| Message ID | 20240801130833.680962-1-dmantipov@yandex.ru (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: kcm: use previously opened message only once | expand |
On Thu, 1 Aug 2024 16:08:33 +0300 Dmitry Antipov wrote: > When syzkaller reproducer injects 'alloc_skb()' failure at line > 817, 'kcm_sendmsg()' may return with partial message saved at > 'kcm->seq_skb'. Next call of this function will try to build the > next message starting from the saved one, but should do it only > once. Otherwise a complete mess in skb management causes an > undefined behavior of any kind, including UAFs reported by KASAN. > > Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") > Reported-by: syzbot+b72d86aa5df17ce74c60@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=b72d86aa5df17ce74c60 > Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> > --- > net/kcm/kcmsock.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c > index 2f191e50d4fc..fa5ce5c88045 100644 > --- a/net/kcm/kcmsock.c > +++ b/net/kcm/kcmsock.c > @@ -766,6 +766,8 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) > if (kcm->seq_skb) { > /* Previously opened message */ > head = kcm->seq_skb; > + /* ...should be used only once */ > + kcm->seq_skb = NULL; > skb = kcm_tx_msg(head)->last_skb; > goto start; > } Not sure how much this matters but if we clear seq_skb then handling here: https://elixir.bootlin.com/linux/v6.10-rc4/source/net/kcm/kcmsock.c#L940 will work differently.
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index 2f191e50d4fc..fa5ce5c88045 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -766,6 +766,8 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) if (kcm->seq_skb) { /* Previously opened message */ head = kcm->seq_skb; + /* ...should be used only once */ + kcm->seq_skb = NULL; skb = kcm_tx_msg(head)->last_skb; goto start; }
When syzkaller reproducer injects 'alloc_skb()' failure at line 817, 'kcm_sendmsg()' may return with partial message saved at 'kcm->seq_skb'. Next call of this function will try to build the next message starting from the saved one, but should do it only once. Otherwise a complete mess in skb management causes an undefined behavior of any kind, including UAFs reported by KASAN. Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Reported-by: syzbot+b72d86aa5df17ce74c60@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b72d86aa5df17ce74c60 Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> --- net/kcm/kcmsock.c | 2 ++ 1 file changed, 2 insertions(+)