Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp3332936imu; Sun, 11 Nov 2018 12:34:38 -0800 (PST) X-Google-Smtp-Source: AJdET5eQl0lOy5exL4DYGmDgF6/EtyqvavM7nKu3mzDonfkKOwCwzZWoRNmgiu6XGJaylK1CfFGL X-Received: by 2002:a63:2586:: with SMTP id l128mr15366518pgl.104.1541968478852; Sun, 11 Nov 2018 12:34:38 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1541968478; cv=none; d=google.com; s=arc-20160816; b=NPsHzI/ObKOju8uQ5s7/eObov/IpPbiQQwhK3wpZ7+m+llFn/BIOPQ5Cfz7tFcdlCt JL0WIxcsW5bguLOP8dIPWEmHrIc55b80IFvLrfzMagAbBZPchsMPQxzjlrJQc40wSVrc tOKJ91OA10GhBj1UQ3dnmQJPhYomO2WEAFbkPAhf5YBzyhqwgmCrCXP7bzq3HDNaYyd2 /EIq996TR1OMc/eHYjrwJozJxivvF4XK4Um6793sbUYZJiE0vT8RtztUCQN1JTQ3Z9+i s/ZuvHxv0OzstB0n1+hPrWnM6BHlfSEqQJEtjJ6Q+U62Ndo5Dv9JZimAYRuus4aO++ZN 6E+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition; bh=H0Z9Uft3KBJHXJnOXMVoELwm1vfOgaiUDIml2PuicAw=; b=Z+xjnSf1QCrAyDkH26TowUoS/9rLGoe20Z9+Lz7fLcwcaEpo6bmXJaJ/LXcNkSk95+ AdHbtWlSJcbRE3FYbsCF2BmF+2a96PY7z4ji629MUTXLWMsZPr/1bcQ9nNcPA1WFKtEM af7LwVOAWbDJ+h+Vo8zgBkjQ3JwOAkkPJZ4Ry1G2e4Egmj2kJu3lwQVPi56ij2Dmq69d ZavlDkR6DXUw6OQip3J6mWp81ALCgAzz6rYpYM/HhJLMRfV60Kk+Qj7MrROExvbZCqXa WQt9w9lJ9GdOnkH2H/cM+0oo1I2Ozc5wreVQH31riPmbXn5C1NqI7+vh5bfiSiW1eTeh umOA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id x12-v6si15374298pfn.111.2018.11.11.12.34.23; Sun, 11 Nov 2018 12:34:38 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730598AbeKLGWY (ORCPT + 99 others); Mon, 12 Nov 2018 01:22:24 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:50172 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730277AbeKLFsQ (ORCPT ); Mon, 12 Nov 2018 00:48:16 -0500 Received: from [192.168.4.242] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1gLvsc-0000oP-9t; Sun, 11 Nov 2018 19:58:46 +0000 Received: from ben by deadeye with local (Exim 4.91) (envelope-from ) id 1gLvsZ-0001pC-5V; Sun, 11 Nov 2018 19:58:43 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "syzbot" , "Willem de Bruijn" , "David S. Miller" Date: Sun, 11 Nov 2018 19:49:05 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 312/366] packet: refine ring v3 block size test to hold one frame In-Reply-To: X-SA-Exim-Connect-IP: 192.168.4.242 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.61-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Willem de Bruijn commit 4576cd469d980317c4edd9173f8b694aa71ea3a3 upstream. TPACKET_V3 stores variable length frames in fixed length blocks. Blocks must be able to store a block header, optional private space and at least one minimum sized frame. Frames, even for a zero snaplen packet, store metadata headers and optional reserved space. In the block size bounds check, ensure that the frame of the chosen configuration fits. This includes sockaddr_ll and optional tp_reserve. Syzbot was able to construct a ring with insuffient room for the sockaddr_ll in the header of a zero-length frame, triggering an out-of-bounds write in dev_parse_header. Convert the comparison to less than, as zero is a valid snap len. This matches the test for minimum tp_frame_size immediately below. Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") Fixes: eb73190f4fbe ("net/packet: refine check for priv area size") Reported-by: syzbot Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings --- net/packet/af_packet.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3874,6 +3874,8 @@ static int packet_set_ring(struct sock * } if (req->tp_block_nr) { + unsigned int min_frame_size; + /* Sanity tests and some calculations */ err = -EBUSY; if (unlikely(rb->pg_vec)) @@ -3896,12 +3898,12 @@ static int packet_set_ring(struct sock * goto out; if (unlikely(req->tp_block_size & (PAGE_SIZE - 1))) goto out; + min_frame_size = po->tp_hdrlen + po->tp_reserve; if (po->tp_version >= TPACKET_V3 && - req->tp_block_size <= - BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr)) + req->tp_block_size < + BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size) goto out; - if (unlikely(req->tp_frame_size < po->tp_hdrlen + - po->tp_reserve)) + if (unlikely(req->tp_frame_size < min_frame_size)) goto out; if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) goto out;