netdev - Re: [PATCH net] net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Jun 2022 09:24:38 -0600
From:   Jens Axboe <axboe@...nel.dk>
To:     Eric Dumazet <edumazet@...gle.com>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Cc:     netdev@...r.kernel.org, eric.dumazet@...il.com,
        syzbot <syzkaller@...glegroups.com>
Subject: Re: [PATCH net] net: clear msg_get_inq in __sys_recvfrom() and
 __copy_msghdr_from_user()

On 6/22/22 9:02 AM, Eric Dumazet wrote:
> syzbot reported uninit-value in tcp_recvmsg() [1]
> 
> Issue here is that msg->msg_get_inq should have been cleared,
> otherwise tcp_recvmsg() might read garbage and perform
> more work than needed, or have undefined behavior.
> 
> Given CONFIG_INIT_STACK_ALL_ZERO=y is probably going to be
> the default soon, I chose to change __sys_recvfrom() to clear
> all fields but msghdr.addr which might be not NULL.
> 
> For __copy_msghdr_from_user(), I added an explicit clear
> of kmsg->msg_get_inq.
> 
> [1]
> BUG: KMSAN: uninit-value in tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
> tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
> inet_recvmsg+0x13a/0x5a0 net/ipv4/af_inet.c:850
> sock_recvmsg_nosec net/socket.c:995 [inline]
> sock_recvmsg net/socket.c:1013 [inline]
> __sys_recvfrom+0x696/0x900 net/socket.c:2176
> __do_sys_recvfrom net/socket.c:2194 [inline]
> __se_sys_recvfrom net/socket.c:2190 [inline]
> __x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> Local variable msg created at:
> __sys_recvfrom+0x81/0x900 net/socket.c:2154
> __do_sys_recvfrom net/socket.c:2194 [inline]
> __se_sys_recvfrom net/socket.c:2190 [inline]
> __x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190
> 
> CPU: 0 PID: 3493 Comm: syz-executor170 Not tainted 5.19.0-rc3-syzkaller-30868-g4b28366af7d9 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Thanks Eric, looks good to me:

Reviewed-by: Jens Axboe <axboe@...nel.dk>

-- 
Jens Axboe