Eric Dumazet c99c91fa17 netlink: reset network and mac headers in netlink_dump() ... [ Upstream commit 99c07327ae11e24886d552dddbe4537bfca2765d ] netlink_dump() is allocating an skb, reserves space in it but forgets to reset network header. This allows a BPF program, invoked later from sk_filter() to access uninitialized kernel memory from the reserved space. Theorically mac header reset could be omitted, because it is set to a special initial value. bpf_internal_load_pointer_neg_helper calls skb_mac_header() without checking skb_mac_header_was_set(). Relying on skb->len not being too big seems fragile. We also could add a sanity check in bpf_internal_load_pointer_neg_helper() to avoid surprises in the future. syzbot report was: BUG: KMSAN: uninit-value in ___bpf_prog_run+0xa22b/0xb420 kernel/bpf/core.c:1637 ___bpf_prog_run+0xa22b/0xb420 kernel/bpf/core.c:1637 __bpf_prog_run32+0x121/0x180 kernel/bpf/core.c:1796 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline] __bpf_prog_run include/linux/filter.h:626 [inline] bpf_prog_run include/linux/filter.h:633 [inline] __bpf_prog_run_save_cb+0x168/0x580 include/linux/filter.h:756 bpf_prog_run_save_cb include/linux/filter.h:770 [inline] sk_filter_trim_cap+0x3bc/0x8c0 net/core/filter.c:150 sk_filter include/linux/filter.h:905 [inline] netlink_dump+0xe0c/0x16c0 net/netlink/af_netlink.c:2276 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_read_iter+0x5a9/0x630 net/socket.c:1039 do_iter_readv_writev+0xa7f/0xc70 do_iter_read+0x52c/0x14c0 fs/read_write.c:786 vfs_readv fs/read_write.c:906 [inline] do_readv+0x432/0x800 fs/read_write.c:943 __do_sys_readv fs/read_write.c:1034 [inline] __se_sys_readv fs/read_write.c:1031 [inline] __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was stored to memory at: ___bpf_prog_run+0x96c/0xb420 kernel/bpf/core.c:1558 __bpf_prog_run32+0x121/0x180 kernel/bpf/core.c:1796 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline] __bpf_prog_run include/linux/filter.h:626 [inline] bpf_prog_run include/linux/filter.h:633 [inline] __bpf_prog_run_save_cb+0x168/0x580 include/linux/filter.h:756 bpf_prog_run_save_cb include/linux/filter.h:770 [inline] sk_filter_trim_cap+0x3bc/0x8c0 net/core/filter.c:150 sk_filter include/linux/filter.h:905 [inline] netlink_dump+0xe0c/0x16c0 net/netlink/af_netlink.c:2276 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_read_iter+0x5a9/0x630 net/socket.c:1039 do_iter_readv_writev+0xa7f/0xc70 do_iter_read+0x52c/0x14c0 fs/read_write.c:786 vfs_readv fs/read_write.c:906 [inline] do_readv+0x432/0x800 fs/read_write.c:943 __do_sys_readv fs/read_write.c:1034 [inline] __se_sys_readv fs/read_write.c:1031 [inline] __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3244 [inline] __kmalloc_node_track_caller+0xde3/0x14f0 mm/slub.c:4972 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1158 [inline] netlink_dump+0x30f/0x16c0 net/netlink/af_netlink.c:2242 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_read_iter+0x5a9/0x630 net/socket.c:1039 do_iter_readv_writev+0xa7f/0xc70 do_iter_read+0x52c/0x14c0 fs/read_write.c:786 vfs_readv fs/read_write.c:906 [inline] do_readv+0x432/0x800 fs/read_write.c:943 __do_sys_readv fs/read_write.c:1034 [inline] __se_sys_readv fs/read_write.c:1031 [inline] __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x44/0xae CPU: 0 PID: 3470 Comm: syz-executor751 Not tainted 5.17.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: db65a3aaf2 ("netlink: Trim skb to alloc size to avoid MSG_TRUNC") Fixes: 9063e21fb0 ("netlink: autosize skb lengthes") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20220415181442.551228-1-eric.dumazet@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-04-27 13:39:43 +02:00
..
6lowpan
9p	xen/9p: use alloc/free_pages_exact()	2022-03-11 10:15:13 +01:00
802
8021q
appletalk
atm
ax25	ax25: Fix NULL pointer dereference in ax25_kill_by_device	2022-03-16 13:20:26 +01:00
batman-adv	batman-adv: Don't expect inter-netns unique iflink indices	2022-03-08 19:04:08 +01:00
bluetooth	Bluetooth: Fix use after free in hci_send_acl	2022-04-15 14:15:03 +02:00
bpf
bpfilter
bridge	net: bridge: fix stale eth hdr pointer in br_dev_xmit	2022-02-16 12:51:45 +01:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-22 11:48:11 +02:00
can	net: add missing SOF_TIMESTAMPING_OPT_ID support	2022-04-15 14:15:04 +02:00
ceph
core	net/sched: flower: fix parsing of ethertype following VLAN header	2022-04-20 09:12:48 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:04:10 +01:00
dccp	tcp: fix race condition when creating child sockets from syncookies	2022-04-27 13:39:42 +02:00
decnet
dns_resolver
dsa	net: dsa: Add missing of_node_put() in dsa_port_parse_of	2022-03-23 09:10:44 +01:00
ethernet
hsr
ieee802154	net: ieee802154: Return meaningful error codes from the netlink helpers	2022-02-08 18:23:16 +01:00
ife
ipv4	tcp: Fix potential use-after-free due to double kfree()	2022-04-27 13:39:42 +02:00
ipv6	tcp: fix race condition when creating child sockets from syncookies	2022-04-27 13:39:42 +02:00
iucv
kcm
key	xfrm: policy: match with both mark and mask on user interfaces	2022-04-15 14:15:07 +02:00
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 11:48:11 +02:00
l3mdev
lapb
llc	llc: only change llc->dev when bind() succeeds	2022-03-28 08:41:44 +02:00
mac80211	mac80211: fix potential double free on mesh join	2022-03-28 08:41:44 +02:00
mac802154
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 08:50:13 +01:00
ncsi
netfilter	netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options	2022-04-15 14:14:53 +02:00
netlabel	net: fix NULL pointer reference in cipso_v4_doi_free	2021-09-22 11:48:09 +02:00
netlink	netlink: reset network and mac headers in netlink_dump()	2022-04-27 13:39:43 +02:00
netrom
nfc	nfc: nci: add flush_workqueue to prevent uaf	2022-04-20 09:12:49 +02:00
nsh
openvswitch	net: openvswitch: don't send internal clone attribute to the userspace.	2022-04-15 14:15:05 +02:00
packet	net/packet: fix packet_sock xmit return value checking	2022-04-27 13:39:43 +02:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 13:58:50 +01:00
psample
qrtr
rds	rds: memory leak in __rds_conn_create()	2021-12-22 09:19:01 +01:00
rfkill
rose
rxrpc	rxrpc: Restore removed timer deletion	2022-04-27 13:39:42 +02:00
sched	net/sched: cls_u32: fix possible leak in u32_init_knode()	2022-04-27 13:39:43 +02:00
sctp	sctp: Initialize daddr on peeled off socket	2022-04-20 09:12:48 +02:00
smc	net/smc: correct settings of RMB window update limit	2022-04-15 14:15:02 +02:00
strparser
sunrpc	SUNRPC/call_alloc: async tasks mustn't block waiting for memory	2022-04-15 14:15:03 +02:00
switchdev
tipc	tipc: Fix end of loop tests for list_for_each_entry()	2022-03-02 11:38:11 +01:00
tls
unix	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress	2022-01-27 09:04:32 +01:00
vmw_vsock	vsock: remove vsock from connected table when connect is interrupted by a signal	2022-02-23 11:58:39 +01:00
wimax
wireless	nl80211: Update bss channel on channel switch for P2P_CLIENT	2022-03-23 09:10:41 +01:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-04-15 14:14:53 +02:00
xdp
xfrm	xfrm: policy: match with both mark and mask on user interfaces	2022-04-15 14:15:07 +02:00
compat.c
Kconfig
Makefile
socket.c
sysctl_net.c