Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1680430

[PATCH 3.18 06/36] decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mateusz Jurczyk <mjurczyk@google.com>


[ Upstream commit dd0da17b209ed91f39872766634ca967c170ada1 ]

Verify that the length of the socket buffer is sufficient to cover the
nlmsghdr structure before accessing the nlh->nlmsg_len field for further
input sanitization. If the client only supplies 1-3 bytes of data in
sk_buff, then nlh->nlmsg_len remains partially uninitialized and
contains leftover memory from the corresponding kernel allocation.
Operating on such data may result in indeterminate evaluation of the
nlmsg_len < sizeof(*nlh) expression.

The bug was discovered by a runtime instrumentation designed to detect
use of uninitialized memory in the kernel. The patch prevents this and
other similar tools (e.g. KMSAN) from flagging this behavior in the future.

Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/decnet/netfilter/dn_rtmsg.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -104,7 +104,9 @@ static inline void dnrmg_receive_user_sk
 {
 	struct nlmsghdr *nlh = nlmsg_hdr(skb);
 
-	if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
+	if (skb->len < sizeof(*nlh) ||
+	    nlh->nlmsg_len < sizeof(*nlh) ||
+	    skb->len < nlh->nlmsg_len)
 		return;
 
 	if (!netlink_capable(skb, CAP_NET_ADMIN))

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/36] 3.18.60-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 15/36] arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 34/36] cpufreq: s3c2416: double free on driver init error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 18/36] MIPS: Fix IRQ tracing & lockdep when rescheduling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  [PATCH 3.18 25/36] net: korina: Fix NAPI versus resources freeing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
  Re: [PATCH 3.18 14/36] NFSv4: fix a reference leak caused WARNING  messages Trond Myklebust <trondmy@primarydata.com> - 2017-07-03 16:40 +0200
    Re: [PATCH 3.18 14/36] NFSv4: fix a reference leak caused WARNING  messages "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
  [PATCH 3.18 28/36] xfrm: NULL dereference on allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 31/36] ARM: 8685/1: ensure memblock-limit is pmd-aligned Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 11/36] ipv6: fix calling in6_ifa_hold incorrectly for dad work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 32/36] iommu/vt-d: Dont over-free page table directories Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 06/36] decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 27/36] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 05/36] net: dont call strlen on non-terminated string in dev_set_alias() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 29/36] xfrm: Oops on error in pfkey_msg2xfrm_state() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 07/36] Fix an intermittent pr_emerg warning about lo becoming free. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 20/36] drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 16/36] MIPS: Avoid accidental raw backtrace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 14/36] NFSv4: fix a reference leak caused WARNING messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 08/36] net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 30/36] watchdog: bcm281xx: Fix use of uninitialized spinlock. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  [PATCH 3.18 17/36] MIPS: pm-cps: Drop manual cache-line alignment of ready_count Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
  Re: [PATCH 3.18 00/36] 3.18.60-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-03 21:40 +0200

csiph-web