netdev - Re: [PATCH v1] net: Add distinct sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220714045517.185599-1-khalid.masum.92@gmail.com>
Date:   Thu, 14 Jul 2022 10:55:17 +0600
From:   Khalid Masum <khalid.masum.92@...il.com>
To:     chuck.lever@...cle.com
Cc:     andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
        daniel@...earbox.net, davem@...emloft.net, edumazet@...gle.com,
        jakub@...udflare.com, john.fastabend@...il.com, kafai@...com,
        kpsingh@...nel.org, kuba@...nel.org, linux-kernel@...r.kernel.org,
        netdev@...r.kernel.org, pabeni@...hat.com, songliubraving@...com,
        yhs@...com, syzbot+1fa91bcd05206ff8cbb5@...kaller.appspotmail.com,
        Khalid Masum <khalid.masum.92@...il.com>
Subject: Re: [PATCH v1] net: Add distinct sk_psock field

On Wed, 13 Jul 2022 10:26:21 -0400 Chuck Lever wrote:
> The sk_psock facility populates the sk_user_data field with the
> address of an extra bit of metadata. User space sockets never
> populate the sk_user_data field, so this has worked out fine.
> 
> However, kernel socket consumers such as the RPC client and server
> do populate the sk_user_data field. The sk_psock() function cannot
> tell that the content of sk_user_data does not point to psock
> metadata, so it will happily return a pointer to something else,
> cast to a struct sk_psock.
> 
> Thus kernel socket consumers and psock currently cannot co-exist.
> 
> We could educate sk_psock() to return NULL if sk_user_data does
> not point to a struct sk_psock. However, a more general solution
> that enables full co-existence psock and other uses of sk_user_data
> might be more interesting.
> 
> Move the struct sk_psock address to its own pointer field so that
> the contents of the sk_user_data field is preserved.
> 
> Reviewed-by: Hannes Reinecke <hare@...e.de>
> Signed-off-by: Chuck Lever <chuck.lever@...cle.com>

The patch seems to fix the syzbot bug: 
[syzbot] KASAN: slab-out-of-bounds Read in sk_psock_get
Reported-by: syzbot+1fa91bcd05206ff8cbb5@...kaller.appspotmail.com
As the reproducer no longer triggers the warning.

Tested-by: Khalid Masum <khalid.masum.92@...il.com>