From patchwork Thu Apr 5 22:07:45 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 151008 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id D1943B7054 for ; Fri, 6 Apr 2012 05:08:31 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755837Ab2DETIF (ORCPT ); Thu, 5 Apr 2012 15:08:05 -0400 Received: from mail-bk0-f46.google.com ([209.85.214.46]:58669 "EHLO mail-bk0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755657Ab2DETID (ORCPT ); Thu, 5 Apr 2012 15:08:03 -0400 Received: by bkcik5 with SMTP id ik5so1632392bkc.19 for ; Thu, 05 Apr 2012 12:08:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer; bh=oUEh3CkMp/g5O/glzhgIU+FZc9suLWNURbTF/ERBHAk=; b=glMeYbqeJX8SYGbMFUkSE1uQgCMgtZ88+4qqaCKvsdv8HJknr03z6CpAyAm2VTISUf 2uautbeANNyCwQF8wdjemQeIik986O6lIUgd69P5caEafYQBrG6oGRzzRBjFirz+97mb Q/1uRphS6UK4OkeEjcn5o1AmAoU+Bt3CwBZ2+AAY/DfU1TKVL16hYPv5nnh6l13UI3gp T1YHTgLFKRDtQuI8HuqXtZbK0dHMcKTiPkhFGoS3bUVmbQVeaoATMwlBsQZGrxV8nJz2 nKyYSLuxZwOhSBfWXapD3j05AfE7a/9xHjBk1mwykbk+/Y+XMFiOUw3hL/CKQd/BIg4b emzg== Received: by 10.205.130.1 with SMTP id hk1mr1766181bkc.51.1333652881426; Thu, 05 Apr 2012 12:08:01 -0700 (PDT) Received: from localhost.localdomain (95-89-78-76-dynip.superkabel.de. [95.89.78.76]) by mx.google.com with ESMTPS id c4sm10470457bkh.0.2012.04.05.12.07.59 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 05 Apr 2012 12:08:00 -0700 (PDT) From: Sasha Levin To: remi.denis-courmont@nokia.com, davem@davemloft.net Cc: davej@redhat.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Sasha Levin Subject: [PATCH v2] phonet: Check input from user before allocating Date: Thu, 5 Apr 2012 18:07:45 -0400 Message-Id: <1333663665-3999-1-git-send-email-levinsasha928@gmail.com> X-Mailer: git-send-email 1.7.8.5 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org A phonet packet is limited to USHRT_MAX bytes, this is never checked during tx which means that the user can specify any size he wishes, and the kernel will attempt to allocate that size. In the good case, it'll lead to the following warning, but it may also cause the kernel to kick in the OOM and kill a random task on the server. [ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730() [ 8921.749770] Pid: 5081, comm: trinity Tainted: G W 3.4.0-rc1-next-20120402-sasha #46 [ 8921.756672] Call Trace: [ 8921.758185] [] warn_slowpath_common+0x87/0xb0 [ 8921.762868] [] warn_slowpath_null+0x15/0x20 [ 8921.765399] [] __alloc_pages_slowpath+0x65/0x730 [ 8921.769226] [] ? zone_watermark_ok+0x1a/0x20 [ 8921.771686] [] ? get_page_from_freelist+0x625/0x660 [ 8921.773919] [] __alloc_pages_nodemask+0x1f8/0x240 [ 8921.776248] [] kmalloc_large_node+0x70/0xc0 [ 8921.778294] [] __kmalloc_node_track_caller+0x34/0x1c0 [ 8921.780847] [] ? sock_alloc_send_pskb+0xbc/0x260 [ 8921.783179] [] __alloc_skb+0x75/0x170 [ 8921.784971] [] sock_alloc_send_pskb+0xbc/0x260 [ 8921.787111] [] ? release_sock+0x7e/0x90 [ 8921.788973] [] sock_alloc_send_skb+0x10/0x20 [ 8921.791052] [] pep_sendmsg+0x60/0x380 [ 8921.792931] [] ? pn_socket_bind+0x156/0x180 [ 8921.794917] [] ? pn_socket_autobind+0x3f/0x90 [ 8921.797053] [] pn_socket_sendmsg+0x4f/0x70 [ 8921.798992] [] sock_aio_write+0x187/0x1b0 [ 8921.801395] [] ? sub_preempt_count+0xae/0xf0 [ 8921.803501] [] ? __lock_acquire+0x42c/0x4b0 [ 8921.805505] [] ? __sock_recv_ts_and_drops+0x140/0x140 [ 8921.807860] [] do_sync_readv_writev+0xbc/0x110 [ 8921.809986] [] ? might_fault+0x97/0xa0 [ 8921.811998] [] ? security_file_permission+0x1e/0x90 [ 8921.814595] [] do_readv_writev+0xe2/0x1e0 [ 8921.816702] [] ? do_setitimer+0x1ac/0x200 [ 8921.818819] [] ? get_parent_ip+0x11/0x50 [ 8921.820863] [] ? sub_preempt_count+0xae/0xf0 [ 8921.823318] [] vfs_writev+0x46/0x60 [ 8921.825219] [] sys_writev+0x4f/0xb0 [ 8921.827127] [] system_call_fastpath+0x16/0x1b [ 8921.829384] ---[ end trace dffe390f30db9eb7 ]--- Signed-off-by: Sasha Levin Acked-by: Rémi Denis-Courmont --- net/phonet/pep.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/net/phonet/pep.c b/net/phonet/pep.c index 9f60008..caee99e 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -1130,6 +1130,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk, int flags = msg->msg_flags; int err, done; + if (len > USHRT_MAX) + return -EMSGSIZE; + if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL| MSG_CMSG_COMPAT)) || !(msg->msg_flags & MSG_EOR))