Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/1839935/?format=api
{ "id": 1839935, "url": "http://patchwork.ozlabs.org/api/patches/1839935/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20230926200505.2804266-3-jrife@google.com/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20230926200505.2804266-3-jrife@google.com>", "list_archive_url": null, "date": "2023-09-26T20:05:04", "name": "[net,v6,2/3] net: prevent rewrite of msg_name and msg_namelen in sock_sendmsg()", "commit_ref": null, "pull_url": null, "state": "handled-elsewhere", "archived": false, "hash": "45677f42750c0cc16e998562290f5a3e1cd1608b", "submitter": { "id": 87261, "url": "http://patchwork.ozlabs.org/api/people/87261/?format=api", "name": "Jordan Rife", "email": "jrife@google.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20230926200505.2804266-3-jrife@google.com/mbox/", "series": [ { "id": 374999, "url": "http://patchwork.ozlabs.org/api/series/374999/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=374999", "date": "2023-09-26T20:05:02", "name": "Insulate Kernel Space From SOCK_ADDR Hooks", "version": 6, "mbox": "http://patchwork.ozlabs.org/series/374999/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/1839935/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/1839935/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<netfilter-devel-owner@vger.kernel.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256\n header.s=20230601 header.b=EFRwWR00;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2620:137:e000::1:20; helo=out1.vger.email;\n envelope-from=netfilter-devel-owner@vger.kernel.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20])\n\tby legolas.ozlabs.org (Postfix) with ESMTP id 4Rw9hc1sRfz1ypD\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 27 Sep 2023 06:05:20 +1000 (AEST)", "(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n id S235814AbjIZUFY (ORCPT <rfc822;incoming@patchwork.ozlabs.org>);\n Tue, 26 Sep 2023 16:05:24 -0400", "from lindbergh.monkeyblade.net ([23.128.96.19]:52234 \"EHLO\n lindbergh.monkeyblade.net\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n with ESMTP id S235818AbjIZUFX (ORCPT\n <rfc822;netfilter-devel@vger.kernel.org>);\n Tue, 26 Sep 2023 16:05:23 -0400", "from mail-io1-xd49.google.com (mail-io1-xd49.google.com\n [IPv6:2607:f8b0:4864:20::d49])\n by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E46819C\n for <netfilter-devel@vger.kernel.org>;\n Tue, 26 Sep 2023 13:05:15 -0700 (PDT)", "by mail-io1-xd49.google.com with SMTP id\n ca18e2360f4ac-7916aa85aa2so1221800639f.2\n for <netfilter-devel@vger.kernel.org>;\n Tue, 26 Sep 2023 13:05:15 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=google.com; s=20230601; t=1695758714; x=1696363514;\n darn=vger.kernel.org;\n h=cc:to:from:subject:message-id:references:mime-version:in-reply-to\n :date:from:to:cc:subject:date:message-id:reply-to;\n bh=Y896tdbpANmEYjOJHc8XK7Iynz1k/9wM577XVZiXiEc=;\n b=EFRwWR00l+HS09aReiShHLlPm3py4L1Mu3puJ7tgZJ+1QIGrKZzLe3fJcHFF1nvwhO\n awRtdL7kpEMEqSQprzmbBWQ1XX4Ij73uWBwt4xXip2CS0MRANBpCzmoXT2cz5mJaT+OU\n q+pAX6ljYtHHuLC0QV7x6+67gft8AbB9bnov+cO73xHamTpGxxQYubT79EJeMTBepeT3\n WPCPzaBOBd9RoMjqcwTsbci+oVW+1H1MmQGQMpaqhVq5erjenzObgr2eHdPBwkK1QJl2\n NIhShmRV86RdgfgqZrTq6qNkrAi4RN7U2Kdvh00we1Bk5cfuahxO2Y5i5Ysad+ivARKP\n 0E5A==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1695758714; x=1696363514;\n h=cc:to:from:subject:message-id:references:mime-version:in-reply-to\n :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;\n bh=Y896tdbpANmEYjOJHc8XK7Iynz1k/9wM577XVZiXiEc=;\n b=Ta4ERFTXRysUXf86+xaKsmgD6YnlKkd7KT2H/SMazmfM8l2200qyUU8xwnJmZ9Iqa3\n Mwu4tlcGspPnjH6d8M3SVQ/06PWPcuSyfB87VT6AOgV8tJR0IZlSlC1rLLRMCNKjhlPf\n xRCi9YGwhXNHLIm58Q6MSKiuGiGePvGVL+Ql9mqQJ1jtx3BQzFV8Ipc0VS88E0NLnm3R\n n3YjiSD7KoiNL2YZYAip5v7TLdpV8Zf+/YYyvVwBRrcTDYauSjoaFXPMcfVcCMmpTmgT\n Xal+hrdC38GE9pyWDEJaL8U9Q9oOPJBb0sFRUtlJC7S7Tlj+6kHTSRovq4p3LCuZmxJA\n qH5g==", "X-Gm-Message-State": "AOJu0YxKlNewaHRdak/xDLHkxUJ0vzF/XtLzhzH0kvGqrTblvSuoVDiu\n okttDft+UQNNdqh/1xjv4SuvB3Ezsg==", "X-Google-Smtp-Source": "\n AGHT+IGAObIysfj6fqWw+uKxKjJ0fY0RpF57lGXSTezunDHESqDHeOipAl1lWQDRdfwi7TOwImqfnBF74w==", "X-Received": "from jrife.c.googlers.com ([fda3:e722:ac3:cc00:2b:ff92:c0a8:9f])\n (user=jrife job=sendgmr) by 2002:a05:6638:658e:b0:43c:e990:b090 with SMTP id\n fr14-20020a056638658e00b0043ce990b090mr50473jab.6.1695758714545; Tue, 26 Sep\n 2023 13:05:14 -0700 (PDT)", "Date": "Tue, 26 Sep 2023 15:05:04 -0500", "In-Reply-To": "<20230926200505.2804266-1-jrife@google.com>", "Mime-Version": "1.0", "References": "<20230926200505.2804266-1-jrife@google.com>", "X-Mailer": "git-send-email 2.42.0.515.g380fc7ccd1-goog", "Message-ID": "<20230926200505.2804266-3-jrife@google.com>", "Subject": "[PATCH net v6 2/3] net: prevent rewrite of msg_name and msg_namelen\n in sock_sendmsg()", "From": "Jordan Rife <jrife@google.com>", "To": "davem@davemloft.net, edumazet@google.com, kuba@kernel.org,\n pabeni@redhat.com, willemdebruijn.kernel@gmail.com,\n netdev@vger.kernel.org", "Cc": "dborkman@kernel.org, horms@verge.net.au, pablo@netfilter.org,\n kadlec@netfilter.org, fw@strlen.de, santosh.shilimkar@oracle.com,\n ast@kernel.org, rdna@fb.com, linux-rdma@vger.kernel.org,\n rds-devel@oss.oracle.com, coreteam@netfilter.org,\n netfilter-devel@vger.kernel.org, ja@ssi.bg,\n lvs-devel@vger.kernel.org, kafai@fb.com, daniel@iogearbox.net,\n daan.j.demeyer@gmail.com, Jordan Rife <jrife@google.com>,\n stable@vger.kernel.org", "Content-Type": "text/plain; charset=\"UTF-8\"", "X-Spam-Status": "No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED,\n DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,\n RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL\n autolearn=unavailable autolearn_force=no version=3.4.6", "X-Spam-Checker-Version": "SpamAssassin 3.4.6 (2021-04-09) on\n lindbergh.monkeyblade.net", "Precedence": "bulk", "List-ID": "<netfilter-devel.vger.kernel.org>", "X-Mailing-List": "netfilter-devel@vger.kernel.org" }, "content": "Callers of sock_sendmsg(), and similarly kernel_sendmsg(), in kernel\nspace may observe their value of msg_name change in cases where BPF\nsendmsg hooks rewrite the send address. This has been confirmed to break\nNFS mounts running in UDP mode and has the potential to break other\nsystems.\n\nSoon, support will be added for BPF sockaddr hooks for Unix sockets\nwhich introduces the ability to modify the msg->msg_namelen value.\n\nThis patch:\n\n1) Creates a new function called __sock_sendmsg() with same logic as the\n old sock_sendmsg() function.\n2) Replaces calls to sock_sendmsg() made by __sys_sendto() and\n __sys_sendmsg() with __sock_sendmsg() to avoid an unnecessary copy,\n as these system calls are already protected.\n3) Makes a copy of msg->msg_name and to insulate callers.\n4) Makes a copy of msg->msg_namelen to insulate callers in anticipation\n of the aforementioned change to support Unix sockets.\n\nLink: https://lore.kernel.org/netdev/20230912013332.2048422-1-jrife@google.com/\nLink: https://lore.kernel.org/bpf/202309231339.L2O0CrMU-lkp@intel.com/T/#m181770af51156bdaa70fd4a4cb013ba11f28e101\nFixes: 1cedee13d25a (\"bpf: Hooks for sys_sendmsg\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jordan Rife <jrife@google.com>\n---\n net/socket.c | 31 +++++++++++++++++++++++++------\n 1 file changed, 25 insertions(+), 6 deletions(-)", "diff": "diff --git a/net/socket.c b/net/socket.c\nindex c8b08b32f097e..107a257a75186 100644\n--- a/net/socket.c\n+++ b/net/socket.c\n@@ -737,6 +737,14 @@ static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)\n \treturn ret;\n }\n \n+static int __sock_sendmsg(struct socket *sock, struct msghdr *msg)\n+{\n+\tint err = security_socket_sendmsg(sock, msg,\n+\t\t\t\t\t msg_data_left(msg));\n+\n+\treturn err ?: sock_sendmsg_nosec(sock, msg);\n+}\n+\n /**\n *\tsock_sendmsg - send a message through @sock\n *\t@sock: socket\n@@ -747,10 +755,21 @@ static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)\n */\n int sock_sendmsg(struct socket *sock, struct msghdr *msg)\n {\n-\tint err = security_socket_sendmsg(sock, msg,\n-\t\t\t\t\t msg_data_left(msg));\n+\tstruct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name;\n+\tint save_addrlen = msg->msg_namelen;\n+\tstruct sockaddr_storage address;\n+\tint ret;\n \n-\treturn err ?: sock_sendmsg_nosec(sock, msg);\n+\tif (msg->msg_name) {\n+\t\tmemcpy(&address, msg->msg_name, msg->msg_namelen);\n+\t\tmsg->msg_name = &address;\n+\t}\n+\n+\tret = __sock_sendmsg(sock, msg);\n+\tmsg->msg_name = save_addr;\n+\tmsg->msg_namelen = save_addrlen;\n+\n+\treturn ret;\n }\n EXPORT_SYMBOL(sock_sendmsg);\n \n@@ -1138,7 +1157,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)\n \tif (sock->type == SOCK_SEQPACKET)\n \t\tmsg.msg_flags |= MSG_EOR;\n \n-\tres = sock_sendmsg(sock, &msg);\n+\tres = __sock_sendmsg(sock, &msg);\n \t*from = msg.msg_iter;\n \treturn res;\n }\n@@ -2174,7 +2193,7 @@ int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags,\n \tif (sock->file->f_flags & O_NONBLOCK)\n \t\tflags |= MSG_DONTWAIT;\n \tmsg.msg_flags = flags;\n-\terr = sock_sendmsg(sock, &msg);\n+\terr = __sock_sendmsg(sock, &msg);\n \n out_put:\n \tfput_light(sock->file, fput_needed);\n@@ -2538,7 +2557,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,\n \t\terr = sock_sendmsg_nosec(sock, msg_sys);\n \t\tgoto out_freectl;\n \t}\n-\terr = sock_sendmsg(sock, msg_sys);\n+\terr = __sock_sendmsg(sock, msg_sys);\n \t/*\n \t * If this is sendmmsg() and sending to current destination address was\n \t * successful, remember it.\n", "prefixes": [ "net", "v6", "2/3" ] }