Eric Dumazet
4d50e50045
net: flower: fix stack-out-of-bounds in fl_set_key_cfm()
Typical misuse of
nla_parse_nested(array, XXX_MAX, ...);
array must be declared as
struct nlattr *array[XXX_MAX + 1];
v2: Based on feedbacks from Ido Schimmel and Zahari Doychev,
I also changed TCA_FLOWER_KEY_CFM_OPT_MAX and cfm_opt_policy
definitions.
syzbot reported:
BUG: KASAN: stack-out-of-bounds in __nla_validate_parse+0x136/0x2bd0 lib/nlattr.c:588
Write of size 32 at addr ffffc90003a0ee20 by task syz-executor296/5014
CPU: 0 PID: 5014 Comm: syz-executor296 Not tainted 6.5.0-rc2-syzkaller-00307-gd192f5382581 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0x163/0x540 mm/kasan/report.c:475
kasan_report+0x175/0x1b0 mm/kasan/report.c:588
kasan_check_range+0x27e/0x290 mm/kasan/generic.c:187
__asan_memset+0x23/0x40 mm/kasan/shadow.c:84
__nla_validate_parse+0x136/0x2bd0 lib/nlattr.c:588
__nla_parse+0x40/0x50 lib/nlattr.c:700
nla_parse_nested include/net/netlink.h:1262 [inline]
fl_set_key_cfm+0x1e3/0x440 net/sched/cls_flower.c:1718
fl_set_key+0x2168/0x6620 net/sched/cls_flower.c:1884
fl_tmplt_create+0x1fe/0x510 net/sched/cls_flower.c:2666
tc_chain_tmplt_add net/sched/cls_api.c:2959 [inline]
tc_ctl_chain+0x131d/0x1ac0 net/sched/cls_api.c:3068
rtnetlink_rcv_msg+0x82b/0xf50 net/core/rtnetlink.c:6424
netlink_rcv_skb+0x1df/0x430 net/netlink/af_netlink.c:2549
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x7c3/0x990 net/netlink/af_netlink.c:1365
netlink_sendmsg+0xa2a/0xd60 net/netlink/af_netlink.c:1914
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg net/socket.c:748 [inline]
____sys_sendmsg+0x592/0x890 net/socket.c:2494
___sys_sendmsg net/socket.c:2548 [inline]
__sys_sendmsg+0x2b0/0x3a0 net/socket.c:2577
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f54c6150759
Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe06c30578 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f54c619902d RCX: 00007f54c6150759
RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
RBP: 00007ffe06c30590 R08: 0000000000000000 R09: 00007ffe06c305f0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f54c61c35f0
R13: 00007ffe06c30778 R14: 0000000000000001 R15: 0000000000000001
</TASK>
The buggy address belongs to stack of task syz-executor296/5014
and is located at offset 32 in frame:
fl_set_key_cfm+0x0/0x440 net/sched/cls_flower.c:374
This frame has 1 object:
[32, 56) 'nla_cfm_opt'
The buggy address belongs to the virtual mapping at
[ffffc90003a08000, ffffc90003a11000) created by:
copy_process+0x5c8/0x4290 kernel/fork.c:2330
Fixes: 7cfffd5fed ("net: flower: add support for matching cfm fields")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Zahari Doychev <zdoychev@maxlinear.com>
Link: https://lore.kernel.org/r/20230726145815.943910-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-07-27 20:01:29 -07:00
..
2023-01-19 17:14:18 +01:00
2021-12-21 15:09:46 -08:00
2023-06-22 09:44:28 +02:00
2021-09-13 14:51:10 -05:00
2023-05-14 16:05:28 +01:00
2022-11-17 22:49:39 +01:00
2022-09-21 18:42:55 +01:00
2022-06-28 21:26:05 +02:00
2023-06-26 08:05:57 +02:00
2022-06-28 21:26:05 +02:00
2022-06-28 21:26:05 +02:00
2022-06-28 21:26:05 +02:00
2022-08-09 19:51:05 +02:00
2023-04-27 18:49:24 -04:00
2022-06-28 21:26:05 +02:00
2023-05-30 15:20:08 +01:00
2023-03-30 23:24:24 -07:00
2023-07-08 12:08:39 -07:00
2022-04-29 14:38:03 -07:00
2022-11-23 19:55:22 +01:00
2023-06-20 14:28:17 -06:00
2022-05-13 10:56:10 +02:00
2021-11-01 13:36:08 +00:00
2022-11-04 16:56:41 +01:00
2022-08-11 10:31:19 -07:00
2022-12-22 18:18:37 -08:00
2023-03-10 21:05:16 +01:00
2022-10-31 07:29:47 -04:00
2023-05-30 16:42:00 -07:00
2022-12-27 12:52:10 +01:00
2023-01-21 19:01:59 +01:00
2022-06-28 21:26:05 +02:00
2023-06-24 14:52:28 -07:00
2022-06-07 10:20:42 -07:00
2022-12-05 18:00:58 +01:00
2023-04-17 19:52:19 +02:00
2022-05-18 00:11:18 +08:00
2023-06-22 09:44:28 +02:00
2023-06-06 17:05:54 -04:00
2022-05-15 18:31:28 -06:00
2022-09-24 08:50:04 +02:00
2022-09-24 08:50:04 +02:00
2021-11-26 16:48:59 +01:00
2022-06-28 21:26:05 +02:00
2023-04-18 16:39:34 -07:00
2023-06-08 10:11:17 -04:00
2023-04-22 14:41:30 -07:00
2022-01-26 14:49:46 +01:00
2022-06-28 21:26:05 +02:00
2023-01-20 09:33:22 +00:00
2022-12-07 20:09:18 -08:00
2021-10-18 12:28:53 -07:00
2023-03-06 15:49:07 -06:00
2023-03-06 15:49:07 -06:00
2023-03-30 15:57:50 -04:00
2022-06-28 21:26:05 +02:00
2022-06-20 18:21:25 +02:00
2022-08-29 15:32:13 +02:00
2022-06-03 20:09:27 +08:00
2023-06-30 09:37:26 -07:00
2023-06-12 08:50:48 +01:00
2023-01-23 12:44:18 +00:00
2023-06-15 14:55:15 +02:00
2023-03-10 21:05:16 +01:00
2023-04-19 23:39:42 -04:00
2022-11-28 12:46:23 -08:00
2023-02-07 12:53:53 +01:00
2022-04-04 08:55:23 +02:00
2023-05-25 13:16:57 +02:00
2022-06-28 21:26:05 +02:00
2023-06-06 07:54:00 +09:00
2023-03-16 21:20:32 -07:00
2022-06-28 21:26:05 +02:00
2022-12-01 19:58:50 -08:00
2022-02-21 19:38:17 +10:30
2022-02-17 09:09:37 +01:00
2023-06-07 16:26:33 +02:00
2021-10-07 13:51:11 +02:00
2022-08-10 13:49:50 +01:00
2022-05-04 11:06:13 +02:00
2023-03-29 10:50:48 +02:00
2022-03-11 08:28:05 -08:00
2023-05-24 22:05:24 -07:00
2022-09-20 11:53:32 +01:00
2023-03-10 21:05:16 +01:00
2022-02-18 13:08:18 +00:00
2021-11-15 07:53:10 -08:00
2021-11-15 07:53:10 -08:00
2023-04-12 23:18:45 +05:30
2022-02-18 21:20:06 -08:00
2022-10-28 12:36:34 +08:00
2022-06-28 21:26:05 +02:00
2023-04-21 08:25:50 +01:00
2022-09-15 09:08:09 +02:00
2023-05-13 17:02:33 +01:00
2022-08-18 20:37:35 -07:00
2023-07-25 20:10:05 -07:00
2022-06-28 21:26:05 +02:00
2022-12-12 09:29:56 +00:00
2022-03-11 08:28:27 -08:00
2022-06-28 21:26:05 +02:00
2023-05-23 15:38:59 +02:00
2022-06-28 21:26:05 +02:00
2022-06-28 21:26:05 +02:00
2022-11-22 17:50:36 -08:00
2022-07-17 07:52:46 -07:00
2023-06-28 16:09:41 -06:00
2022-02-04 20:24:45 -08:00
2023-01-06 19:22:53 -08:00
2022-02-28 13:25:48 +01:00
2022-11-30 20:16:49 -04:00
2023-06-16 12:04:30 -04:00
2022-06-28 21:26:05 +02:00
2023-02-06 09:01:00 +00:00
2022-10-17 09:51:26 -05:00
2021-10-05 06:54:16 -05:00
2023-03-30 14:06:56 -06:00
2022-06-28 21:26:05 +02:00
2023-03-16 15:18:02 +01:00
2022-06-28 21:26:05 +02:00
2022-06-28 21:26:05 +02:00
2023-01-19 16:28:57 +01:00
2022-06-03 20:09:27 +08:00
2023-06-15 11:37:55 -04:00
2023-06-09 12:34:45 -04:00
2023-07-01 07:07:55 -04:00
2022-09-20 09:13:38 +02:00
2023-02-21 18:15:59 +01:00
2022-05-25 09:51:36 -07:00
2022-07-08 10:46:53 -07:00
2022-05-10 06:30:05 -06:00
2022-08-29 10:44:08 +02:00
2022-08-02 12:34:03 -04:00
2021-10-21 23:36:28 +02:00
2022-02-09 12:00:11 +00:00
2023-05-24 09:13:22 -07:00
2023-01-04 14:59:25 +01:00
2023-05-25 16:21:22 +02:00
2023-03-23 17:25:46 +01:00
2023-03-23 17:25:46 +01:00
2023-01-07 11:29:29 +01:00
2023-01-18 17:12:37 -08:00
2021-09-03 09:58:17 -07:00
2022-06-28 21:26:05 +02:00
2023-06-09 16:25:16 -07:00
2022-01-11 18:45:02 -08:00
2023-05-19 04:30:22 +02:00
2023-06-21 22:45:57 -07:00
2022-02-19 16:05:54 +00:00
2023-04-27 19:15:11 -06:00
2022-06-28 21:26:05 +02:00
2022-11-03 20:46:32 -07:00
2022-06-28 21:26:05 +02:00
2022-12-08 19:49:21 -08:00
2023-03-16 21:20:32 -07:00
2022-09-07 16:46:03 +02:00
2022-11-18 18:36:54 -08:00
2021-12-27 14:58:37 +00:00
2022-02-25 18:50:12 -05:00
2022-03-13 12:59:35 -04:00
2021-09-14 11:11:20 +02:00
2021-10-21 17:25:17 +02:00
2023-06-21 14:01:29 +02:00
2022-05-20 06:17:33 -06:00
2022-02-27 10:58:04 -08:00
2023-06-12 09:46:30 +01:00
2023-03-23 12:22:19 +09:00
2023-05-31 16:34:38 -05:00
2023-02-07 11:52:00 +00:00
2021-12-23 09:32:51 +01:00
2021-12-27 17:12:58 +01:00
2023-07-27 20:01:29 -07:00
2023-05-31 10:00:30 +01:00
2023-06-07 14:26:09 -06:00
2022-12-01 03:22:20 +00:00
2023-06-08 07:16:53 -07:00
2023-01-06 17:12:39 +00:00
2023-03-21 11:37:32 +01:00
2023-06-20 09:02:33 +01:00
2023-04-16 14:23:07 +02:00
2022-06-28 21:26:05 +02:00
2022-02-17 09:09:38 +01:00
2021-12-10 17:10:55 -08:00
2022-05-09 14:00:07 +02:00
2022-09-24 08:31:54 +02:00
2022-06-28 21:26:05 +02:00
2023-01-06 19:28:01 -08:00
2022-03-13 11:49:53 -05:00
2022-12-27 12:52:12 +01:00
2022-03-23 19:58:40 +01:00
2023-03-16 21:25:45 -07:00
2023-03-09 11:31:44 +01:00
2022-05-03 14:11:58 -07:00
2023-04-19 14:07:13 -06:00
2022-08-03 16:29:08 -07:00
2022-09-20 12:33:22 +02:00
2022-06-28 21:26:05 +02:00
2023-02-08 13:10:15 +01:00
2023-01-19 15:01:20 +01:00
2022-11-03 03:43:05 +01:00
2023-03-21 15:43:19 +01:00
2022-02-02 07:42:41 -08:00
2022-07-18 11:19:17 +01:00
2023-01-26 10:52:18 +01:00
2022-06-01 16:48:05 -07:00
2022-01-08 17:41:00 +09:00
2022-09-11 19:47:04 -05:00
2022-03-31 13:04:44 -07:00
2022-06-28 21:26:05 +02:00
2022-11-09 14:06:51 +01:00
2023-03-28 13:39:02 -07:00
2022-06-30 13:14:35 +02:00
2023-03-24 16:59:09 -04:00
2023-04-18 16:39:34 -07:00
2022-10-28 10:47:42 +01:00
2022-11-17 11:04:23 -08:00
2022-04-26 10:17:03 +02:00
2022-02-03 19:50:49 +01:00
2022-04-06 13:48:02 +01:00
2022-09-27 17:29:09 -07:00
2023-06-15 13:41:53 +02:00
2022-06-27 16:25:41 +02:00
2023-06-05 09:36:35 +02:00
2023-06-04 08:34:14 -06:00
2022-06-28 21:26:05 +02:00
2022-08-31 09:07:53 +02:00
2023-03-29 06:52:09 -04:00
2023-04-05 19:42:48 -07:00
2023-03-23 17:25:46 +01:00
2023-01-15 23:45:15 +02:00
2022-12-07 17:58:46 +01:00
2023-06-09 16:13:01 +01:00
2022-12-07 17:58:46 +01:00
2022-12-07 17:58:46 +01:00
2023-04-15 08:58:41 +01:00
2022-12-28 05:09:46 -05:00
2022-08-11 04:26:08 -04:00
2022-07-11 09:54:37 +02:00
2023-06-30 15:22:09 -07:00
2023-07-03 12:15:14 -04:00
2023-07-03 12:15:14 -04:00
2023-06-09 16:14:40 +01:00
2022-06-28 21:26:05 +02:00
2023-04-04 11:01:57 -04:00
2022-12-12 14:19:23 -08:00
2023-04-21 03:02:35 -04:00
2022-03-28 16:52:58 -04:00
2021-11-04 16:36:54 +01:00
2021-09-29 09:22:29 +02:00
2021-11-01 05:26:48 -04:00
2022-05-10 07:22:28 -04:00
2021-12-06 15:03:05 +01:00
2021-11-10 15:32:38 +01:00
2023-03-13 16:32:16 -07:00
2022-08-11 04:06:40 -04:00
2021-08-26 22:28:03 +02:00
2022-08-16 01:40:24 -04:00
2021-09-05 16:23:09 -04:00
2021-10-08 16:21:53 +01:00
2023-05-28 19:07:48 -06:00
2022-12-05 10:30:47 +01:00