Skip to content
  • Eric Dumazet's avatar
    net/smc: fix leak of kernel memory to user space · 457fed77
    Eric Dumazet authored
    As nlmsg_put() does not clear the memory that is reserved,
    it this the caller responsability to make sure all of this
    memory will be written, in order to not reveal prior content.
    
    While we are at it, we can provide the socket cookie even
    if clsock is not set.
    
    syzbot reported :
    
    BUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
    BUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:59 [inline]
    BUG: KMSAN: uninit-value in __swab32p include/uapi/linux/swab.h:179 [inline]
    BUG: KMSAN: uninit-value in __be32_to_cpup include/uapi/linux/byteorder/little_endian.h:82 [inline]
    BUG: KMSAN: uninit-value in get_unaligned_be32 include/linux/unaligned/access_ok.h:30 [inline]
    BUG: KMSAN: uninit-value in ____bpf_skb_load_helper_32 net/core/filter.c:240 [inline]
    BUG: KMSAN: uninit-value in ____bpf_skb_load_helper_32_no_cache net/core/filter.c:255 [inline]
    BUG: KMSAN: uninit-value in bpf_skb_load_helper_32_no_cache+0x14a/0x390 net/core/filter.c:252
    CPU: 1 PID: 5262 Comm: syz-executor.5 Not tainted 5.5.0-rc5-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0x1c9/0x220 lib/dump_stack.c:118
     kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
     __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
     __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
     __fswab32 include/uapi/linux/swab.h:59 [inline]
     __swab32p include/uapi/linux/swab.h:179 [inline]
     __be32_to_cpup include/uapi/linux/byteorder/little_endian.h:82 [inline]
     get_unaligned_be32 include/linux/unaligned/access_ok.h:30 [inline]
     ____bpf_skb_load_helper_32 net/core/filter.c:240 [inline]
     ____bpf_skb_load_helper_32_no_cache net/core/filter.c:255 [inline]
     bpf_skb_load_helper_32_no_cache+0x14a/0x390 net/core/filter.c:252
    
    Uninit was created at:
     kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
     kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
     kmsan_kmalloc_large+0x73/0xc0 mm/kmsan/kmsan_hooks.c:128
     kmalloc_large_node_hook mm/slub.c:1406 [inline]
     kmalloc_large_node+0x282/0x2c0 mm/slub.c:3841
     __kmalloc_node_track_caller+0x44b/0x1200 mm/slub.c:4368
     __kmalloc_reserve net/core/skbuff.c:141 [inline]
     __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:209
     alloc_skb include/linux/skbuff.h:1049 [inline]
     netlink_dump+0x44b/0x1ab0 net/netlink/af_netlink.c:2224
     __netlink_dump_start+0xbb2/0xcf0 net/netlink/af_netlink.c:2352
     netlink_dump_start include/linux/netlink.h:233 [inline]
     smc_diag_handler_dump+0x2ba/0x300 net/smc/smc_diag.c:242
     sock_diag_rcv_msg+0x211/0x610 net/core/sock_diag.c:256
     netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2477
     sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:275
     netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
     netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1328
     netlink_sendmsg+0x1248/0x14d0 net/netlink/af_netlink.c:1917
     sock_sendmsg_nosec net/socket.c:639 [inline]
     sock_sendmsg net/socket.c:659 [inline]
     kernel_sendmsg+0x433/0x440 net/socket.c:679
     sock_no_sendpage+0x235/0x300 net/core/sock.c:2740
     kernel_sendpage net/socket.c:3776 [inline]
     sock_sendpage+0x1e1/0x2c0 net/socket.c:937
     pipe_to_sendpage+0x38c/0x4c0 fs/splice.c:458
     splice_from_pipe_feed fs/splice.c:512 [inline]
     __splice_from_pipe+0x539/0xed0 fs/splice.c:636
     splice_from_pipe fs/splice.c:671 [inline]
     generic_splice_sendpage+0x1d5/0x2d0 fs/splice.c:844
     do_splice_from fs/splice.c:863 [inline]
     do_splice fs/splice.c:1170 [inline]
     __do_sys_splice fs/splice.c:1447 [inline]
     __se_sys_splice+0x2380/0x3350 fs/splice.c:1427
     __x64_sys_splice+0x6e/0x90 fs/splice.c:1427
     do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: f16a7dd5
    
     ("smc: netlink interface for SMC sockets")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Cc: Ursula Braun <ubraun@linux.vnet.ibm.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    457fed77