From patchwork Fri Jul 25 15:23:58 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Ryabinin X-Patchwork-Id: 373728 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id C32181400D5 for ; Sat, 26 Jul 2014 01:30:21 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753925AbaGYP3p (ORCPT ); Fri, 25 Jul 2014 11:29:45 -0400 Received: from mailout3.w1.samsung.com ([210.118.77.13]:11456 "EHLO mailout3.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753170AbaGYP3o (ORCPT ); Fri, 25 Jul 2014 11:29:44 -0400 Received: from eucpsbgm1.samsung.com (unknown [203.254.199.244]) by mailout3.w1.samsung.com (Oracle Communications Messaging Server 7u4-24.01(7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTP id <0N99001DHXPG3220@mailout3.w1.samsung.com>; Fri, 25 Jul 2014 16:29:40 +0100 (BST) X-AuditID: cbfec7f4-b7fac6d000006cfe-2b-53d277e4e842 Received: from eusync2.samsung.com ( [203.254.199.212]) by eucpsbgm1.samsung.com (EUCPMTA) with SMTP id C7.98.27902.4E772D35; Fri, 25 Jul 2014 16:29:40 +0100 (BST) Received: from a.ryabinin ([106.109.129.143]) by eusync2.samsung.com (Oracle Communications Messaging Server 7u4-23.01 (7.0.4.23.0) 64bit (built Aug 10 2011)) with ESMTPA id <0N99007HMXPGFL00@eusync2.samsung.com>; Fri, 25 Jul 2014 16:29:40 +0100 (BST) Message-id: <53D2768E.2040902@samsung.com> Date: Fri, 25 Jul 2014 19:23:58 +0400 From: Andrey Ryabinin User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-version: 1.0 To: Sasha Levin , "David S. Miller" Cc: "netdev@vger.kernel.org" , LKML , Dave Jones , Hannes Frederic Sowa , Eric Dumazet Subject: Re: net: socket: NULL ptr deref in sendmsg References: <53C2FF3D.4030201@oracle.com> In-reply-to: <53C2FF3D.4030201@oracle.com> Content-type: multipart/mixed; boundary=------------060401010001020104050602 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrPLMWRmVeSWpSXmKPExsVy+t/xK7pPyi8FG3xba2yx5XoTk8Wc8y0s Fk+PPWK32DzZ2eLyrjlsFscWiFksPnKb2YHdY8vKm0weCzaVenx8eovF4/2+q2weLy6eYvH4 vEkugC2KyyYlNSezLLVI3y6BK+Nk0zTGgsOWFZ+XnmVpYHyk38XIySEhYCKxeW8bO4QtJnHh 3nq2LkYuDiGBpYwSF2Z3QjnNTBJrn61g7WLk4OAV0JI4ttoQpIFFQFVizsQ7rCA2m4CexL9Z 29lAbFGBCIkDfc/A4rwCghI/Jt9jAbFFBIIlzh5/yQIyk1ngGqPExY5/YEXCAsYSF9Z2MYHM FxLQlFjc7wkS5gRatb/hKyOIzSzgI/GmdxfzBEb+WUjGzkKSgrB1JN71PYCy5SW2v50DZRtI NHecZ8MUt5I49fAB2wJG9lWMoqmlyQXFSem5hnrFibnFpXnpesn5uZsYIRHzZQfj4mNWhxgF OBiVeHgZHp4KFmJNLCuuzD3EqAI059GG1RcYpVjy8vNSlUR4A3MvBQvxpiRWVqUW5ccXleak Fh9iZOLglGpgDIyslnl66IAta91dq3ouZuEsK33trSxLa8PyLoZP5i0KWNgldO7wXRVxbkvm I0GZBwtY9sWqGQX3qq1J8HrT89i3o/qkpPuh21uc5m8MtHPRjRawmfjX6GC6pdbDLk3h50k1 K80Ygx1ltlmuXbY7v8NqV7enyde0BxEPD08Jm3+BoW2t1GMlluKMREMt5qLiRADAMAkwggIA AA== Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 07/14/14 01:50, Sasha Levin wrote: > > I've tried debugging it, but I don't see a code path that could lead to that. > I finally found some time to take look at this and I've found where the problem is. Sasha, I suppose there was no usual "Unable to handle NULL pointer deference" after KASAN's report, right? This gave me a clue that address 0 is actually mapped and contains valid socket address structure in it. I've managed to write a simple code (in attachment), which could easily reproduce this bug. I've fixed it with the following patch, please take a look. From: Andrey Ryabinin Subject: [PATCH] net: sendmsg: fix NULL pointer dereference Sasha's report: > While fuzzing with trinity inside a KVM tools guest running the latest -next > kernel with the KASAN patchset, I've stumbled on the following spew: > > [ 4448.949424] ================================================================== > [ 4448.951737] AddressSanitizer: user-memory-access on address 0 > [ 4448.952988] Read of size 2 by thread T19638: > [ 4448.954510] CPU: 28 PID: 19638 Comm: trinity-c76 Not tainted 3.16.0-rc4-next-20140711-sasha-00046-g07d3099-dirty #813 > [ 4448.956823] ffff88046d86ca40 0000000000000000 ffff880082f37e78 ffff880082f37a40 > [ 4448.958233] ffffffffb6e47068 ffff880082f37a68 ffff880082f37a58 ffffffffb242708d > [ 4448.959552] 0000000000000000 ffff880082f37a88 ffffffffb24255b1 0000000000000000 > [ 4448.961266] Call Trace: > [ 4448.963158] dump_stack (lib/dump_stack.c:52) > [ 4448.964244] kasan_report_user_access (mm/kasan/report.c:184) > [ 4448.965507] __asan_load2 (mm/kasan/kasan.c:352) > [ 4448.966482] ? netlink_sendmsg (net/netlink/af_netlink.c:2339) > [ 4448.967541] netlink_sendmsg (net/netlink/af_netlink.c:2339) > [ 4448.968537] ? get_parent_ip (kernel/sched/core.c:2555) > [ 4448.970103] sock_sendmsg (net/socket.c:654) > [ 4448.971584] ? might_fault (mm/memory.c:3741) > [ 4448.972526] ? might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3740) > [ 4448.973596] ? verify_iovec (net/core/iovec.c:64) > [ 4448.974522] ___sys_sendmsg (net/socket.c:2096) > [ 4448.975797] ? put_lock_stats.isra.13 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254) > [ 4448.977030] ? lock_release_holdtime (kernel/locking/lockdep.c:273) > [ 4448.978197] ? lock_release_non_nested (kernel/locking/lockdep.c:3434 (discriminator 1)) > [ 4448.979346] ? check_chain_key (kernel/locking/lockdep.c:2188) > [ 4448.980535] __sys_sendmmsg (net/socket.c:2181) > [ 4448.981592] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600) > [ 4448.982773] ? trace_hardirqs_on (kernel/locking/lockdep.c:2607) > [ 4448.984458] ? syscall_trace_enter (arch/x86/kernel/ptrace.c:1500 (discriminator 2)) > [ 4448.985621] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600) > [ 4448.986754] SyS_sendmmsg (net/socket.c:2201) > [ 4448.987708] tracesys (arch/x86/kernel/entry_64.S:542) > [ 4448.988929] ================================================================== This reports means that we've come to netlink_sendmsg() with msg->msg_name == NULL and msg->msg_namelen > 0. After this report there was no usual "Unable to handle kernel NULL pointer dereference" and this gave me a clue that address 0 is mapped and contains valid socket address structure in it. This bug was introduced in f3d3342602f8bcbf37d7c46641cb9bca7618eb1c (net: rework recvmsg handler msg_name and msg_namelen logic). Commit message states that: "Set msg->msg_name = NULL if user specified a NULL in msg_name but had a non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't affect sendto as it would bail out earlier while trying to copy-in the address." But in fact this affects sendto when address 0 is mapped and contains socket address structure in it. In such case copy-in address will succeed, verify_iovec() function will successfully exit with msg->msg_namelen > 0 and msg->msg_name == NULL. This patch fixes it by assigning m->msg_name to address if move_addr_to_kernel() was successful. Cc: Hannes Frederic Sowa Cc: Eric Dumazet Cc: Reported-by: Sasha Levin Signed-off-by: Andrey Ryabinin --- net/compat.c | 6 ++++-- net/core/iovec.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/net/compat.c b/net/compat.c index 9a76eaf..eefd989 100644 --- a/net/compat.c +++ b/net/compat.c @@ -92,9 +92,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov, kern_address); if (err < 0) return err; - } - if (kern_msg->msg_name) + kern_msg->msg_name = kern_address; + } else + if (kern_msg->msg_name) + kern_msg->msg_name = kern_address; } else kern_msg->msg_name = NULL; diff --git a/net/core/iovec.c b/net/core/iovec.c index 827dd6b..16bd954 100644 --- a/net/core/iovec.c +++ b/net/core/iovec.c @@ -47,9 +47,11 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a address); if (err < 0) return err; - } - if (m->msg_name) + m->msg_name = address; + } else + if (m->msg_name) + m->msg_name = address; } else { m->msg_name = NULL; }