...r.kernel.org>, linux-sctp@...r.kernel.org,
        davem@...emloft.net,
        Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
        syzkaller@...glegroups.com
Subject: Re: [PATCH net] sctp: use memdup_user instead of vmemdup_user

On Wed, Mar 20, 2019 at 02:49:38PM +0800, Xin Long wrote:
> In sctp_setsockopt_bindx()/__sctp_setsockopt_connectx(), it allocates
> memory with addrs_size which is passed from userspace. We used flag
> GFP_USER to put some more restrictions on it in Commit cacc06215271
> ("sctp: use GFP_USER for user-controlled kmalloc").
> 
> However, since Commit c981f254cc82 ("sctp: use vmemdup_user() rather
> than badly open-coding memdup_user()"), vmemdup_user() has been used,
> which doesn't check GFP_USER flag when goes to vmalloc_*(). So when
> addrs_size is a huge value, it could exhaust memory and even trigger
> oom killer.
> 
> This patch is to use memdup_user() instead, in which GFP_USER would
> work to limit the memory allocation with a huge addrs_size.
> 
> Note we can't fix it by limiting 'addrs_size', as there's no demand
> for it from RFC.
> 
> Reported-by: syzbot+ec1b7575afef85a0e5ca@...kaller.appspotmail.com
> Fixes: c981f254cc82 ("sctp: use vmemdup_user() rather than badly open-coding memdup_user()")
> Signed-off-by: Xin Long <lucien.xin@...il.com>
> ---
>  net/sctp/socket.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index 6140471..09ad5b2 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -999,7 +999,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
>  	if (unlikely(addrs_size <= 0))
>  		return -EINVAL;
>  
> -	kaddrs = vmemdup_user(addrs, addrs_size);
> +	kaddrs = memdup_user(addrs, addrs_size);
>  	if (unlikely(IS_ERR(kaddrs)))
>  		return PTR_ERR(kaddrs);
>  
> @@ -1007,7 +1007,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
>  	addr_buf = kaddrs;
>  	while (walk_size < addrs_size) {
>  		if (walk_size + sizeof(sa_family_t) > addrs_size) {
> -			kvfree(kaddrs);
> +			kfree(kaddrs);
>  			return -EINVAL;
>  		}
>  
> @@ -1018,7 +1018,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
>  		 * causes the address buffer to overflow return EINVAL.
>  		 */
>  		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
> -			kvfree(kaddrs);
> +			kfree(kaddrs);
>  			return -EINVAL;
>  		}
>  		addrcnt++;
> @@ -1054,7 +1054,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
>  	}
>  
>  out:
> -	kvfree(kaddrs);
> +	kfree(kaddrs);
>  
>  	return err;
>  }
> @@ -1329,7 +1329,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
>  	if (unlikely(addrs_size <= 0))
>  		return -EINVAL;
>  
> -	kaddrs = vmemdup_user(addrs, addrs_size);
> +	kaddrs = memdup_user(addrs, addrs_size);
>  	if (unlikely(IS_ERR(kaddrs)))
>  		return PTR_ERR(kaddrs);
>  
> @@ -1349,7 +1349,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
>  	err = __sctp_connect(sk, kaddrs, addrs_size, flags, assoc_id);
>  
>  out_free:
> -	kvfree(kaddrs);
> +	kfree(kaddrs);
>  
>  	return err;
>  }
> -- 
> 2.1.0
> 
> 
Acked-by: Neil Horman <nhorman@...driver.com>