[5.10,27/86] netlink: reset network and mac headers in netlink_dump()

From: Eric Dumazet <edumazet@google.com>

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 99c07327ae11e24886d552dddbe4537bfca2765d ]

netlink_dump() is allocating an skb, reserves space in it
but forgets to reset network header.

This allows a BPF program, invoked later from sk_filter()
to access uninitialized kernel memory from the reserved
space.

Theorically mac header reset could be omitted, because
it is set to a special initial value.
bpf_internal_load_pointer_neg_helper calls skb_mac_header()
without checking skb_mac_header_was_set().
Relying on skb->len not being too big seems fragile.
We also could add a sanity check in bpf_internal_load_pointer_neg_helper()
to avoid surprises in the future.

syzbot report was:

BUG: KMSAN: uninit-value in ___bpf_prog_run+0xa22b/0xb420 kernel/bpf/core.c:1637
 ___bpf_prog_run+0xa22b/0xb420 kernel/bpf/core.c:1637
 __bpf_prog_run32+0x121/0x180 kernel/bpf/core.c:1796
 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline]
 __bpf_prog_run include/linux/filter.h:626 [inline]
 bpf_prog_run include/linux/filter.h:633 [inline]
 __bpf_prog_run_save_cb+0x168/0x580 include/linux/filter.h:756
 bpf_prog_run_save_cb include/linux/filter.h:770 [inline]
 sk_filter_trim_cap+0x3bc/0x8c0 net/core/filter.c:150
 sk_filter include/linux/filter.h:905 [inline]
 netlink_dump+0xe0c/0x16c0 net/netlink/af_netlink.c:2276
 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002
 sock_recvmsg_nosec net/socket.c:948 [inline]
 sock_recvmsg net/socket.c:966 [inline]
 sock_read_iter+0x5a9/0x630 net/socket.c:1039
 do_iter_readv_writev+0xa7f/0xc70
 do_iter_read+0x52c/0x14c0 fs/read_write.c:786
 vfs_readv fs/read_write.c:906 [inline]
 do_readv+0x432/0x800 fs/read_write.c:943
 __do_sys_readv fs/read_write.c:1034 [inline]
 __se_sys_readv fs/read_write.c:1031 [inline]
 __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was stored to memory at:
 ___bpf_prog_run+0x96c/0xb420 kernel/bpf/core.c:1558
 __bpf_prog_run32+0x121/0x180 kernel/bpf/core.c:1796
 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline]
 __bpf_prog_run include/linux/filter.h:626 [inline]
 bpf_prog_run include/linux/filter.h:633 [inline]
 __bpf_prog_run_save_cb+0x168/0x580 include/linux/filter.h:756
 bpf_prog_run_save_cb include/linux/filter.h:770 [inline]
 sk_filter_trim_cap+0x3bc/0x8c0 net/core/filter.c:150
 sk_filter include/linux/filter.h:905 [inline]
 netlink_dump+0xe0c/0x16c0 net/netlink/af_netlink.c:2276
 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002
 sock_recvmsg_nosec net/socket.c:948 [inline]
 sock_recvmsg net/socket.c:966 [inline]
 sock_read_iter+0x5a9/0x630 net/socket.c:1039
 do_iter_readv_writev+0xa7f/0xc70
 do_iter_read+0x52c/0x14c0 fs/read_write.c:786
 vfs_readv fs/read_write.c:906 [inline]
 do_readv+0x432/0x800 fs/read_write.c:943
 __do_sys_readv fs/read_write.c:1034 [inline]
 __se_sys_readv fs/read_write.c:1031 [inline]
 __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:737 [inline]
 slab_alloc_node mm/slub.c:3244 [inline]
 __kmalloc_node_track_caller+0xde3/0x14f0 mm/slub.c:4972
 kmalloc_reserve net/core/skbuff.c:354 [inline]
 __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
 alloc_skb include/linux/skbuff.h:1158 [inline]
 netlink_dump+0x30f/0x16c0 net/netlink/af_netlink.c:2242
 netlink_recvmsg+0x1129/0x1c80 net/netlink/af_netlink.c:2002
 sock_recvmsg_nosec net/socket.c:948 [inline]
 sock_recvmsg net/socket.c:966 [inline]
 sock_read_iter+0x5a9/0x630 net/socket.c:1039
 do_iter_readv_writev+0xa7f/0xc70
 do_iter_read+0x52c/0x14c0 fs/read_write.c:786
 vfs_readv fs/read_write.c:906 [inline]
 do_readv+0x432/0x800 fs/read_write.c:943
 __do_sys_readv fs/read_write.c:1034 [inline]
 __se_sys_readv fs/read_write.c:1031 [inline]
 __x64_sys_readv+0xe5/0x120 fs/read_write.c:1031
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU: 0 PID: 3470 Comm: syz-executor751 Not tainted 5.17.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: db65a3aaf29e ("netlink: Trim skb to alloc size to avoid MSG_TRUNC")
Fixes: 9063e21fb026 ("netlink: autosize skb lengthes")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20220415181442.551228-1-eric.dumazet@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netlink/af_netlink.c | 7 +++++++
 1 file changed, 7 insertions(+)

Message ID	20220426081741.993715405@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>, syzbot <syzkaller@googlegroups.com>, Paolo Abeni <pabeni@redhat.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 27/86] netlink: reset network and mac headers in netlink_dump() Date: Tue, 26 Apr 2022 10:20:55 +0200 Message-Id: <20220426081741.993715405@linuxfoundation.org> In-Reply-To: <20220426081741.202366502@linuxfoundation.org> References: <20220426081741.202366502@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,02/86] mm: page_alloc: fix building error on -Werror=array-compare [5.10,03/86] tracing: Dump stacktrace trigger to the corresponding instance [5.10,04/86] perf tools: Fix segfault accessing sample_id xyarray [5.10,05/86] gfs2: assign rgrp glock before compute_bitstructs [5.10,06/86] net/sched: cls_u32: fix netns refcount changes in u32_change() [5.10,07/86] ALSA: usb-audio: Clear MIDI port active flag after draining [5.10,08/86] ALSA: hda/realtek: Add quirk for Clevo NP70PNP [5.10,09/86] dm: fix mempool NULL pointer race when completing IO [5.10,10/86] ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek [5.10,11/86] ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component [5.10,12/86] ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use [5.10,13/86] dmaengine: imx-sdma: Fix error checking in sdma_event_remap [5.10,14/86] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources [5.10,15/86] spi: spi-mtk-nor: initialize spi controller after resume [5.10,16/86] esp: limit skb_page_frag_refill use to a single page [5.10,17/86] igc: Fix infinite loop in release_swfw_sync [5.10,18/86] igc: Fix BUG: scheduling while atomic [5.10,19/86] rxrpc: Restore removed timer deletion [5.10,20/86] net/smc: Fix sock leak when release after smc_shutdown() [5.10,21/86] net/packet: fix packet_sock xmit return value checking [5.10,22/86] ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() [5.10,23/86] ip6_gre: Fix skb_under_panic in __gre6_xmit() [5.10,24/86] net/sched: cls_u32: fix possible leak in u32_init_knode() [5.10,25/86] l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper... [5.10,26/86] ipv6: make ip6_rt_gc_expire an atomic_t [5.10,27/86] netlink: reset network and mac headers in netlink_dump() [5.10,28/86] net: stmmac: Use readl_poll_timeout_atomic() in atomic state [5.10,29/86] dmaengine: idxd: add RO check for wq max_batch_size write [5.10,30/86] dmaengine: idxd: add RO check for wq max_transfer_size write [5.10,31/86] selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets [5.10,32/86] arm64/mm: Remove [PUD\|PMD]_TABLE_BIT from [pud\|pmd]_bad() [5.10,33/86] arm64: mm: fix p?d_leaf() [5.10,34/86] ARM: vexpress/spc: Avoid negative array index when !SMP [5.10,35/86] reset: tegra-bpmp: Restore Handle errors in BPMP response [5.10,36/86] platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative [5.10,37/86] ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant [5.10,38/86] arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes [5.10,39/86] vxlan: fix error return code in vxlan_fdb_append [5.10,40/86] cifs: Check the IOCB_DIRECT flag, not O_DIRECT [5.10,41/86] net: atlantic: Avoid out-of-bounds indexing [5.10,42/86] mt76: Fix undefined behavior due to shift overflowing the constant [5.10,43/86] brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant [5.10,44/86] dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() [5.10,45/86] drm/msm/mdp5: check the return of kzalloc() [5.10,46/86] net: macb: Restart tx only if queue pointer is lagging [5.10,47/86] scsi: qedi: Fix failed disconnect handling [5.10,48/86] stat: fix inconsistency between struct stat and struct compat_stat [5.10,49/86] nvme: add a quirk to disable namespace identifiers [5.10,50/86] nvme-pci: disable namespace identifiers for Qemu controllers [5.10,51/86] EDAC/synopsys: Read the error count from the correct register [5.10,52/86] mm, hugetlb: allow for "high" userspace addresses [5.10,53/86] oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup [5.10,54/86] mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() [5.10,55/86] ata: pata_marvell: Check the bmdma_addr beforing reading [5.10,56/86] dma: at_xdmac: fix a missing check on list iterator [5.10,57/86] net: atlantic: invert deep par in pm functions, preventing null derefs [5.10,58/86] xtensa: patch_text: Fixup last cpu should be master [5.10,59/86] xtensa: fix a7 clobbering in coprocessor context load/store [5.10,60/86] openvswitch: fix OOB access in reserve_sfa_size() [5.10,61/86] gpio: Request interrupts after IRQ is initialized [5.10,62/86] ASoC: soc-dapm: fix two incorrect uses of list iterator [5.10,63/86] e1000e: Fix possible overflow in LTR decoding [5.10,64/86] ARC: entry: fix syscall_trace_exit argument [5.10,65/86] arm_pmu: Validate single/group leader events [5.10,66/86] sched/pelt: Fix attach_entity_load_avg() corner case [5.10,67/86] perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled [5.10,68/86] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised [5.10,69/86] drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare [5.10,70/86] KVM: PPC: Fix TCE handling for VFIO [5.10,71/86] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage [5.10,72/86] powerpc/perf: Fix power9 event alternatives [5.10,73/86] perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event [5.10,74/86] ext4: fix fallocate to use file_modified to update permissions consistently [5.10,75/86] ext4: fix symlink file size not match to file content [5.10,76/86] ext4: fix use-after-free in ext4_search_dir [5.10,77/86] ext4: limit length to bitmap_maxbytes - blocksize in punch_hole [5.10,78/86] ext4, doc: fix incorrect h_reserved size [5.10,79/86] ext4: fix overhead calculation to account for the reserved gdt blocks [5.10,80/86] ext4: force overhead calculation if the s_overhead_cluster makes no sense [5.10,81/86] can: isotp: stop timeout monitoring when no first frame was sent [5.10,82/86] jbd2: fix a potential race while discarding reserved buffers after an abort [5.10,83/86] spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller [5.10,84/86] staging: ion: Prevent incorrect reference counting behavour [5.10,85/86] block/compat_ioctl: fix range check in BLKGETSIZE [5.10,86/86] Revert "net: micrel: fix KS8851_MLL Kconfig"

[5.10,27/86] netlink: reset network and mac headers in netlink_dump()

Commit Message

Patch