netdev - Re: [PATCH net v2 1/2] netlink: fix false positive warning in extack during dumps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <73ae0a3c-96d2-497a-af64-2d87244dbb53@intel.com>
Date: Thu, 21 Nov 2024 12:52:54 -0800
From: Jacob Keller <jacob.e.keller@...el.com>
To: Jakub Kicinski <kuba@...nel.org>, <davem@...emloft.net>
CC: <netdev@...r.kernel.org>, <edumazet@...gle.com>, <pabeni@...hat.com>,
	<horms@...nel.org>, <syzbot+d4373fa8042c06cefa84@...kaller.appspotmail.com>,
	<dsahern@...nel.org>
Subject: Re: [PATCH net v2 1/2] netlink: fix false positive warning in extack
 during dumps



On 11/19/2024 2:44 PM, Jakub Kicinski wrote:
> Commit under fixes extended extack reporting to dumps.
> It works under normal conditions, because extack errors are
> usually reported during ->start() or the first ->dump(),
> it's quite rare that the dump starts okay but fails later.
> If the dump does fail later, however, the input skb will
> already have the initiating message pulled, so checking
> if bad attr falls within skb->data will fail.
> 
> Switch the check to using nlh, which is always valid.
> 
> syzbot found a way to hit that scenario by filling up
> the receive queue. In this case we initiate a dump
> but don't call ->dump() until there is read space for
> an skb.
> 
> WARNING: CPU: 1 PID: 5845 at net/netlink/af_netlink.c:2210 netlink_ack_tlv_fill+0x1a8/0x560 net/netlink/af_netlink.c:2209
> RIP: 0010:netlink_ack_tlv_fill+0x1a8/0x560 net/netlink/af_netlink.c:2209
> Call Trace:
>  <TASK>
>  netlink_dump_done+0x513/0x970 net/netlink/af_netlink.c:2250
>  netlink_dump+0x91f/0xe10 net/netlink/af_netlink.c:2351
>  netlink_recvmsg+0x6bb/0x11d0 net/netlink/af_netlink.c:1983
>  sock_recvmsg_nosec net/socket.c:1051 [inline]
>  sock_recvmsg+0x22f/0x280 net/socket.c:1073
>  __sys_recvfrom+0x246/0x3d0 net/socket.c:2267
>  __do_sys_recvfrom net/socket.c:2285 [inline]
>  __se_sys_recvfrom net/socket.c:2281 [inline]
>  __x64_sys_recvfrom+0xde/0x100 net/socket.c:2281
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>  RIP: 0033:0x7ff37dd17a79
> 
> Reported-by: syzbot+d4373fa8042c06cefa84@...kaller.appspotmail.com
> Fixes: 8af4f60472fc ("netlink: support all extack types in dumps")
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>

Reviewed-by: Jacob Keller <jacob.e.keller@...el.com>