netdev - Re: [PATCH net-next 1/2] mptcp: do not inherit inet proto ops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200125.081453.329018046256576212.davem@davemloft.net>
Date:   Sat, 25 Jan 2020 08:14:53 +0100 (CET)
From:   David Miller <davem@...emloft.net>
To:     mathew.j.martineau@...ux.intel.com
Cc:     netdev@...r.kernel.org, fw@...len.de, mptcp@...ts.01.org,
        edumazet@...gle.com, cpaasch@...le.com
Subject: Re: [PATCH net-next 1/2] mptcp: do not inherit inet proto ops

From: Mat Martineau <mathew.j.martineau@...ux.intel.com>
Date: Fri, 24 Jan 2020 16:04:02 -0800

> From: Florian Westphal <fw@...len.de>
> 
> We need to initialise the struct ourselves, else we expose tcp-specific
> callbacks such as tcp_splice_read which will then trigger splat because
> the socket is an mptcp one:
> 
> BUG: KASAN: slab-out-of-bounds in tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
> Write of size 8 at addr ffff888116aa21d0 by task syz-executor.0/5478
> 
> CPU: 1 PID: 5478 Comm: syz-executor.0 Not tainted 5.5.0-rc6 #3
> Call Trace:
>  tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
>  tcp_rcv_space_adjust+0x72/0x7f0 net/ipv4/tcp_input.c:612
>  tcp_read_sock+0x622/0x990 net/ipv4/tcp.c:1674
>  tcp_splice_read+0x20b/0xb40 net/ipv4/tcp.c:791
>  do_splice+0x1259/0x1560 fs/splice.c:1205
> 
> To prevent build error with ipv6, add the recv/sendmsg function
> declaration to ipv6.h.  The functions are already accessible "thanks"
> to retpoline related work, but they are currently only made visible
> by socket.c specific INDIRECT_CALLABLE macros.
> 
> Reported-by: Christoph Paasch <cpaasch@...le.com>
> Signed-off-by: Florian Westphal <fw@...len.de>
> Signed-off-by: Mat Martineau <mathew.j.martineau@...ux.intel.com>

Applied.