| Message ID | 20240404202738.3634547-1-edumazet@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 237f3cf13b20db183d3706d997eedc3c49eacd44 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING | expand |
On 4/4/24 10:27 PM, Eric Dumazet wrote: > syzbot reported an illegal copy in xsk_setsockopt() [1] > > Make sure to validate setsockopt() @optlen parameter. > [...] > > Fixes: 423f38329d26 ("xsk: add umem fill queue support and mmap") > Reported-by: syzbot <syzkaller@googlegroups.com> > Signed-off-by: Eric Dumazet <edumazet@google.com> > Cc: "Björn Töpel" <bjorn@kernel.org> > Cc: Magnus Karlsson <magnus.karlsson@intel.com> > Cc: Maciej Fijalkowski <maciej.fijalkowski@intel.com> > Cc: Jonathan Lemon <jonathan.lemon@gmail.com> > Cc: bpf@vger.kernel.org Given bpf tree PR went out, Jakub, feel free to take directly : Acked-by: Daniel Borkmann <daniel@iogearbox.net> Thanks Eric !
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Thu, 4 Apr 2024 20:27:38 +0000 you wrote: > syzbot reported an illegal copy in xsk_setsockopt() [1] > > Make sure to validate setsockopt() @optlen parameter. > > [1] > > BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] > BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] > BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 > Read of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549 > > [...] Here is the summary with links: - [net] xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING https://git.kernel.org/netdev/net/c/237f3cf13b20 You are awesome, thank you!
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 3404d076a8a3e6a9f43dfca301d3e00078afb934..727aa20be4bde8dc63a544a44a5cdeb19cac7dcb 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -1417,6 +1417,8 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname, struct xsk_queue **q; int entries; + if (optlen < sizeof(entries)) + return -EINVAL; if (copy_from_sockptr(&entries, optval, sizeof(entries))) return -EFAULT;