Received: by 2002:a05:6358:4e97:b0:b3:742d:4702 with SMTP id ce23csp3079594rwb; Mon, 15 Aug 2022 17:37:20 -0700 (PDT) X-Google-Smtp-Source: AA6agR4crs6xRhieWMKos5dr7IuEB0TBd/+Ws2IlM/pv8FkaL9nN8Z3ZViL8zeKu+2xCq0VI5eIf X-Received: by 2002:a17:907:dab:b0:731:58aa:77c9 with SMTP id go43-20020a1709070dab00b0073158aa77c9mr11805881ejc.743.1660610240304; Mon, 15 Aug 2022 17:37:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1660610240; cv=none; d=google.com; s=arc-20160816; b=nc+0n5jf/EnIHsV3mJ7nCd7Ma4taTeBg9CFZxzzMvMnJwN/8ZjOWMQRyAzmbm+7RzK HbB2ZdyzsXNOluDnfWE5ALOaMcHCaW6qP5y2UBdZrdSeIcSZF5j/6PMgwJ6cjF4pVyMx H/1YcViJk3BO5m14KUy1KOaxmXzshuQIedkCLr82txsjZiQjuvmiuGsDGEl2XPRBfKI2 PRuCUCmgP8FC4uKw7Pc9izLfqCk3eQc/1YfoU4xxSJlitPN1mZ/34YKpOVRver5tVwZE QlmHqgP4FzOBBXq6tr61MTbSLXjxMs9exqQyvpKijDNerVo82XszudYTLML3Ejp3RHKk XkSQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=St1oW5Ldj44TJQYAtbd4KfAoYRqU2f/zlOWrPGn5RLI=; b=DxqDeskvF9vva/20+Ht3Ymr5I91kx6/j45bkRPPHTEPYVNGxpp24djWSCwS9+tYRyN jRebSYt5lYljB6Xdv/2lWbGOH3vE9b9yt6Ne3hAiQyfbgW/lCksNFzVqjI5xnJoLXwdw TqQn5AEPuFgMMpKDV6h4ZvJf0FxSsxeqVc707Xbnyr1apd2jY2pej1anx//WXrZBnd+S NUac98AJHHqvw+jk0wacI3UjKGwavEn81NG6RZ0O2IgtkHoTcfVd6TS5jN9icbR7y5jr 159Gt2aDaKC0IbX1U+QlSbNonN+jvQfA3C9EilS1JBydvGfV1g+It3g+m6tJjL1ve9p2 xL1Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=A1CWwJ0q; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id l22-20020a170906795600b0072b4addd854si8726523ejo.292.2022.08.15.17.36.54; Mon, 15 Aug 2022 17:37:20 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=A1CWwJ0q; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348350AbiHOVc7 (ORCPT + 99 others); Mon, 15 Aug 2022 17:32:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347203AbiHOV27 (ORCPT ); Mon, 15 Aug 2022 17:28:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62DF1EE4A5; Mon, 15 Aug 2022 12:23:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3C578B80FD3; Mon, 15 Aug 2022 19:23:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8B6F7C433C1; Mon, 15 Aug 2022 19:23:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660591433; bh=u0HsNN8rMYruFAvZHEvP0r2fe53rUhzO3lCv1NuR+A8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=A1CWwJ0qGH3RFEiOyJyikecZyGVGeSDyYzwdsq0pqUaX/0CtlbJzaICvXrBlFqldm Qbzpsx5ajM1RY+EfFdMBfThkXtfCu5hjxhPSjDEpvSwmV4N9rll5LV+lEAA+j4S1dD xsPWSwIOR2+nvXx68UedPqp8qTRcaRdYDC4dUAKI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , "Jason A. Donenfeld" , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.18 0539/1095] wireguard: allowedips: dont corrupt stack when detecting overflow Date: Mon, 15 Aug 2022 19:58:58 +0200 Message-Id: <20220815180451.840742115@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180429.240518113@linuxfoundation.org> References: <20220815180429.240518113@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jason A. Donenfeld [ Upstream commit c31b14d86dfe7174361e8c6e5df6c2c3a4d5918c ] In case push_rcu() and related functions are buggy, there's a WARN_ON(len >= 128), which the selftest tries to hit by being tricky. In case it is hit, we shouldn't corrupt the kernel's stack, though; otherwise it may be hard to even receive the report that it's buggy. So conditionalize the stack write based on that WARN_ON()'s return value. Note that this never *actually* happens anyway. The WARN_ON() in the first place is bounded by IS_ENABLED(DEBUG), and isn't expected to ever actually hit. This is just a debugging sanity check. Additionally, hoist the constant 128 into a named enum, MAX_ALLOWEDIPS_BITS, so that it's clear why this value is chosen. Suggested-by: Linus Torvalds Link: https://lore.kernel.org/all/CAHk-=wjJZGA6w_DxA+k7Ejbqsq+uGK==koPai3sqdsfJqemvag@mail.gmail.com/ Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/wireguard/allowedips.c | 9 ++++++--- drivers/net/wireguard/selftest/allowedips.c | 6 +++--- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireguard/allowedips.c b/drivers/net/wireguard/allowedips.c index 9a4c8ff32d9d..5bf7822c53f1 100644 --- a/drivers/net/wireguard/allowedips.c +++ b/drivers/net/wireguard/allowedips.c @@ -6,6 +6,8 @@ #include "allowedips.h" #include "peer.h" +enum { MAX_ALLOWEDIPS_BITS = 128 }; + static struct kmem_cache *node_cache; static void swap_endian(u8 *dst, const u8 *src, u8 bits) @@ -40,7 +42,8 @@ static void push_rcu(struct allowedips_node **stack, struct allowedips_node __rcu *p, unsigned int *len) { if (rcu_access_pointer(p)) { - WARN_ON(IS_ENABLED(DEBUG) && *len >= 128); + if (WARN_ON(IS_ENABLED(DEBUG) && *len >= MAX_ALLOWEDIPS_BITS)) + return; stack[(*len)++] = rcu_dereference_raw(p); } } @@ -52,7 +55,7 @@ static void node_free_rcu(struct rcu_head *rcu) static void root_free_rcu(struct rcu_head *rcu) { - struct allowedips_node *node, *stack[128] = { + struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS] = { container_of(rcu, struct allowedips_node, rcu) }; unsigned int len = 1; @@ -65,7 +68,7 @@ static void root_free_rcu(struct rcu_head *rcu) static void root_remove_peer_lists(struct allowedips_node *root) { - struct allowedips_node *node, *stack[128] = { root }; + struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS] = { root }; unsigned int len = 1; while (len > 0 && (node = stack[--len])) { diff --git a/drivers/net/wireguard/selftest/allowedips.c b/drivers/net/wireguard/selftest/allowedips.c index e173204ae7d7..41db10f9be49 100644 --- a/drivers/net/wireguard/selftest/allowedips.c +++ b/drivers/net/wireguard/selftest/allowedips.c @@ -593,10 +593,10 @@ bool __init wg_allowedips_selftest(void) wg_allowedips_remove_by_peer(&t, a, &mutex); test_negative(4, a, 192, 168, 0, 1); - /* These will hit the WARN_ON(len >= 128) in free_node if something - * goes wrong. + /* These will hit the WARN_ON(len >= MAX_ALLOWEDIPS_BITS) in free_node + * if something goes wrong. */ - for (i = 0; i < 128; ++i) { + for (i = 0; i < MAX_ALLOWEDIPS_BITS; ++i) { part = cpu_to_be64(~(1LLU << (i % 64))); memset(&ip, 0xff, 16); memcpy((u8 *)&ip + (i < 64) * 8, &part, 8); -- 2.35.1