leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
d02fd6e7d2
linux/net/rds
History
Avinash Repaka 14e138a86f RDS: Check cmsg_len before dereferencing CMSG_DATA 
RDS currently doesn't check if the length of the control message is
large enough to hold the required data, before dereferencing the control
message data. This results in following crash:

BUG: KASAN: stack-out-of-bounds in rds_rdma_bytes net/rds/send.c:1013
[inline]
BUG: KASAN: stack-out-of-bounds in rds_sendmsg+0x1f02/0x1f90
net/rds/send.c:1066
Read of size 8 at addr ffff8801c928fb70 by task syzkaller455006/3157

CPU: 0 PID: 3157 Comm: syzkaller455006 Not tainted 4.15.0-rc3+ #161
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x25b/0x340 mm/kasan/report.c:409
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
 rds_rdma_bytes net/rds/send.c:1013 [inline]
 rds_sendmsg+0x1f02/0x1f90 net/rds/send.c:1066
 sock_sendmsg_nosec net/socket.c:628 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:638
 ___sys_sendmsg+0x320/0x8b0 net/socket.c:2018
 __sys_sendmmsg+0x1ee/0x620 net/socket.c:2108
 SYSC_sendmmsg net/socket.c:2139 [inline]
 SyS_sendmmsg+0x35/0x60 net/socket.c:2134
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x43fe49
RSP: 002b:00007fffbe244ad8 EFLAGS: 00000217 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fe49
RDX: 0000000000000001 RSI: 000000002020c000 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004017b0
R13: 0000000000401840 R14: 0000000000000000 R15: 0000000000000000

To fix this, we verify that the cmsg_len is large enough to hold the
data to be read, before proceeding further.

Reported-by: syzbot <syzkaller-bugs@googlegroups.com>
Signed-off-by: Avinash Repaka <avinash.repaka@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-27 10:37:23 -05:00
..
af_rds.c RDS: validate the requested traces user input against max supported 2017-01-06 22:14:26 -05:00
bind.c RDS: make rhashtable_params const 2017-08-28 11:30:02 -07:00
cong.c RDS: split out connection specific state from rds_connection to rds_conn_path 2016-06-14 23:50:41 -07:00
connection.c rds: reduce memory footprint for RDS when transport is RDMA 2017-08-03 09:27:59 -07:00
ib_cm.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-03-15 11:59:10 -07:00
ib_fmr.c net/rds/ib_fmr.c: use kmalloc_array_node() 2017-11-15 18:21:02 -08:00
ib_frmr.c RDS: IB: split the mr registration and invalidation path 2017-01-02 14:02:47 -08:00
ib_mr.h rds: ib: add the static type to the function 2017-03-13 23:20:05 -07:00
ib_rdma.c RDS: IB: Initialize max_items based on underlying device attributes 2017-10-05 21:16:33 -07:00
ib_recv.c rds: ib: Fix NULL pointer dereference in debug code 2017-11-10 14:54:47 +09:00
ib_ring.c
ib_send.c rds: Fix inaccurate accounting of unsignaled wrs 2017-10-26 17:35:57 +09:00
ib_stats.c RDS: IB: add few useful cache stasts 2017-01-02 14:02:51 -08:00
ib_sysctl.c net: Convert uses of typedef ctl_table to struct ctl_table 2013-06-13 02:36:09 -07:00
ib.c RDS: IB: Limit the scope of has_fr/has_fmr variables 2017-10-05 21:16:33 -07:00
ib.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-04 09:26:51 +09:00
info.c rds: fix an integer overflow test in rds_info_getsockopt() 2015-08-03 15:20:16 -07:00
info.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig RDS: Drop stale iWARP RDMA transport 2016-03-02 14:13:17 -05:00
loop.c RDS: TCP: Hooks to set up a single connection path 2016-07-01 16:45:17 -04:00
loop.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
message.c net, rds: convert rds_message.m_refcount from atomic_t to refcount_t 2017-07-04 22:35:18 +01:00
page.c rds: remove dead code 2016-12-26 21:35:39 -05:00
rdma_transport.c RDS: RDMA: start rdma listening after init 2017-01-02 14:02:45 -08:00
rdma_transport.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rdma.c rds: Fix NULL pointer dereference in __rds_rdma_map 2017-12-06 15:44:27 -05:00
rds_single_path.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rds.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
recv.c net, rds: convert rds_incoming.i_refcount from atomic_t to refcount_t 2017-07-04 22:35:17 +01:00
send.c RDS: Check cmsg_len before dereferencing CMSG_DATA 2017-12-27 10:37:23 -05:00
stats.c net/rds: zero last byte for strncpy 2013-03-08 00:35:44 -05:00
sysctl.c net: rds: fix coding style issues 2016-06-18 21:34:09 -07:00
tcp_connect.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
tcp_listen.c rds: tcp: use sock_create_lite() to create the accept socket 2017-07-08 11:16:16 +01:00
tcp_recv.c RDS: add receive message trace used by application 2017-01-02 14:02:59 -08:00
tcp_send.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
tcp_stats.c
tcp.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
tcp.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
threads.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
transport.c rds: remove unnecessary returned value check 2017-03-03 09:51:22 -08:00