From patchwork Tue Jun 6 13:56:54 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Potapenko X-Patchwork-Id: 771890 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3whv6G2xnPz9s78 for ; Wed, 7 Jun 2017 00:22:46 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="j5kpLRJr"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751445AbdFFOWe (ORCPT ); Tue, 6 Jun 2017 10:22:34 -0400 Received: from mail-wm0-f53.google.com ([74.125.82.53]:35114 "EHLO mail-wm0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751399AbdFFOWc (ORCPT ); Tue, 6 Jun 2017 10:22:32 -0400 Received: by mail-wm0-f53.google.com with SMTP id x70so38326383wme.0 for ; Tue, 06 Jun 2017 07:22:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=a4MByZfuB0EkGMiq9ND7p9jUaZIutP6rmFeeY5ORL8A=; b=j5kpLRJrXMjt4hok8lKMTq/JAVjy8rt0m2UQDzMioZmV0Gjfn4PstGscDFEJnKhESc 10DuHcAXMOS/naWbtkC9eUck5DGjUzCYAA2XI4lh+tHGULVnM6cvmsHtt+Cq9kBughDk KKyZlGyP7fLmPnbhg7v1hkGhqBLPF6hOK3U+UI5JeZkg56Nq6q0xUv7Ns8M7rg5Dc7NG +pFqum581Bghr60anBX0th3mKs77IpvHP/LbbA8ked6SKFsfvmFu5sWa+9bBQb/gRwWC 8mT4+RnFQfZu1uQJaGc7dpWdxxsjtQ9K/nXbBjlROGdGi9v2H6gsDytE4GOy2hNiejvV hfDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=a4MByZfuB0EkGMiq9ND7p9jUaZIutP6rmFeeY5ORL8A=; b=jF0uSuCZOQwzkuQXT4ml4YnvEcsuyIq54mPu9iR+o4I0U1u+bx7322IrQHVX5fr1yz KZQFVhshMNy/3BNhOLj1J7y110VIotP7U2H9G4d0C2E9SPyJdVvGlnFq7KBI9dN0DDY4 K8aZ2siz/1T381grJPxCFMGJ9GE20ENLAfdSghXMsbLmImBDbXL5GJxXRN4mccmc2MJ6 r63EDhvqRCiXwiCrKNIymHInm15I6SVHeIrd+gXzO+exfYhcWHyRyXCMU6tyKrLarHj1 r+Nw4pvJyctZxPs7L+7EKaMCzZzpDUC3lc0KQPZvVU5HTpnqIH7F122GDKEqXb8qW6/C 5E4g== X-Gm-Message-State: AODbwcCKXp3UTbaQ+7y2c/wVfD5odTLdQuTzpCTlJtVL+P1XgwaJsq/+ gBQhQKhBTgcmCOz1 X-Received: by 10.28.129.139 with SMTP id c133mr11360945wmd.14.1496758950994; Tue, 06 Jun 2017 07:22:30 -0700 (PDT) Received: from glider0.muc.corp.google.com ([100.105.28.21]) by smtp.gmail.com with ESMTPSA id h123sm12463709wmd.34.2017.06.06.07.22.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 06 Jun 2017 07:22:30 -0700 (PDT) From: Alexander Potapenko To: dvyukov@google.com, kcc@google.com, edumazet@google.com, davem@davemloft.net, stephen@networkplumber.org Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH v4] net: don't call strlen on non-terminated string in dev_set_alias() Date: Tue, 6 Jun 2017 15:56:54 +0200 Message-Id: <20170606135654.111884-1-glider@google.com> X-Mailer: git-send-email 2.13.0.506.g27d5fe0cd-goog Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org KMSAN reported a use of uninitialized memory in dev_set_alias(), which was caused by calling strlcpy() (which in turn called strlen()) on the user-supplied non-terminated string. Signed-off-by: Alexander Potapenko --- v4: dropped the comment at all, as suggested by Yury Norov v3: removed the multi-line comment v2: fixed an off-by-one error spotted by Dmitry Vyukov For the record, here is the KMSAN report: ================================================================== BUG: KMSAN: use of unitialized memory in strlcpy+0x8b/0x1b0 CPU: 0 PID: 1062 Comm: probe Not tainted 4.11.0-rc5+ #2763 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x143/0x1b0 lib/dump_stack.c:52 kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:1016 __kmsan_warning_32+0x66/0xb0 mm/kmsan/kmsan_instr.c:491 strlen lib/string.c:484 strlcpy+0x8b/0x1b0 lib/string.c:144 dev_set_alias+0x295/0x360 net/core/dev.c:1255 do_setlink+0xfe5/0x5750 net/core/rtnetlink.c:2007 rtnl_setlink+0x469/0x4f0 net/core/rtnetlink.c:2249 rtnetlink_rcv_msg+0x5da/0xb40 net/core/rtnetlink.c:4107 netlink_rcv_skb+0x339/0x5a0 net/netlink/af_netlink.c:2339 rtnetlink_rcv+0x83/0xa0 net/core/rtnetlink.c:4113 netlink_unicast_kernel net/netlink/af_netlink.c:1272 netlink_unicast+0x13b7/0x1480 net/netlink/af_netlink.c:1298 netlink_sendmsg+0x10b8/0x10f0 net/netlink/af_netlink.c:1844 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg net/socket.c:643 sock_write_iter+0x395/0x440 net/socket.c:857 call_write_iter ./include/linux/fs.h:1733 new_sync_write fs/read_write.c:497 __vfs_write+0x619/0x700 fs/read_write.c:510 vfs_write+0x47e/0x8a0 fs/read_write.c:558 SYSC_write+0x17e/0x2f0 fs/read_write.c:605 SyS_write+0x87/0xb0 fs/read_write.c:597 entry_SYSCALL_64_fastpath+0x13/0x94 arch/x86/entry/entry_64.S:204 RIP: 0033:0x4052f1 RSP: 002b:00007fde1ed05d80 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004052f1 RDX: 0000000000000026 RSI: 00000000006cf0c0 RDI: 0000000000000032 RBP: 00007fde1ed05da0 R08: 00007fde1ed06700 R09: 00007fde1ed06700 R10: 00007fde1ed069d0 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fde1ed069c0 R15: 00007fde1ed06700 origin: 00000000aec00057 save_stack_trace+0x59/0x60 arch/x86/kernel/stacktrace.c:59 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:352 kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:247 kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:260 slab_alloc_node mm/slub.c:2743 __kmalloc_node_track_caller+0x1f4/0x390 mm/slub.c:4349 __kmalloc_reserve net/core/skbuff.c:138 __alloc_skb+0x2cd/0x740 net/core/skbuff.c:231 alloc_skb ./include/linux/skbuff.h:933 netlink_alloc_large_skb net/netlink/af_netlink.c:1144 netlink_sendmsg+0x934/0x10f0 net/netlink/af_netlink.c:1819 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg net/socket.c:643 sock_write_iter+0x395/0x440 net/socket.c:857 call_write_iter ./include/linux/fs.h:1733 new_sync_write fs/read_write.c:497 __vfs_write+0x619/0x700 fs/read_write.c:510 vfs_write+0x47e/0x8a0 fs/read_write.c:558 SYSC_write+0x17e/0x2f0 fs/read_write.c:605 SyS_write+0x87/0xb0 fs/read_write.c:597 entry_SYSCALL_64_fastpath+0x13/0x94 arch/x86/entry/entry_64.S:204 ================================================================== and the reproducer: ================================================================== #include int sock = -1; char buf[] = "\x26\x00\x00\x00\x13\x00\x47\xf1\x07\x01\xc1\xb0" "\x0e\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00" "\x09\xef\x18\xff\xff\x00\xf1\x32\x05\x00\x14\x00" "\x6e\x35"; void do_work(int arg) { switch (arg) { case 0: sock = socket(0x10, 0x3, 0x0); break; case 1: write(sock, buf, 0x26); break; } } void *thread_fn(void *arg) { int actual_arg = (int)arg; int iter = 10000, i; for (i = 0; i < iter; i++) { do_work(actual_arg); usleep(100); } return NULL; } int main() { pthread_t thr[4]; int i; for (i = 0; i < 4; i++) { pthread_create(&thr, NULL, thread_fn, (void*)(i % 2)); } sleep(10); return 0; } ================================================================== --- net/core/dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index fca407b4a6ea..84e1e86a4bce 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1253,8 +1253,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len) if (!new_ifalias) return -ENOMEM; dev->ifalias = new_ifalias; + memcpy(dev->ifalias, alias, len); + dev->ifalias[len] = 0; - strlcpy(dev->ifalias, alias, len+1); return len; }