| Message ID | 20171230001305.15553-1-ebiggers3@gmail.com |
|---|---|
| State | Awaiting Upstream, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | af_key: fix buffer overread in verify_address_len() | expand |
On Fri, Dec 29, 2017 at 06:13:05PM -0600, Eric Biggers wrote: > From: Eric Biggers <ebiggers@google.com> > > If a message sent to a PF_KEY socket ended with one of the extensions > that takes a 'struct sadb_address' but there were not enough bytes > remaining in the message for the ->sa_family member of the 'struct > sockaddr' which is supposed to follow, then verify_address_len() read > past the end of the message, into uninitialized memory. Fix it by > returning -EINVAL in this case. > > This bug was found using syzkaller with KMSAN. > > Reproducer: > > #include <linux/pfkeyv2.h> > #include <sys/socket.h> > #include <unistd.h> > > int main() > { > int sock = socket(PF_KEY, SOCK_RAW, PF_KEY_V2); > char buf[24] = { 0 }; > struct sadb_msg *msg = (void *)buf; > struct sadb_address *addr = (void *)(msg + 1); > > msg->sadb_msg_version = PF_KEY_V2; > msg->sadb_msg_type = SADB_DELETE; > msg->sadb_msg_len = 3; > addr->sadb_address_len = 1; > addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; > > write(sock, buf, 24); > } > > Reported-by: Alexander Potapenko <glider@google.com> > Cc: stable@vger.kernel.org > Signed-off-by: Eric Biggers <ebiggers@google.com> Applied to the ipsec tree, thanks Eric!
diff --git a/net/key/af_key.c b/net/key/af_key.c index 3dffb892d52c..596499cc8b2f 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -401,6 +401,11 @@ static int verify_address_len(const void *p) #endif int len; + if (sp->sadb_address_len < + DIV_ROUND_UP(sizeof(*sp) + offsetofend(typeof(*addr), sa_family), + sizeof(uint64_t))) + return -EINVAL; + switch (addr->sa_family) { case AF_INET: len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin), sizeof(uint64_t));