From patchwork Wed Apr 19 21:19:43 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Ahern X-Patchwork-Id: 752504 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3w7Zdn62JMz9s3s for ; Thu, 20 Apr 2017 07:19:57 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b="F5t8CEXm"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S969592AbdDSVTz (ORCPT ); Wed, 19 Apr 2017 17:19:55 -0400 Received: from mail-io0-f177.google.com ([209.85.223.177]:35584 "EHLO mail-io0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S967679AbdDSVTw (ORCPT ); Wed, 19 Apr 2017 17:19:52 -0400 Received: by mail-io0-f177.google.com with SMTP id r16so37217984ioi.2 for ; Wed, 19 Apr 2017 14:19:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=from:to:cc:subject:date:message-id; bh=8GI36eWRiaVkUNvyK5INBVhRNaGZpEXDAyynxepB6Q0=; b=F5t8CEXmAQoZLahBprlMBf3FAfy+w+h/eETZsbAtO52NxQTZSHLihb2idr15qnev1f P1ozTqyQb2VfVlPOorEP/xOBSb039zw1g6eTYoai7HvTavWcZxGjL55IHDOkS93ibewd +RRnttqtBqcbhRPyIcvLaN8g2SCoDkiAv3Z/E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=8GI36eWRiaVkUNvyK5INBVhRNaGZpEXDAyynxepB6Q0=; b=SdkxoU04VWyFZxPF4i7J3KtrrMwWCR1vLGVwBNRjidd5y3uaCW1fC4X7bdSyXMApS2 E+GBTgqeN8L+XrqTIeAWUXq3X+zFlRz1hec0K0w0G3CHz+TZcXZ+G6/N7NZgXaRuxnnW tuip4WFUsuRM3KhTUjJ2OnwTW8E+wiJQ4GnMhvxzBKBV8sC6Z751bwA9w3OE77hZbWKP r1MK26yiQnZ1+yyXI8XVtfDXO6+60hFsSHG90i0goGdGD+mhkhnKeR3ZEQto6V4QZzDl 9QBu7qAn8BcZNGSyYF+6vqUxqoab4PO/8hjx1R9gJmCElVK4xMb2KrW4lFVdG4E7hhaZ oXMQ== X-Gm-Message-State: AN3rC/79GP7Xd8piL0W+rQJVFGT32c0CAxo7sp/EE5P0T3avkAo1heG9 chtGx+WgPzB19c+q X-Received: by 10.99.99.2 with SMTP id x2mr4810649pgb.46.1492636789558; Wed, 19 Apr 2017 14:19:49 -0700 (PDT) Received: from kenny.it.cumulusnetworks.com. ([216.129.126.126]) by smtp.googlemail.com with ESMTPSA id q5sm6225069pgn.59.2017.04.19.14.19.48 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 19 Apr 2017 14:19:48 -0700 (PDT) From: David Ahern To: netdev@vger.kernel.org Cc: kafai@fb.com, andreyknvl@google.com, David Ahern Subject: [PATCH net] net: ipv6: RTF_PCPU should not be settable from userspace Date: Wed, 19 Apr 2017 14:19:43 -0700 Message-Id: <1492636783-29756-1-git-send-email-dsa@cumulusnetworks.com> X-Mailer: git-send-email 2.1.4 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Andrey reported a fault in the IPv6 route code: kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Modules linked in: CPU: 1 PID: 4035 Comm: a.out Not tainted 4.11.0-rc7+ #250 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880069809600 task.stack: ffff880062dc8000 RIP: 0010:ip6_rt_cache_alloc+0xa6/0x560 net/ipv6/route.c:975 RSP: 0018:ffff880062dced30 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff8800670561c0 RCX: 0000000000000006 RDX: 0000000000000003 RSI: ffff880062dcfb28 RDI: 0000000000000018 RBP: ffff880062dced68 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff880062dcfb28 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007feebe37e7c0(0000) GS:ffff88006cb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000205a0fe4 CR3: 000000006b5c9000 CR4: 00000000000006e0 Call Trace: ip6_pol_route+0x1512/0x1f20 net/ipv6/route.c:1128 ip6_pol_route_output+0x4c/0x60 net/ipv6/route.c:1212 ... Andrey's syzkaller program passes rtmsg.rtmsg_flags with the RTF_PCPU bit set. Flags passed to the kernel are blindly copied to the allocated rt6_info by ip6_route_info_create making a newly inserted route appear as though it is a per-cpu route. ip6_rt_cache_alloc sees the flag set and expects rt->dst.from to be set - which it is not since it is not really a per-cpu copy. The subsequent call to __ip6_dst_alloc then generates the fault. Fix by checking for the flag and failing with EINVAL. Fixes: d52d3997f843f ("ipv6: Create percpu rt6_info") Reported-by: Andrey Konovalov Signed-off-by: David Ahern Acked-by: Martin KaFai Lau Tested-by: Andrey Konovalov --- include/uapi/linux/ipv6_route.h | 2 +- net/ipv6/route.c | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/ipv6_route.h b/include/uapi/linux/ipv6_route.h index 85bbb1799df3..d496c02e14bc 100644 --- a/include/uapi/linux/ipv6_route.h +++ b/include/uapi/linux/ipv6_route.h @@ -35,7 +35,7 @@ #define RTF_PREF(pref) ((pref) << 27) #define RTF_PREF_MASK 0x18000000 -#define RTF_PCPU 0x40000000 +#define RTF_PCPU 0x40000000 /* read-only: can not be set by user */ #define RTF_LOCAL 0x80000000 diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 4ba7c49872ff..a1bf426c959b 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1854,6 +1854,10 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg) int addr_type; int err = -EINVAL; + /* RTF_PCPU is an internal flag; can not be set by userspace */ + if (cfg->fc_flags & RTF_PCPU) + goto out; + if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128) goto out; #ifndef CONFIG_IPV6_SUBTREES