netdev - Re: [PATCH net v2 2/3] net: prevent rewrite of msg_name in sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADKFtnQnOnaq_3_o5OoWpuMvzTgzL2qKcY5oc=AbdZJvONSyKQ@mail.gmail.com>
Date: Mon, 18 Sep 2023 10:52:44 -0700
From: Jordan Rife <jrife@...gle.com>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>
Cc: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, 
	pabeni@...hat.com, netdev@...r.kernel.org, dborkman@...nel.org
Subject: Re: [PATCH net v2 2/3] net: prevent rewrite of msg_name in sock_sendmsg()

> You used this short-hand to avoid having to update all callers to sock_sendmsg to __kernel_sendmsg?

Sorry about that, I misunderstood the intent. I'm fine with
introducing a new function, doing the address copy there, and
replacing all calls to sock_sendmsg with this wrapper. One thought on
the naming though,

To me the "__" prefix seems out of place for a function meant as a
public interface. Some possible alternatives:

1) Rename the current kernel_sendmsg() function to
kernel_sendmsg_kvec() and name  our new function kernel_sendmsg(). To
me this makes some sense, considering the new function is the more
generic of the two, and the existing kernel_sendmsg() specifically
accepts "struct kvec".
2) Same as #1, but drop the old kernel_sendmsg() function instead of
renaming it. Adapt all calls to the old kernel_sendmsg() to fit the
new kernel_sendmsg() (this amounts to adding a
iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size); call in
each spot before kernel_sendmsg() is called.

-Jordan

On Mon, Sep 18, 2023 at 6:09 AM Willem de Bruijn
<willemdebruijn.kernel@...il.com> wrote:
>
> On Sun, Sep 17, 2023 at 10:50 PM Jordan Rife <jrife@...gle.com> wrote:
> >
> > Callers of sock_sendmsg(), and similarly kernel_sendmsg(), in kernel
> > space may observe their value of msg_name change in cases where BPF
> > sendmsg hooks rewrite the send address. This has been confirmed to break
> > NFS mounts running in UDP mode and has the potential to break other
> > systems.
> >
> > This patch:
> >
> > 1) Creates a new function called __sock_sendmsg() with same logic as the
> >    old sock_sendmsg() function.
> > 2) Replaces calls to sock_sendmsg() made by __sys_sendto() and
> >    __sys_sendmsg() with __sock_sendmsg() to avoid an unnecessary copy,
> >    as these system calls are already protected.
> > 3) Modifies sock_sendmsg() so that it makes a copy of msg_name if
> >    present before passing it down the stack to insulate callers from
> >    changes to the send address.
>
> You used this short-hand to avoid having to update all callers to
> sock_sendmsg to __kernel_sendmsg?
>
> Unless the changes are massively worse than the other two patches, I
> do think using the kernel_.. prefix is preferable, as it documents
> that in-kernel users should use the kernel_.. sockets API rather than
> directly call the sock_.. ones.
>
> It's not clear that sock_sendmsg really is part of the kernel socket API.