Received: by 2002:a05:6a10:c604:0:0:0:0 with SMTP id y4csp3767771pxt; Tue, 10 Aug 2021 10:51:48 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxJgW2gloXLc+9AAuUoonHJN8rHU1WwRZ4D2f1i6vaZ4pZfIt2fNoPXN/3311paDOUIndk6 X-Received: by 2002:a17:907:3d93:: with SMTP id he19mr14952661ejc.179.1628617908171; Tue, 10 Aug 2021 10:51:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1628617908; cv=none; d=google.com; s=arc-20160816; b=aAVzaP6elWnQbZs8boXpDVXLEty9iFyiTf3tkFTbWq+nsB50T3zYKfYvzMU9F1eUsR +5NRCeXnTOJoHnQBi6vJP1UfefIKjsH8ROI7r79d+Fgguyb9sEX6DxQaOgsWBX3et8uS cxHn64/XZ4KWTD8Tsur0UQflvJfsrXrBwMxdvIE8SGGHzrMgm8U+70I/CuX5QFhvgahd VX9Pt1XfzpHVbzCv26Gk2JpakIzMJ1MQkhCjzD1SZT49gG7xUc2S4Pn9UBtkgErONz0X TQCDgGFXt+iVyaLFUCclR7iHguTQgwBVbjEXwON6t1JrLJhQM9cXppCwesy3sxzMiB7o ChSg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=F7qw1lNviBRkO880lHUebnUPHo3p/xfhodxcpLG1QOc=; b=Acjwx8LK9x4sxS0vCacBId8C3+gkbcPWkvO1CntpPfdIMLywMlVFczrc+cSVS5ZHzc CLdpVLoaVzNs7znK/HZpMpYl7gSSCwW2u25DuFq9gfAMIoYba3cySgAJPxIXpV59rGMY 080NMNeZcQBu57DCsZkjNGfyUnnsl9xAwk3R1vvpwarGZeG13FEs14BxHAcT494GHj5j Y+bhF89xuNVdd2xtI0R5i75yzemkY3LG8AFTK0M/NZflRW5x8ov7/izc5e/BQcgyVkHy 9SuyWd+9Z++c1ZBK+GM0MJ6rreDG1or0Ah7mSE74EUwWBQ0wJhhljU1lDvcIG2Xc56a1 TLGQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=fAEnQP85; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id y15si6598535edu.593.2021.08.10.10.51.24; Tue, 10 Aug 2021 10:51:48 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=fAEnQP85; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236554AbhHJRta (ORCPT + 99 others); Tue, 10 Aug 2021 13:49:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:51520 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235693AbhHJRq2 (ORCPT ); Tue, 10 Aug 2021 13:46:28 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 97B5261167; Tue, 10 Aug 2021 17:40:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1628617234; bh=pkLd3vYHaCyyw7w8YG3IbB20GwhjgQULNI4nMHqedAw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fAEnQP85NaTWkNdwf1HLckxLsl9bw32FmRyFUCshbhXp9PadVYVllMrV2L8iF5vIx Fw4qIZTQygpfIG3HDdh4PcBOI4shNgnGyTReAwMzpy//dmhHAsQapoZ44VHlGls1oP m5zKaj7ueof1/FbOV1SH7UgTXMZtcABoL3DJYNk4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, YueHaibing , Dmitry Safonov , Steffen Klassert Subject: [PATCH 5.10 103/135] net/xfrm/compat: Copy xfrm_spdattr_type_t atributes Date: Tue, 10 Aug 2021 19:30:37 +0200 Message-Id: <20210810172959.261392093@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210810172955.660225700@linuxfoundation.org> References: <20210810172955.660225700@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dmitry Safonov commit 4e9505064f58d1252805952f8547a5b7dbc5c111 upstream. The attribute-translator has to take in mind maxtype, that is xfrm_link::nla_max. When it is set, attributes are not of xfrm_attr_type_t. Currently, they can be only XFRMA_SPD_MAX (message XFRM_MSG_NEWSPDINFO), their UABI is the same for 64/32-bit, so just copy them. Thanks to YueHaibing for reporting this: In xfrm_user_rcv_msg_compat() if maxtype is not zero and less than XFRMA_MAX, nlmsg_parse_deprecated() do not initialize attrs array fully. xfrm_xlate32() will access uninit 'attrs[i]' while iterating all attrs array. KASAN: probably user-memory-access in range [0x0000000041b58ab0-0x0000000041b58ab7] CPU: 0 PID: 15799 Comm: syz-executor.2 Tainted: G W 5.14.0-rc1-syzkaller #0 RIP: 0010:nla_type include/net/netlink.h:1130 [inline] RIP: 0010:xfrm_xlate32_attr net/xfrm/xfrm_compat.c:410 [inline] RIP: 0010:xfrm_xlate32 net/xfrm/xfrm_compat.c:532 [inline] RIP: 0010:xfrm_user_rcv_msg_compat+0x5e5/0x1070 net/xfrm/xfrm_compat.c:577 [...] Call Trace: xfrm_user_rcv_msg+0x556/0x8b0 net/xfrm/xfrm_user.c:2774 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 xfrm_netlink_rcv+0x6b/0x90 net/xfrm/xfrm_user.c:2824 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:702 [inline] Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator") Cc: Reported-by: YueHaibing Signed-off-by: Dmitry Safonov Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/xfrm/xfrm_compat.c | 49 ++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 5 deletions(-) --- a/net/xfrm/xfrm_compat.c +++ b/net/xfrm/xfrm_compat.c @@ -298,8 +298,16 @@ static int xfrm_xlate64(struct sk_buff * len = nlmsg_attrlen(nlh_src, xfrm_msg_min[type]); nla_for_each_attr(nla, attrs, len, remaining) { - int err = xfrm_xlate64_attr(dst, nla); + int err; + switch (type) { + case XFRM_MSG_NEWSPDINFO: + err = xfrm_nla_cpy(dst, nla, nla_len(nla)); + break; + default: + err = xfrm_xlate64_attr(dst, nla); + break; + } if (err) return err; } @@ -341,7 +349,8 @@ static int xfrm_alloc_compat(struct sk_b /* Calculates len of translated 64-bit message. */ static size_t xfrm_user_rcv_calculate_len64(const struct nlmsghdr *src, - struct nlattr *attrs[XFRMA_MAX+1]) + struct nlattr *attrs[XFRMA_MAX + 1], + int maxtype) { size_t len = nlmsg_len(src); @@ -358,10 +367,20 @@ static size_t xfrm_user_rcv_calculate_le case XFRM_MSG_POLEXPIRE: len += 8; break; + case XFRM_MSG_NEWSPDINFO: + /* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */ + return len; default: break; } + /* Unexpected for anything, but XFRM_MSG_NEWSPDINFO, please + * correct both 64=>32-bit and 32=>64-bit translators to copy + * new attributes. + */ + if (WARN_ON_ONCE(maxtype)) + return len; + if (attrs[XFRMA_SA]) len += 4; if (attrs[XFRMA_POLICY]) @@ -440,7 +459,8 @@ static int xfrm_xlate32_attr(void *dst, static int xfrm_xlate32(struct nlmsghdr *dst, const struct nlmsghdr *src, struct nlattr *attrs[XFRMA_MAX+1], - size_t size, u8 type, struct netlink_ext_ack *extack) + size_t size, u8 type, int maxtype, + struct netlink_ext_ack *extack) { size_t pos; int i; @@ -520,6 +540,25 @@ static int xfrm_xlate32(struct nlmsghdr } pos = dst->nlmsg_len; + if (maxtype) { + /* attirbutes are xfrm_spdattr_type_t, not xfrm_attr_type_t */ + WARN_ON_ONCE(src->nlmsg_type != XFRM_MSG_NEWSPDINFO); + + for (i = 1; i <= maxtype; i++) { + int err; + + if (!attrs[i]) + continue; + + /* just copy - no need for translation */ + err = xfrm_attr_cpy32(dst, &pos, attrs[i], size, + nla_len(attrs[i]), nla_len(attrs[i])); + if (err) + return err; + } + return 0; + } + for (i = 1; i < XFRMA_MAX + 1; i++) { int err; @@ -564,7 +603,7 @@ static struct nlmsghdr *xfrm_user_rcv_ms if (err < 0) return ERR_PTR(err); - len = xfrm_user_rcv_calculate_len64(h32, attrs); + len = xfrm_user_rcv_calculate_len64(h32, attrs, maxtype); /* The message doesn't need translation */ if (len == nlmsg_len(h32)) return NULL; @@ -574,7 +613,7 @@ static struct nlmsghdr *xfrm_user_rcv_ms if (!h64) return ERR_PTR(-ENOMEM); - err = xfrm_xlate32(h64, h32, attrs, len, type, extack); + err = xfrm_xlate32(h64, h32, attrs, len, type, maxtype, extack); if (err < 0) { kvfree(h64); return ERR_PTR(err);