From patchwork Mon Apr 24 12:59:14 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Potapenko X-Patchwork-Id: 754231 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3wBRJ92STxz9s8Q for ; Mon, 24 Apr 2017 22:59:37 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="geFV1o5d"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1170462AbdDXM73 (ORCPT ); Mon, 24 Apr 2017 08:59:29 -0400 Received: from mail-wr0-f180.google.com ([209.85.128.180]:34358 "EHLO mail-wr0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1170447AbdDXM7U (ORCPT ); Mon, 24 Apr 2017 08:59:20 -0400 Received: by mail-wr0-f180.google.com with SMTP id z109so91298329wrb.1 for ; Mon, 24 Apr 2017 05:59:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=S+cqblkMCyiRI6uERDzlqPKn0Z02c6F2gaEeBjLjUeo=; b=geFV1o5dKthfQcbp9ds5un4f01f1TmQfv3mhpLD/oNE6wq0xnT3prQmcyy256odE/q btFo5p6a0UDwgPSPVO6PVdAEE7mcqSmGgR4ayRV40E9PXfDk+cflU0sXm7c3mW7C8lXx LmAuHrVjc8M7r0JsbYRbbF3NUIcAEZg6JNMbbUrsU6ex4Iy+VeuQwmdIUswv/XDgpK44 064FkulePUbKBO+syMUoXCBrPePooZVRl8QmDsyMzQ6d4E6esIFq9EuipI4gtgDym2EB aEs+IaFD5EFAcYSe5+A7K4+ix0p+JEAwNRhbyS+DM3+h2Y8DcksNUmzwHohewZQDYjeP w5uQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=S+cqblkMCyiRI6uERDzlqPKn0Z02c6F2gaEeBjLjUeo=; b=sH9YFTdgSPZv4aYypSYrP4q3b7SM+Q3QHqJWtoZVjdTmR05DfGJcrh4/SFAIw0Ybnw KtxxFVncIsvp35emP2vYeW67ap05/8WrKNsKOVtEHM5YwFbV25mrfV0Qw2uCOcub4tFP Jqh+5/3zcuAkMqbol6/jxTBlw384oWI9nK6fI6LOdKGeCrPnAO+hS5xn644lB5TP60d1 NPLVqcWg/HkcYAVDg2phU7NiCQMSo/v33OAw2CP8J1e6yeRnhYaaFsSZBh65VBWpXpJs dqGfHZaMil8/0jkZCTIvrKHmnH8LsKOzKx680wJigXCpFpJd0FmIkd3Oan13Op27+tzT iupA== X-Gm-Message-State: AN3rC/5O/vVDuOUdFSK+CJTS7HByrWNfGn3p6QIMrndPmdLxzH0RP/HG zhkmcSZeJfbSQu0T X-Received: by 10.223.163.212 with SMTP id m20mr5826169wrb.29.1493038758872; Mon, 24 Apr 2017 05:59:18 -0700 (PDT) Received: from glider0.muc.corp.google.com ([100.105.28.21]) by smtp.gmail.com with ESMTPSA id v23sm21848373wra.65.2017.04.24.05.59.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 24 Apr 2017 05:59:17 -0700 (PDT) From: Alexander Potapenko To: dvyukov@google.com, kcc@google.com, edumazet@google.com, davem@davemloft.net, kuznet@ms2.inr.ac.ru Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH v2] net/packet: initialize val in packet_getsockopt() Date: Mon, 24 Apr 2017 14:59:14 +0200 Message-Id: <20170424125914.43270-1-glider@google.com> X-Mailer: git-send-email 2.12.2.816.g2cccc81164-goog Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In the case getsockopt() is called with PACKET_HDRLEN and optlen < 4 |val| remains uninitialized and the syscall may behave differently depending on its value. This doesn't have security consequences (as the uninit bytes aren't copied back), but it's still cleaner to initialize |val| and ensure optlen is not less than sizeof(int). This bug has been detected with KMSAN. Signed-off-by: Alexander Potapenko --- v2: - if len < sizeof(int), make it 0 KMSAN report below: ================================================================== BUG: KMSAN: use of unitialized memory in packet_getsockopt+0xb9b/0xbe0 inter: 0 CPU: 0 PID: 1036 Comm: probe Tainted: G B 4.11.0-rc5+ #2444 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x143/0x1b0 lib/dump_stack.c:52 kmsan_report+0x16b/0x1e0 mm/kmsan/kmsan.c:1078 __kmsan_warning_32+0x5c/0xa0 mm/kmsan/kmsan_instr.c:510 packet_getsockopt+0xb9b/0xbe0 net/packet/af_packet.c:3839 SYSC_getsockopt+0x495/0x540 net/socket.c:1829 SyS_getsockopt+0xb0/0xd0 net/socket.c:1811 entry_SYSCALL_64_fastpath+0x13/0x94 arch/x86/entry/entry_64.S:204 RIP: 0033:0x436d8a RSP: 002b:00007ffce54e52c8 EFLAGS: 00000203 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000436d8a RDX: 000000000000000b RSI: 0000000000000107 RDI: 0000000000000003 RBP: 00007ffce54e52b0 R08: 00007ffce54e52d8 R09: 0000000000000004 R10: 00007ffce54e52d4 R11: 0000000000000203 R12: 00007ffce54e53c8 R13: 00007ffce54e53d8 R14: 0000000000000002 R15: 0000000000000000 origin description: ----val@packet_getsockopt (origin=00000000f6600052) local variable created at: packet_getsockopt+0xcd/0xbe0 net/packet/af_packet.c:3789 SYSC_getsockopt+0x495/0x540 net/socket.c:1829 ================================================================== --- net/packet/af_packet.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 8489beff5c25..dfc762df5da9 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3787,7 +3787,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen) { int len; - int val, lv = sizeof(val); + int val = 0, lv = sizeof(val); struct sock *sk = sock->sk; struct packet_sock *po = pkt_sk(sk); void *data = &val; @@ -3836,6 +3836,8 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, case PACKET_HDRLEN: if (len > sizeof(int)) len = sizeof(int); + if (len < sizeof(int)) + len = 0; if (copy_from_user(&val, optval, len)) return -EFAULT; switch (val) {