From patchwork Fri Mar 27 07:57:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Pavel Machek X-Patchwork-Id: 11461955 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 985CE6CA for ; Fri, 27 Mar 2020 07:57:29 +0000 (UTC) Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 73DD720705 for ; Fri, 27 Mar 2020 07:57:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 73DD720705 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ucw.cz Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=cip-dev-bounces@lists.cip-project.org Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 1E2C8875AB; Fri, 27 Mar 2020 07:57:29 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZcnF7TC7_oyQ; Fri, 27 Mar 2020 07:57:27 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by fraxinus.osuosl.org (Postfix) with ESMTP id E6DB387484; Fri, 27 Mar 2020 07:57:27 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id CBC7EC0177; Fri, 27 Mar 2020 07:57:27 +0000 (UTC) X-Original-To: cip-dev@lists.cip-project.org Delivered-To: cip-dev@lists.linuxfoundation.org Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists.linuxfoundation.org (Postfix) with ESMTP id 99EB7C0177 for ; Fri, 27 Mar 2020 07:57:26 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 84A9388808 for ; Fri, 27 Mar 2020 07:57:26 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J+es8FUazchX for ; Fri, 27 Mar 2020 07:57:24 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from jabberwock.ucw.cz (jabberwock.ucw.cz [46.255.230.98]) by whitealder.osuosl.org (Postfix) with ESMTPS id 8739A88802 for ; Fri, 27 Mar 2020 07:57:24 +0000 (UTC) Received: by jabberwock.ucw.cz (Postfix, from userid 1017) id 163D41C0323; Fri, 27 Mar 2020 08:57:21 +0100 (CET) Date: Fri, 27 Mar 2020 08:57:20 +0100 From: Pavel Machek To: cip-dev@lists.cip-project.org, stable@kernel.org, eperezma@redhat.com, mst@redhat.com, davem@davemloft.net Message-ID: <20200327075720.GA32000@duo.ucw.cz> MIME-Version: 1.0 User-Agent: Mutt/1.10.1 (2018-07-13) Subject: [cip-dev] [PATCH 4.4] vhost: Check docket sk_family instead of call getname X-BeenThere: cip-dev@lists.cip-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: cip-dev-bounces@lists.cip-project.org Sender: "cip-dev" From: Eugenio Pérez Doing so, we save one call to get data we already have in the struct. Also, since there is no guarantee that getname use sockaddr_ll parameter beyond its size, we add a little bit of security here. It should do not do beyond MAX_ADDR_LEN, but syzbot found that ax25_getname writes more (72 bytes, the size of full_sockaddr_ax25, versus 20 + 32 bytes of sockaddr_ll + MAX_ADDR_LEN in syzbot repro). Fixes: 3a4d5c94e9593 ("vhost_net: a kernel-level virtio server") Reported-by: syzbot+f2a62d07a5198c819c7b@syzkaller.appspotmail.com Signed-off-by: Eugenio Pérez Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller Upstream: 42d84c8490f9f0931786f1623191fcab397c3d64 Signed-off-by: Pavel Machek --- drivers/vhost/net.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) --- Since it is a security problem, I backported the patch to 4.4. I compile tested it on cip test farm, but it was only built for single target, probably due to too big config. diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index 1459dc9fd701..5efac33c29dc 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -815,11 +815,7 @@ static int vhost_net_release(struct inode *inode, struct file *f) static struct socket *get_raw_socket(int fd) { - struct { - struct sockaddr_ll sa; - char buf[MAX_ADDR_LEN]; - } uaddr; - int uaddr_len = sizeof uaddr, r; + int r; struct socket *sock = sockfd_lookup(fd, &r); if (!sock) @@ -831,12 +827,7 @@ static struct socket *get_raw_socket(int fd) goto err; } - r = sock->ops->getname(sock, (struct sockaddr *)&uaddr.sa, - &uaddr_len, 0); - if (r) - goto err; - - if (uaddr.sa.sll_family != AF_PACKET) { + if (sock->sk->sk_family != AF_PACKET) { r = -EPFNOSUPPORT; goto err; }