| Message ID | da8bd5e9-0476-d75b-4669-0a21637663b2@linux.alibaba.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: prevent user from passing illegal stab size | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Guessed tree name to be net-next |
| netdev/subject_prefix | warning | Target tree name not specified in the subject |
| netdev/cc_maintainers | success | CCed 6 of 6 maintainers |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 4864 this patch: 4864 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | warning | WARNING: From:/Signed-off-by: email name mismatch: 'From: "王贇" <yun.wang@linux.alibaba.com>' != 'Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com>' |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 4956 this patch: 4956 |
| netdev/header_inline | success | Link |
On Thu, 23 Sep 2021 17:08:13 +0800 王贇 wrote: > We observed below report when playing with netlink sock: > > UBSAN: shift-out-of-bounds in net/sched/sch_api.c:580:10 > shift exponent 249 is too large for 32-bit type > CPU: 0 PID: 685 Comm: a.out Not tainted > Call Trace: > dump_stack_lvl+0x8d/0xcf > ubsan_epilogue+0xa/0x4e > __ubsan_handle_shift_out_of_bounds+0x161/0x182 > __qdisc_calculate_pkt_len+0xf0/0x190 > __dev_queue_xmit+0x2ed/0x15b0 > > it seems like kernel won't check the stab size_log passing from > user, and will use the insane value later to calculate pkt_len. > > This patch just add a check on the size_log to avoid insane > calculation. > > Reported-by: Abaci <abaci@linux.alibaba.com> > Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com> > --- > include/uapi/linux/pkt_sched.h | 1 + > net/sched/sch_api.c | 3 +++ > 2 files changed, 4 insertions(+) > > diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h > index ec88590..fa194a0 100644 > --- a/include/uapi/linux/pkt_sched.h > +++ b/include/uapi/linux/pkt_sched.h > @@ -98,6 +98,7 @@ struct tc_ratespec { > }; > > #define TC_RTAB_SIZE 1024 > +#define TC_LOG_MAX 30 Adding a uAPI define is not necessary. > struct tc_sizespec { > unsigned char cell_log; > diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c > index 5e90e9b..1b6b8f8 100644 > --- a/net/sched/sch_api.c > +++ b/net/sched/sch_api.c > @@ -513,6 +513,9 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt, > return stab; > } > > + if (s->size_log > TC_LOG_MAX) > + return ERR_PTR(-EINVAL); Looks sane, please add an extack message. Why not cover cell_log as well while at it? > stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL); > if (!stab) > return ERR_PTR(-ENOMEM);
On 2021/9/24 上午12:00, Jakub Kicinski wrote: > On Thu, 23 Sep 2021 17:08:13 +0800 王贇 wrote: >> We observed below report when playing with netlink sock: >> >> UBSAN: shift-out-of-bounds in net/sched/sch_api.c:580:10 >> shift exponent 249 is too large for 32-bit type >> CPU: 0 PID: 685 Comm: a.out Not tainted >> Call Trace: >> dump_stack_lvl+0x8d/0xcf >> ubsan_epilogue+0xa/0x4e >> __ubsan_handle_shift_out_of_bounds+0x161/0x182 >> __qdisc_calculate_pkt_len+0xf0/0x190 >> __dev_queue_xmit+0x2ed/0x15b0 >> >> it seems like kernel won't check the stab size_log passing from >> user, and will use the insane value later to calculate pkt_len. >> >> This patch just add a check on the size_log to avoid insane >> calculation. >> >> Reported-by: Abaci <abaci@linux.alibaba.com> >> Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com> >> --- >> include/uapi/linux/pkt_sched.h | 1 + >> net/sched/sch_api.c | 3 +++ >> 2 files changed, 4 insertions(+) >> >> diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h >> index ec88590..fa194a0 100644 >> --- a/include/uapi/linux/pkt_sched.h >> +++ b/include/uapi/linux/pkt_sched.h >> @@ -98,6 +98,7 @@ struct tc_ratespec { >> }; >> >> #define TC_RTAB_SIZE 1024 >> +#define TC_LOG_MAX 30 > > Adding a uAPI define is not necessary. Yes, I'll move this to somewhere else. > >> struct tc_sizespec { >> unsigned char cell_log; >> diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c >> index 5e90e9b..1b6b8f8 100644 >> --- a/net/sched/sch_api.c >> +++ b/net/sched/sch_api.c >> @@ -513,6 +513,9 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt, >> return stab; >> } >> >> + if (s->size_log > TC_LOG_MAX) >> + return ERR_PTR(-EINVAL); > > Looks sane, please add an extack message. > > Why not cover cell_log as well while at it? You're right, will add message and check this one too in v2 :-) Regards, Michael Wang > >> stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL); >> if (!stab) >> return ERR_PTR(-ENOMEM);
diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h index ec88590..fa194a0 100644 --- a/include/uapi/linux/pkt_sched.h +++ b/include/uapi/linux/pkt_sched.h @@ -98,6 +98,7 @@ struct tc_ratespec { }; #define TC_RTAB_SIZE 1024 +#define TC_LOG_MAX 30 struct tc_sizespec { unsigned char cell_log; diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 5e90e9b..1b6b8f8 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -513,6 +513,9 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt, return stab; } + if (s->size_log > TC_LOG_MAX) + return ERR_PTR(-EINVAL); + stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL); if (!stab) return ERR_PTR(-ENOMEM);
We observed below report when playing with netlink sock: UBSAN: shift-out-of-bounds in net/sched/sch_api.c:580:10 shift exponent 249 is too large for 32-bit type CPU: 0 PID: 685 Comm: a.out Not tainted Call Trace: dump_stack_lvl+0x8d/0xcf ubsan_epilogue+0xa/0x4e __ubsan_handle_shift_out_of_bounds+0x161/0x182 __qdisc_calculate_pkt_len+0xf0/0x190 __dev_queue_xmit+0x2ed/0x15b0 it seems like kernel won't check the stab size_log passing from user, and will use the insane value later to calculate pkt_len. This patch just add a check on the size_log to avoid insane calculation. Reported-by: Abaci <abaci@linux.alibaba.com> Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com> --- include/uapi/linux/pkt_sched.h | 1 + net/sched/sch_api.c | 3 +++ 2 files changed, 4 insertions(+)