netdev - Re: [PATCH net] net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 23 Jun 2022 06:42:21 +0200
From:   Eric Dumazet <edumazet@...gle.com>
To:     Jens Axboe <axboe@...nel.dk>,
        Alexander Potapenko <glider@...gle.com>
Cc:     "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        netdev <netdev@...r.kernel.org>,
        Eric Dumazet <eric.dumazet@...il.com>,
        syzbot <syzkaller@...glegroups.com>
Subject: Re: [PATCH net] net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()

On Wed, Jun 22, 2022 at 5:24 PM Jens Axboe <axboe@...nel.dk> wrote:
>
> On 6/22/22 9:02 AM, Eric Dumazet wrote:
> > syzbot reported uninit-value in tcp_recvmsg() [1]
> >
> > Issue here is that msg->msg_get_inq should have been cleared,
> > otherwise tcp_recvmsg() might read garbage and perform
> > more work than needed, or have undefined behavior.
> >
> > Given CONFIG_INIT_STACK_ALL_ZERO=y is probably going to be
> > the default soon, I chose to change __sys_recvfrom() to clear
> > all fields but msghdr.addr which might be not NULL.
> >
> > For __copy_msghdr_from_user(), I added an explicit clear
> > of kmsg->msg_get_inq.
> >
> > [1]
> > BUG: KMSAN: uninit-value in tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
> > tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
> > inet_recvmsg+0x13a/0x5a0 net/ipv4/af_inet.c:850
> > sock_recvmsg_nosec net/socket.c:995 [inline]
> > sock_recvmsg net/socket.c:1013 [inline]
> > __sys_recvfrom+0x696/0x900 net/socket.c:2176
> > __do_sys_recvfrom net/socket.c:2194 [inline]
> > __se_sys_recvfrom net/socket.c:2190 [inline]
> > __x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190
> > do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> > do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
> > entry_SYSCALL_64_after_hwframe+0x46/0xb0
> >
> > Local variable msg created at:
> > __sys_recvfrom+0x81/0x900 net/socket.c:2154
> > __do_sys_recvfrom net/socket.c:2194 [inline]
> > __se_sys_recvfrom net/socket.c:2190 [inline]
> > __x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190
> >
> > CPU: 0 PID: 3493 Comm: syz-executor170 Not tainted 5.19.0-rc3-syzkaller-30868-g4b28366af7d9 #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
>
> Thanks Eric, looks good to me:
>
> Reviewed-by: Jens Axboe <axboe@...nel.dk>
>
> --
> Jens Axboe
>

Alexander tested the patch as well:

Tested-by: Alexander Potapenko<glider@...gle.com>

Thanks !