From patchwork Wed Jun 7 13:14:29 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mateusz Jurczyk X-Patchwork-Id: 772420 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3wjTYg22gyz9sDC for ; Wed, 7 Jun 2017 23:15:03 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="AIVbY6DL"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751495AbdFGNOe (ORCPT ); Wed, 7 Jun 2017 09:14:34 -0400 Received: from mail-wr0-f182.google.com ([209.85.128.182]:34378 "EHLO mail-wr0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751403AbdFGNOd (ORCPT ); Wed, 7 Jun 2017 09:14:33 -0400 Received: by mail-wr0-f182.google.com with SMTP id g76so6008494wrd.1 for ; Wed, 07 Jun 2017 06:14:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=KrhccHmKkQSL25qwJv4XGf1wbNZG4hZhSS70+pCjlIo=; b=AIVbY6DL8CSa8BXtMeeAamukk5GzrqzKdYmT5RGN2LOSn44zVvXDiK9AtiP1+25M2P uKDJqpBCjxMGGSigW7jYa/lO2xw8K1s6ouh7rcaJKtJtWiujtCa7jSKJK9GxYOAfmQhY jGJmYkeRqGODCqh6K9Y4hdT1mI/zgwa9xKB/7z8Me1KRTMDaT1eFm5LGEy0Q8MErTK8r OlzDA0U0nyE5Cy6+32iP+Yrob7g2jiv7Fc19yx03BgOdn1Gt9AIzODFjoYxuQW+WEFE0 nZ5dnclfQHw1Fv1C80p3cgz5pW8J6gqWbtKuYBXhbAN0rrJOUAPWrKyfobOY/A+A8Lju mauQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=KrhccHmKkQSL25qwJv4XGf1wbNZG4hZhSS70+pCjlIo=; b=btEnWhZlKtOszz5zNHR27xzxXssU4KPRrq+DShYLh1/mvVpv5xVibZ1aKMxzW9us/v rihyCSKay7kBytKbrp5xGTkkpl9F9vV6dzMJYmUslk04BGpKvdBrXh7rAG2l852720YG UoTbFtme9DrcAkXDw8kgT/4MeUPCw3IrbPkzctftE7NGNrUVgteYy+RrrUfikQnw7/G9 ywXoj/40vXkf/jSOZI4cDMfCwXij1JDHpiEjY0HZ13GgInrm7O1IWLN4CH3FUhDtsEl9 32x4tDFMOMvm1g2AViSKlo0Dnr+M78ZEsS7ttPrjNcjcyya0+fDarVaaodGyMWzPkz2s MqnA== X-Gm-Message-State: AODbwcC7Jyz3vOhK74++VGnM/x44yFdGBg+LKZEmAAIsZIcEg+1XDJtu LujldH86ROQ4S14dpDcghw== X-Received: by 10.223.176.9 with SMTP id f9mr20845054wra.106.1496841271457; Wed, 07 Jun 2017 06:14:31 -0700 (PDT) Received: from mjurczyk.krp.corp.google.com ([172.28.242.6]) by smtp.gmail.com with ESMTPSA id t22sm2121187wmt.19.2017.06.07.06.14.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 07 Jun 2017 06:14:30 -0700 (PDT) From: Mateusz Jurczyk To: Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal Cc: "David S. Miller" , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-decnet-user@lists.sourceforge.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb Date: Wed, 7 Jun 2017 15:14:29 +0200 Message-Id: <20170607131429.30441-1-mjurczyk@google.com> X-Mailer: git-send-email 2.13.1.508.gb3defc5cc-goog Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Verify that the length of the socket buffer is sufficient to cover the entire nlh->nlmsg_len field before accessing that field for further input sanitization. If the client only supplies 1-3 bytes of data in sk_buff, then nlh->nlmsg_len remains partially uninitialized and contains leftover memory from the corresponding kernel allocation. Operating on such data may result in indeterminate evaluation of the nlmsg_len < sizeof(*nlh) expression. The bug was discovered by a runtime instrumentation designed to detect use of uninitialized memory in the kernel. The patch prevents this and other similar tools (e.g. KMSAN) from flagging this behavior in the future. Signed-off-by: Mateusz Jurczyk --- net/decnet/netfilter/dn_rtmsg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c index 1ed81ac6dd1a..26e020e9d415 100644 --- a/net/decnet/netfilter/dn_rtmsg.c +++ b/net/decnet/netfilter/dn_rtmsg.c @@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb) { struct nlmsghdr *nlh = nlmsg_hdr(skb); - if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) + if (skb->len < sizeof(nlh->nlmsg_len) || + nlh->nlmsg_len < sizeof(*nlh) || + skb->len < nlh->nlmsg_len) return; if (!netlink_capable(skb, CAP_NET_ADMIN))