From patchwork Mon May 21 23:35:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 917920 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="UDVEzg93"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40qZs0252rz9s1b for ; Tue, 22 May 2018 09:35:32 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751635AbeEUXfa (ORCPT ); Mon, 21 May 2018 19:35:30 -0400 Received: from mail-pf0-f193.google.com ([209.85.192.193]:40011 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751039AbeEUXf3 (ORCPT ); Mon, 21 May 2018 19:35:29 -0400 Received: by mail-pf0-f193.google.com with SMTP id f189-v6so7819376pfa.7 for ; Mon, 21 May 2018 16:35:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=8WGOEXEd1yT9+TR3qLfj43gvzyku9DchbNZeGS+ijhM=; b=UDVEzg93JuhcbjoGQMev7eoy6que8NUOxUkCrW3NzjYo4mjm2++oeidKBynAZfBYaD WAdWdRhpKdApBFUFY0uhBnBhXLuO68MRW9fm3Tv+PMimPHn0UVzMrVSN0K80rz976B77 PJCzrd1elsGYJNaWltlyo6udH9FU7NSYBGUrKacUUnRRl27tfMbxhFXQBHNLtMwylsrQ dvuc7b+8aVRzr9uDAJnpiabvYGe4MODKNL+K90sZN7rUg1hx08Ze/4MU/gbzWnquGCiT OmpkfoPYBPuFb4URZQTbaj9Y/zxmztwfTOP+lI9IzdVIz3+ALO0/nSqlkB0/cjnkV8qJ FAVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=8WGOEXEd1yT9+TR3qLfj43gvzyku9DchbNZeGS+ijhM=; b=EretOOMzT523RaDLfmnbbIkG4mkyynS1C9aJSjMjCpvPilvDxMMIfIQ2RRgfkuWORT FPNKEMPeriJA2uipuv3tGeIyOs0SakBuHf/KzdLkKnLAejRF8IOts+tLS5/gW33Bd7Kv OwpcPvNxuhWca7Kg1t0H2T7NFovGK0CaabXvGqMKu1NCWDj/+x9LXglfMklaWGGW8/Kg axZw0H/pYBU+CmVZVsbAwMJ5mA2E5FLQIEeI+VziommI6p2vpnc5kki/JAkezkToJomX 1NB5uuBZI2mTBqFRKNkRAD8tUcaXWtSRpPoQfcsg5iu6YHxEe36NCzZTJmcznGHJ92+T 6Ogw== X-Gm-Message-State: ALKqPwcPEdcYLpcrf0t37of0Hmt4q6RQEty3ROR6y6Xyt9+2jnemhpCy P0PpbUO+0ySwSNlMn2YwZFTO276zHwQ= X-Google-Smtp-Source: AB8JxZrPSNMVrcTz0EfWNEgiqReUZRdpGQBKaSaVRep+Cu6XefqL4nN+sW6SRoPcPz/MxR0M/XtVgQ== X-Received: by 2002:a63:9401:: with SMTP id m1-v6mr17231097pge.140.1526945728317; Mon, 21 May 2018 16:35:28 -0700 (PDT) Received: from localhost ([2620:15c:2c4:201:f5a:7eca:440a:3ead]) by smtp.gmail.com with ESMTPSA id t63-v6sm8760732pgb.36.2018.05.21.16.35.26 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 21 May 2018 16:35:26 -0700 (PDT) From: Eric Dumazet To: "David S . Miller" Cc: netdev , Eric Dumazet , Eric Dumazet , Florian Westphal , Pablo Neira Ayuso Subject: [PATCH v2 net] netfilter: provide correct argument to nla_strlcpy() Date: Mon, 21 May 2018 16:35:24 -0700 Message-Id: <20180521233524.66326-1-edumazet@google.com> X-Mailer: git-send-email 2.17.0.441.gb46fe60e1d-goog Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Recent patch forgot to remove nla_data(), upsetting syzkaller a bit. BUG: KASAN: slab-out-of-bounds in nla_strlcpy+0x13d/0x150 lib/nlattr.c:314 Read of size 1 at addr ffff8801ad1f4fdd by task syz-executor189/4509 CPU: 1 PID: 4509 Comm: syz-executor189 Not tainted 4.17.0-rc6+ #62 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 print_address_description+0x6c/0x20b mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430 nla_strlcpy+0x13d/0x150 lib/nlattr.c:314 nfnl_acct_new+0x574/0xc50 net/netfilter/nfnetlink_acct.c:118 nfnetlink_rcv_msg+0xdb5/0xff0 net/netfilter/nfnetlink.c:212 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448 nfnetlink_rcv+0x1fe/0x1ba0 net/netfilter/nfnetlink.c:513 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:639 sock_write_iter+0x35a/0x5a0 net/socket.c:908 call_write_iter include/linux/fs.h:1784 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x64d/0x960 fs/read_write.c:487 vfs_write+0x1f8/0x560 fs/read_write.c:549 ksys_write+0xf9/0x250 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 Fixes: 4e09fc873d92 ("netfilter: prefer nla_strlcpy for dealing with NLA_STRING attributes") Signed-off-by: Eric Dumazet Cc: Florian Westphal Cc: Pablo Neira Ayuso Reported-by: syzbot Acked-by: Florian Westphal --- net/netfilter/nfnetlink_acct.c | 2 +- net/netfilter/nfnetlink_cthelper.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c index 6ddf89183e7b47e6c029b28cf5b524c73a790498..a0e5adf0b3b6ddbcd01f956d25dda01c611a7663 100644 --- a/net/netfilter/nfnetlink_acct.c +++ b/net/netfilter/nfnetlink_acct.c @@ -115,7 +115,7 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl, nfacct->flags = flags; } - nla_strlcpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX); + nla_strlcpy(nfacct->name, tb[NFACCT_NAME], NFACCT_NAME_MAX); if (tb[NFACCT_BYTES]) { atomic64_set(&nfacct->bytes, diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c index fa026b269b3691d5186e28020eb2b08e93dc3679..cb5b5f2077774c29fb987b7f1eb2d75e9efc2fe1 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -150,7 +150,7 @@ nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy, return -EINVAL; nla_strlcpy(expect_policy->name, - nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN); + tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN); expect_policy->max_expected = ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) @@ -235,7 +235,7 @@ nfnl_cthelper_create(const struct nlattr * const tb[], goto err1; nla_strlcpy(helper->name, - nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN); + tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN); size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); if (size > FIELD_SIZEOF(struct nf_conn_help, data)) { ret = -ENOMEM;