Eric Dumazet f3552c3759 netlink: reset network and mac headers in netlink_dump() ... [ Upstream commit 99c07327ae ] netlink_dump() is allocating an skb, reserves space in it but forgets to reset network header. This allows a BPF program, invoked later from sk_filter() to access uninitialized kernel memory from the reserved space. Theorically mac header reset could be omitted, because it is set to a special initial value. bpf_internal_load_pointer_neg_helper calls skb_mac_header() without checking skb_mac_header_was_set(). Relying on skb->len not being too big seems fragile. We also could add a sanity check in bpf_internal_load_pointer_neg_helper() to avoid surprises in the future. syzbot report was: BUG: KMSAN: uninit-value in ___bpf_prog_run+0xa22b/0xb420 kernel/bpf/core.c:1637 ___bpf_prog_run+0xa22b/0xb420 kernel/bpf/core.c:1637 __bpf_prog_run32+0x121/0x180 kernel/bpf/core.c:1796 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline] __bpf_prog_run include/linux/filter.h:626 [inline] bpf_prog_run include/linux/filter.h:633 [inline] __bpf_prog_run_save_cb+0x168/0x580 include/linux/filter.h:756 bpf_prog_run_save_cb include/linux/filter.h:770 [inline] sk_filter_trim_cap+0x3bc/0x8c0 net/core/filter.c:150 sk_filter include/linux/filter.h:905 [inline] netlink_dump+0xe0c/0x16c0 net/netlink/af_netlink.c:2276 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_read_iter+0x5a9/0x630 net/socket.c:1039 do_iter_readv_writev+0xa7f/0xc70 do_iter_read+0x52c/0x14c0 fs/read_write.c:786 vfs_readv fs/read_write.c:906 [inline] do_readv+0x432/0x800 fs/read_write.c:943 __do_sys_readv fs/read_write.c:1034 [inline] __se_sys_readv fs/read_write.c:1031 [inline] __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was stored to memory at: ___bpf_prog_run+0x96c/0xb420 kernel/bpf/core.c:1558 __bpf_prog_run32+0x121/0x180 kernel/bpf/core.c:1796 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline] __bpf_prog_run include/linux/filter.h:626 [inline] bpf_prog_run include/linux/filter.h:633 [inline] __bpf_prog_run_save_cb+0x168/0x580 include/linux/filter.h:756 bpf_prog_run_save_cb include/linux/filter.h:770 [inline] sk_filter_trim_cap+0x3bc/0x8c0 net/core/filter.c:150 sk_filter include/linux/filter.h:905 [inline] netlink_dump+0xe0c/0x16c0 net/netlink/af_netlink.c:2276 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_read_iter+0x5a9/0x630 net/socket.c:1039 do_iter_readv_writev+0xa7f/0xc70 do_iter_read+0x52c/0x14c0 fs/read_write.c:786 vfs_readv fs/read_write.c:906 [inline] do_readv+0x432/0x800 fs/read_write.c:943 __do_sys_readv fs/read_write.c:1034 [inline] __se_sys_readv fs/read_write.c:1031 [inline] __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3244 [inline] __kmalloc_node_track_caller+0xde3/0x14f0 mm/slub.c:4972 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1158 [inline] netlink_dump+0x30f/0x16c0 net/netlink/af_netlink.c:2242 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_read_iter+0x5a9/0x630 net/socket.c:1039 do_iter_readv_writev+0xa7f/0xc70 do_iter_read+0x52c/0x14c0 fs/read_write.c:786 vfs_readv fs/read_write.c:906 [inline] do_readv+0x432/0x800 fs/read_write.c:943 __do_sys_readv fs/read_write.c:1034 [inline] __se_sys_readv fs/read_write.c:1031 [inline] __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x44/0xae CPU: 0 PID: 3470 Comm: syz-executor751 Not tainted 5.17.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: db65a3aaf2 ("netlink: Trim skb to alloc size to avoid MSG_TRUNC") Fixes: 9063e21fb0 ("netlink: autosize skb lengthes") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20220415181442.551228-1-eric.dumazet@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-04-27 14:38:54 +02:00
..
6lowpan	…
9p	xen/9p: use alloc/free_pages_exact()	2022-03-11 12:22:36 +01:00
802	…
8021q	net: vlan: fix underflow for the real_dev refcnt	2021-12-01 09:04:53 +01:00
appletalk	…
atm	…
ax25	ax25: Fix UAF bugs in ax25 timers	2022-04-20 09:34:22 +02:00
batman-adv	ipv6: make mc_forwarding atomic	2022-04-13 20:59:03 +02:00
bluetooth	Bluetooth: Fix use after free in hci_send_acl	2022-04-13 20:59:09 +02:00
bpf	bpf: Make remote_port field in struct bpf_sk_lookup 16-bit wide	2022-04-13 20:59:25 +02:00
bpfilter	…
bridge	net: bridge: multicast: notify switchdev driver whenever MC processing gets disabled	2022-02-23 12:03:13 +01:00
caif	…
can	can: isotp: stop timeout monitoring when no first frame was sent	2022-04-27 14:38:54 +02:00
ceph	…
core	net/sched: flower: fix parsing of ethertype following VLAN header	2022-04-20 09:34:09 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:12:52 +01:00
dccp	tcp: switch orphan_count to bare per-cpu counters	2021-11-18 19:16:33 +01:00
decnet	…
dns_resolver	…
dsa	net: dsa: hellcreek: Calculate checksums in tagger	2022-04-27 14:38:54 +02:00
ethernet	…
ethtool	ethtool: do not perform operations on net devices being unregistered	2021-12-14 10:57:09 +01:00
hsr	…
ieee802154	net: ieee802154: Return meaningful error codes from the netlink helpers	2022-02-08 18:34:09 +01:00
ife	…
ipv4	esp: limit skb_page_frag_refill use to a single page	2022-04-27 14:38:52 +02:00
ipv6	ipv6: make ip6_rt_gc_expire an atomic_t	2022-04-27 14:38:54 +02:00
iucv	…
kcm	…
key	af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register	2022-04-08 14:22:47 +02:00
l2tp	…
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-27 14:38:53 +02:00
lapb	…
llc	llc: only change llc->dev when bind() succeeds	2022-03-28 09:58:46 +02:00
mac80211	mac80211: limit bandwidth in HE capabilities	2022-04-08 14:23:28 +02:00
mac802154	…
mctp	mctp: Fix check for dev_hard_header() result	2022-04-13 20:59:16 +02:00
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 09:04:47 +01:00
mptcp	mptcp: Correctly set DATA_FIN timeout when number of retransmits is large	2022-03-08 19:12:48 +01:00
ncsi	net/ncsi: check for error return from call to nla_put_u32	2022-01-05 12:42:37 +01:00
netfilter	netfilter: nf_tables: nft_parse_register can return a negative value	2022-04-20 09:34:12 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-04-13 20:59:10 +02:00
netlink	netlink: reset network and mac headers in netlink_dump()	2022-04-27 14:38:54 +02:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-27 11:04:00 +01:00
nfc	nfc: nci: add flush_workqueue to prevent uaf	2022-04-20 09:34:13 +02:00
nsh	…
openvswitch	net: openvswitch: fix leak of nested actions	2022-04-13 20:59:19 +02:00
packet	net/packet: fix packet_sock xmit return value checking	2022-04-27 14:38:53 +02:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:35:16 +01:00
psample	…
qrtr	…
rds	rds: memory leak in __rds_conn_create()	2021-12-22 09:32:42 +01:00
rfkill	rfkill: make new event layout opt-in	2022-04-08 14:23:00 +02:00
rose	…
rxrpc	rxrpc: Restore removed timer deletion	2022-04-27 14:38:53 +02:00
sched	net/sched: cls_u32: fix possible leak in u32_init_knode()	2022-04-27 14:38:53 +02:00
sctp	sctp: Initialize daddr on peeled off socket	2022-04-20 09:34:12 +02:00
smc	net/smc: Fix sock leak when release after smc_shutdown()	2022-04-27 14:38:53 +02:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 19:17:11 +01:00
sunrpc	SUNRPC: Fix NFSD's request deferral on RDMA transports	2022-04-20 09:34:18 +02:00
switchdev	…
tipc	tipc: fix the timer expires after interval 100ms	2022-04-08 14:23:43 +02:00
tls	net/tls: fix slab-out-of-bounds bug in decrypt_internal	2022-04-13 20:59:15 +02:00
unix	af_unix: Support POLLPRI for OOB.	2022-04-08 14:24:14 +02:00
vmw_vsock	vsock/virtio: enable VQs early on probe	2022-04-08 14:23:51 +02:00
wireless	nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size	2022-04-20 09:34:19 +02:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-04-08 14:23:53 +02:00
xdp	xsk: Fix race at socket teardown	2022-04-08 14:23:36 +02:00
xfrm	xfrm: fix tunnel model fragmentation behavior	2022-04-08 14:22:46 +02:00
Kconfig	…
Makefile	…
compat.c	…
devres.c	…
socket.c	net: fix SOF_TIMESTAMPING_BIND_PHC to work with multiple sockets	2022-01-27 11:03:52 +01:00
sysctl_net.c	…