| Message ID | 20120711221209.GA30506@redhat.com |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Dave Jones <davej@redhat.com> Date: Wed, 11 Jul 2012 18:12:09 -0400 > Sasha reported this last November (https://lkml.org/lkml/2011/11/22/41) > and I keep walking into it while fuzz testing. net/ieee802154/dgram.c:dgram_sendmsg() now limits the size to the device MTU, so you should not hit this problem any more. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c index 40e606f..1da228a 100644 --- a/net/ieee802154/af_ieee802154.c +++ b/net/ieee802154/af_ieee802154.c @@ -108,6 +108,9 @@ static int ieee802154_sock_sendmsg(struct kiocb *iocb, struct socket *sock, { struct sock *sk = sock->sk; + if (len > MAX_ORDER_NR_PAGES * PAGE_SIZE) + return -EINVAL; + return sk->sk_prot->sendmsg(iocb, sk, msg, len); }
Sasha reported this last November (https://lkml.org/lkml/2011/11/22/41) and I keep walking into it while fuzz testing. Length of the packet is passed in from userspace, and passed down to the page allocator unchecked. If the allocation size is bigger than MAX_ORDER, we get this backtrace from the page allocator. WARNING: at mm/page_alloc.c:2298 __alloc_pages_nodemask+0x46d/0xb00() Call Trace: [<ffffffff81064b2f>] warn_slowpath_common+0x7f/0xc0 [<ffffffff81064b8a>] warn_slowpath_null+0x1a/0x20 [<ffffffff8116105d>] __alloc_pages_nodemask+0x46d/0xb00 [<ffffffff8155ed3b>] ? __alloc_skb+0x4b/0x230 [<ffffffff810d43dd>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff816ace3f>] kmalloc_large_node+0x66/0xab [<ffffffff811ad9b5>] __kmalloc_node_track_caller+0x1b5/0x200 [<ffffffff81559701>] ? sock_alloc_send_pskb+0x271/0x3e0 [<ffffffff8155ed68>] __alloc_skb+0x78/0x230 [<ffffffff81559701>] sock_alloc_send_pskb+0x271/0x3e0 [<ffffffff8156d331>] ? dev_getfirstbyhwtype+0x161/0x250 [<ffffffff8156d1d0>] ? rps_may_expire_flow+0x220/0x220 [<ffffffff81559885>] sock_alloc_send_skb+0x15/0x20 [<ffffffffa4a73347>] dgram_sendmsg+0xe7/0x340 [af_802154] [<ffffffffa4a72044>] ieee802154_sock_sendmsg+0x14/0x20 [af_802154] [<ffffffff81553787>] sock_sendmsg+0x117/0x130 [<ffffffff810cdb7d>] ? trace_hardirqs_off+0xd/0x10 [<ffffffff816b81c7>] ? _raw_spin_unlock_irqrestore+0x77/0x80 [<ffffffff8134312b>] ? debug_object_activate+0x12b/0x1a0 [<ffffffff816b81c7>] ? _raw_spin_unlock_irqrestore+0x77/0x80 [<ffffffff81556b60>] sys_sendto+0x140/0x190 [<ffffffff816c5014>] ? bad_to_user+0x5e/0x80a [<ffffffff8133c04e>] ? trace_hardirqs_on_thunk+0x3a/0x3f [<ffffffff816c15e9>] system_call_fastpath+0x16/0x1b Signed-off-by: Dave Jones <davej@redhat.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html