From patchwork Mon Apr 2 20:31:00 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 150199 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id D4D4BB6FA3 for ; Tue, 3 Apr 2012 04:32:09 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753738Ab2DBSbT (ORCPT ); Mon, 2 Apr 2012 14:31:19 -0400 Received: from mail-bk0-f46.google.com ([209.85.214.46]:40104 "EHLO mail-bk0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751291Ab2DBSbS (ORCPT ); Mon, 2 Apr 2012 14:31:18 -0400 Received: by bkcik5 with SMTP id ik5so2809646bkc.19 for ; Mon, 02 Apr 2012 11:31:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer; bh=6mHdQm9UZAV80aL8TOV4v328d6W4BVMEf+/eoWgzkys=; b=IzPeMsEdD20S6D7o6raAj0YLtU2gQyeO9Iew6PBQSaXGoHhnmKBHdxOblwDcWJdwT6 /4u9/KiYSJMYCs1OEG99QWOsKUPitNdJFRrYzcivS1m+8yPXVdKMYsX1TIf/piOIGDe0 a8hwb1ZlDfwpkKqrJ1dsBdFpezSF/aECr7ndXuSmIVMvrhhk7G9RaAz4iJs6WOEl9B5U fSuJd4W4oKAkuRnSoeo+R+kgPh3xrmkaXNKgwZwQO9hrZS4/PSmelbE71ckjvprOhDnP hGbor9ditf6gR0AybDXge3d31at8hVLEEplV3iwr4NvbJXcUwrJ5Z9o6jbT6T2RjQzBU t4Gg== Received: by 10.204.150.75 with SMTP id x11mr4014256bkv.62.1333391476580; Mon, 02 Apr 2012 11:31:16 -0700 (PDT) Received: from localhost.localdomain (95-89-78-76-dynip.superkabel.de. [95.89.78.76]) by mx.google.com with ESMTPS id f5sm40407479bke.9.2012.04.02.11.31.14 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 02 Apr 2012 11:31:15 -0700 (PDT) From: Sasha Levin To: remi.denis-courmont@nokia.com, davem@davemloft.net Cc: davej@redhat.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Sasha Levin Subject: [PATCH] phonet: Check input from user before allocating Date: Mon, 2 Apr 2012 16:31:00 -0400 Message-Id: <1333398660-11552-1-git-send-email-levinsasha928@gmail.com> X-Mailer: git-send-email 1.7.8.5 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org A phonet packet is limited to USHRT_MAX bytes, this is never checked during tx which means that the user can specify any size he wishes, and the kernel will attempt to allocate that size. In the good case, it'll lead to the following warning, but it may also cause the kernel to kick in the OOM and kill a random task on the server. [ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730() [ 8921.749770] Pid: 5081, comm: trinity Tainted: G W 3.4.0-rc1-next-20120402-sasha #46 [ 8921.756672] Call Trace: [ 8921.758185] [] warn_slowpath_common+0x87/0xb0 [ 8921.762868] [] warn_slowpath_null+0x15/0x20 [ 8921.765399] [] __alloc_pages_slowpath+0x65/0x730 [ 8921.769226] [] ? zone_watermark_ok+0x1a/0x20 [ 8921.771686] [] ? get_page_from_freelist+0x625/0x660 [ 8921.773919] [] __alloc_pages_nodemask+0x1f8/0x240 [ 8921.776248] [] kmalloc_large_node+0x70/0xc0 [ 8921.778294] [] __kmalloc_node_track_caller+0x34/0x1c0 [ 8921.780847] [] ? sock_alloc_send_pskb+0xbc/0x260 [ 8921.783179] [] __alloc_skb+0x75/0x170 [ 8921.784971] [] sock_alloc_send_pskb+0xbc/0x260 [ 8921.787111] [] ? release_sock+0x7e/0x90 [ 8921.788973] [] sock_alloc_send_skb+0x10/0x20 [ 8921.791052] [] pep_sendmsg+0x60/0x380 [ 8921.792931] [] ? pn_socket_bind+0x156/0x180 [ 8921.794917] [] ? pn_socket_autobind+0x3f/0x90 [ 8921.797053] [] pn_socket_sendmsg+0x4f/0x70 [ 8921.798992] [] sock_aio_write+0x187/0x1b0 [ 8921.801395] [] ? sub_preempt_count+0xae/0xf0 [ 8921.803501] [] ? __lock_acquire+0x42c/0x4b0 [ 8921.805505] [] ? __sock_recv_ts_and_drops+0x140/0x140 [ 8921.807860] [] do_sync_readv_writev+0xbc/0x110 [ 8921.809986] [] ? might_fault+0x97/0xa0 [ 8921.811998] [] ? security_file_permission+0x1e/0x90 [ 8921.814595] [] do_readv_writev+0xe2/0x1e0 [ 8921.816702] [] ? do_setitimer+0x1ac/0x200 [ 8921.818819] [] ? get_parent_ip+0x11/0x50 [ 8921.820863] [] ? sub_preempt_count+0xae/0xf0 [ 8921.823318] [] vfs_writev+0x46/0x60 [ 8921.825219] [] sys_writev+0x4f/0xb0 [ 8921.827127] [] system_call_fastpath+0x16/0x1b [ 8921.829384] ---[ end trace dffe390f30db9eb7 ]--- Signed-off-by: Sasha Levin --- net/phonet/pep.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/net/phonet/pep.c b/net/phonet/pep.c index 9f60008..caee99e 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -1130,6 +1130,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk, int flags = msg->msg_flags; int err, done; + if (len > USHRT_MAX) + return -E2BIG; + if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL| MSG_CMSG_COMPAT)) || !(msg->msg_flags & MSG_EOR))