netdev - Re: [syzbot] [sctp?] KMSAN: uninit-value in sctp_sf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADvbK_fopx-d-3N9B84C58D+Z_eSiAyeedMH+31SMJXqHNJzfg@mail.gmail.com>
Date: Mon, 26 Aug 2024 12:24:35 -0400
From: Xin Long <lucien.xin@...il.com>
To: syzbot <syzbot+f0cbb34d39392f2746ca@...kaller.appspotmail.com>
Cc: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, 
	linux-kernel@...r.kernel.org, linux-sctp@...r.kernel.org, 
	marcelo.leitner@...il.com, netdev@...r.kernel.org, pabeni@...hat.com, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [sctp?] KMSAN: uninit-value in sctp_sf_ootb

On Mon, Aug 26, 2024 at 12:09 PM syzbot
<syzbot+f0cbb34d39392f2746ca@...kaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    d2bafcf224f3 Merge tag 'cgroup-for-6.11-rc4-fixes' of git:..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15e9b7f5980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=62f882de896675a6
> dashboard link: https://syzkaller.appspot.com/bug?extid=f0cbb34d39392f2746ca
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/17f6ee87834d/disk-d2bafcf2.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/7783769858d1/vmlinux-d2bafcf2.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/45248109d188/bzImage-d2bafcf2.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+f0cbb34d39392f2746ca@...kaller.appspotmail.com
>
> =====================================================
> BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3702
it seems we need a similar fix in sctp_sf_ootb() as:

commit 50619dbf8db77e98d821d615af4f634d08e22698
Author: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
Date:   Mon Jun 28 16:13:42 2021 -0300

    sctp: add size validation when walking chunks


diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 5adf0c0a6c1a..71b9feaf36bc 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3741,7 +3741,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net,
                }

                ch = (struct sctp_chunkhdr *)ch_end;
-       } while (ch_end < skb_tail_pointer(skb));
+       } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));

        if (ootb_shut_ack)
                return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);