Eric Dumazet 99c07327ae netlink: reset network and mac headers in netlink_dump() ... netlink_dump() is allocating an skb, reserves space in it but forgets to reset network header. This allows a BPF program, invoked later from sk_filter() to access uninitialized kernel memory from the reserved space. Theorically mac header reset could be omitted, because it is set to a special initial value. bpf_internal_load_pointer_neg_helper calls skb_mac_header() without checking skb_mac_header_was_set(). Relying on skb->len not being too big seems fragile. We also could add a sanity check in bpf_internal_load_pointer_neg_helper() to avoid surprises in the future. syzbot report was: BUG: KMSAN: uninit-value in ___bpf_prog_run+0xa22b/0xb420 kernel/bpf/core.c:1637 ___bpf_prog_run+0xa22b/0xb420 kernel/bpf/core.c:1637 __bpf_prog_run32+0x121/0x180 kernel/bpf/core.c:1796 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline] __bpf_prog_run include/linux/filter.h:626 [inline] bpf_prog_run include/linux/filter.h:633 [inline] __bpf_prog_run_save_cb+0x168/0x580 include/linux/filter.h:756 bpf_prog_run_save_cb include/linux/filter.h:770 [inline] sk_filter_trim_cap+0x3bc/0x8c0 net/core/filter.c:150 sk_filter include/linux/filter.h:905 [inline] netlink_dump+0xe0c/0x16c0 net/netlink/af_netlink.c:2276 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_read_iter+0x5a9/0x630 net/socket.c:1039 do_iter_readv_writev+0xa7f/0xc70 do_iter_read+0x52c/0x14c0 fs/read_write.c:786 vfs_readv fs/read_write.c:906 [inline] do_readv+0x432/0x800 fs/read_write.c:943 __do_sys_readv fs/read_write.c:1034 [inline] __se_sys_readv fs/read_write.c:1031 [inline] __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was stored to memory at: ___bpf_prog_run+0x96c/0xb420 kernel/bpf/core.c:1558 __bpf_prog_run32+0x121/0x180 kernel/bpf/core.c:1796 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline] __bpf_prog_run include/linux/filter.h:626 [inline] bpf_prog_run include/linux/filter.h:633 [inline] __bpf_prog_run_save_cb+0x168/0x580 include/linux/filter.h:756 bpf_prog_run_save_cb include/linux/filter.h:770 [inline] sk_filter_trim_cap+0x3bc/0x8c0 net/core/filter.c:150 sk_filter include/linux/filter.h:905 [inline] netlink_dump+0xe0c/0x16c0 net/netlink/af_netlink.c:2276 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_read_iter+0x5a9/0x630 net/socket.c:1039 do_iter_readv_writev+0xa7f/0xc70 do_iter_read+0x52c/0x14c0 fs/read_write.c:786 vfs_readv fs/read_write.c:906 [inline] do_readv+0x432/0x800 fs/read_write.c:943 __do_sys_readv fs/read_write.c:1034 [inline] __se_sys_readv fs/read_write.c:1031 [inline] __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3244 [inline] __kmalloc_node_track_caller+0xde3/0x14f0 mm/slub.c:4972 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1158 [inline] netlink_dump+0x30f/0x16c0 net/netlink/af_netlink.c:2242 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_read_iter+0x5a9/0x630 net/socket.c:1039 do_iter_readv_writev+0xa7f/0xc70 do_iter_read+0x52c/0x14c0 fs/read_write.c:786 vfs_readv fs/read_write.c:906 [inline] do_readv+0x432/0x800 fs/read_write.c:943 __do_sys_readv fs/read_write.c:1034 [inline] __se_sys_readv fs/read_write.c:1031 [inline] __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x44/0xae CPU: 0 PID: 3470 Comm: syz-executor751 Not tainted 5.17.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: db65a3aaf2 ("netlink: Trim skb to alloc size to avoid MSG_TRUNC") Fixes: 9063e21fb0 ("netlink: autosize skb lengthes") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20220415181442.551228-1-eric.dumazet@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2022-04-19 15:05:03 +02:00
..
6lowpan	…
9p	…
802	…
8021q	vlan: use correct format characters	2022-03-17 16:34:49 -07:00
appletalk	…
atm	…
ax25	ax25: Fix UAF bugs in ax25 timers	2022-03-29 10:24:34 +02:00
batman-adv	…
bluetooth	Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed	2022-03-18 17:12:08 +01:00
bpf	…
bpfilter	…
bridge	net: bridge: mst: Restrict info size queries to bridge ports	2022-03-23 10:32:44 -07:00
caif	…
can	can: isotp: stop timeout monitoring when no first frame was sent	2022-04-17 17:21:22 +02:00
ceph	…
core	rtnetlink: Fix handling of disabled L3 stats in RTM_GETSTATS replies	2022-04-14 09:01:26 +02:00
dcb	…
dccp	…
decnet	…
dns_resolver	…
dsa	net: dsa: hellcreek: Calculate checksums in tagger	2022-04-19 09:49:38 +02:00
ethernet	…
ethtool	…
hsr	…
ieee802154	…
ife	…
ipv4	net: Handle l3mdev in ip_tunnel_init_flow	2022-04-15 14:27:30 -07:00
ipv6	ipv6: make ip6_rt_gc_expire an atomic_t	2022-04-15 14:28:50 -07:00
iucv	…
kcm	…
key	…
l2tp	…
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-15 14:27:24 -07:00
lapb	…
llc	llc: only change llc->dev when bind() succeeds	2022-03-25 16:55:41 -07:00
mac80211	mac80211: fix ht_capa printout in debugfs	2022-04-11 11:57:27 +02:00
mac802154	…
mctp	mctp: Use output netdev to allocate skb headroom	2022-04-01 12:04:15 +01:00
mpls	…
mptcp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
ncsi	…
netfilter	netfilter: nf_tables: nft_parse_register can return a negative value	2022-04-12 11:36:37 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-03-21 10:59:11 +00:00
netlink	netlink: reset network and mac headers in netlink_dump()	2022-04-19 15:05:03 +02:00
netrom	…
nfc	nfc: nci: add flush_workqueue to prevent uaf	2022-04-13 14:44:44 +01:00
nsh	…
openvswitch	openvswitch: fix OOB access in reserve_sfa_size()	2022-04-15 11:50:02 +01:00
packet	net/packet: fix packet_sock xmit return value checking	2022-04-15 11:17:30 +01:00
phonet	…
psample	…
qrtr	…
rds	…
rfkill	rfkill: make new event layout opt-in	2022-03-18 13:09:17 +02:00
rose	…
rxrpc	rxrpc: Restore removed timer deletion	2022-04-15 10:54:49 +01:00
sched	net/sched: cls_u32: fix possible leak in u32_init_knode()	2022-04-15 14:26:11 -07:00
sctp	sctp: Initialize daddr on peeled off socket	2022-04-11 20:33:10 -07:00
smc	net/smc: Fix sock leak when release after smc_shutdown()	2022-04-15 11:14:38 +01:00
strparser	…
sunrpc	NFSD bug fixes for 5.18-rc:	2022-04-12 14:23:19 -10:00
switchdev	…
tipc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
tls	net/tls: fix slab-out-of-bounds bug in decrypt_internal	2022-04-01 11:53:35 +01:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
vmw_vsock	vsock/virtio: enable VQs early on probe	2022-03-24 18:36:36 -07:00
wireless	cfg80211: hold bss_lock while updating nontrans_list	2022-04-11 11:55:36 +02:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-03-26 11:48:16 -07:00
xdp	xsk: Do not write NULL in SW ring at allocation failure	2022-03-28 19:56:28 -07:00
xfrm	xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup	2022-04-04 13:32:56 +02:00
Kconfig	…
Kconfig.debug	…
Makefile	…
compat.c	…
devres.c	…
socket.c	fs: allocate inode by using alloc_inode_sb()	2022-03-22 15:57:03 -07:00
sysctl_net.c	…