Vakul Garg 5c1e7e94a7 Prevent overflow of sk_msg in sk_msg_clone() ... Fixed function sk_msg_clone() to prevent overflow of 'dst' while adding pages in scatterlist entries. The overflow of 'dst' causes crash in kernel tls module while doing record encryption. Crash fixed by this patch. [ 78.796119] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [ 78.804900] Mem abort info: [ 78.807683] ESR = 0x96000004 [ 78.810744] Exception class = DABT (current EL), IL = 32 bits [ 78.816677] SET = 0, FnV = 0 [ 78.819727] EA = 0, S1PTW = 0 [ 78.822873] Data abort info: [ 78.825759] ISV = 0, ISS = 0x00000004 [ 78.829600] CM = 0, WnR = 0 [ 78.832576] user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000bf8ee311 [ 78.839195] [0000000000000008] pgd=0000000000000000 [ 78.844081] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 78.849642] Modules linked in: tls xt_conntrack ipt_REJECT nf_reject_ipv4 ip6table_filter ip6_tables xt_CHECKSUM cpve cpufreq_conservative lm90 ina2xx crct10dif_ce [ 78.865377] CPU: 0 PID: 6007 Comm: openssl Not tainted 4.20.0-rc6-01647-g754d5da63145-dirty #107 [ 78.874149] Hardware name: LS1043A RDB Board (DT) [ 78.878844] pstate: 60000005 (nZCv daif -PAN -UAO) [ 78.883632] pc : scatterwalk_copychunks+0x164/0x1c8 [ 78.888500] lr : scatterwalk_copychunks+0x160/0x1c8 [ 78.893366] sp : ffff00001d04b600 [ 78.896668] x29: ffff00001d04b600 x28: ffff80006814c680 [ 78.901970] x27: 0000000000000000 x26: ffff80006c8de786 [ 78.907272] x25: ffff00001d04b760 x24: 000000000000001a [ 78.912573] x23: 0000000000000006 x22: ffff80006814e440 [ 78.917874] x21: 0000000000000100 x20: 0000000000000000 [ 78.923175] x19: 000081ffffffffff x18: 0000000000000400 [ 78.928476] x17: 0000000000000008 x16: 0000000000000000 [ 78.933778] x15: 0000000000000100 x14: 0000000000000001 [ 78.939079] x13: 0000000000001080 x12: 0000000000000020 [ 78.944381] x11: 0000000000001080 x10: 00000000ffff0002 [ 78.949683] x9 : ffff80006814c248 x8 : 00000000ffff0000 [ 78.954985] x7 : ffff80006814c318 x6 : ffff80006c8de786 [ 78.960286] x5 : 0000000000000f80 x4 : ffff80006c8de000 [ 78.965588] x3 : 0000000000000000 x2 : 0000000000001086 [ 78.970889] x1 : ffff7e0001b74e02 x0 : 0000000000000000 [ 78.976192] Process openssl (pid: 6007, stack limit = 0x00000000291367f9) [ 78.982968] Call trace: [ 78.985406] scatterwalk_copychunks+0x164/0x1c8 [ 78.989927] skcipher_walk_next+0x28c/0x448 [ 78.994099] skcipher_walk_done+0xfc/0x258 [ 78.998187] gcm_encrypt+0x434/0x4c0 [ 79.001758] tls_push_record+0x354/0xa58 [tls] [ 79.006194] bpf_exec_tx_verdict+0x1e4/0x3e8 [tls] [ 79.010978] tls_sw_sendmsg+0x650/0x780 [tls] [ 79.015326] inet_sendmsg+0x2c/0xf8 [ 79.018806] sock_sendmsg+0x18/0x30 [ 79.022284] __sys_sendto+0x104/0x138 [ 79.025935] __arm64_sys_sendto+0x24/0x30 [ 79.029936] el0_svc_common+0x60/0xe8 [ 79.033588] el0_svc_handler+0x2c/0x80 [ 79.037327] el0_svc+0x8/0xc [ 79.040200] Code: 6b01005f 54fff788 940169b1 f9000320 (b9400801) [ 79.046283] ---[ end trace 74db007d069c1cf7 ]--- Fixes: d829e9c411 ("tls: convert to generic sk_msg interface") Signed-off-by: Vakul Garg <vakul.garg@nxp.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-12-21 09:12:49 -08:00
..
6lowpan
9p	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-03 10:35:52 -07:00
802
8021q	netpoll: allow cleanup to be synchronous	2018-10-19 17:01:43 -07:00
appletalk
atm	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
ax25
batman-adv	batman-adv: Expand merged fragment buffer for full packet	2018-11-12 10:41:29 +01:00
bluetooth	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
bpf	bpf: refactor bpf_test_run() to separate own failures and test program result	2018-12-01 12:33:58 -08:00
bpfilter	net: bpfilter: Set user mode helper's command line	2018-10-22 19:37:36 -07:00
bridge	net: bridge: fix vlan stats use-after-free on destruction	2018-11-17 21:38:44 -08:00
caif	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
can	net: add missing SOF_TIMESTAMPING_OPT_ID support	2018-12-17 23:27:00 -08:00
ceph	libceph: fall back to sendmsg for slab pages	2018-11-19 17:59:47 +01:00
core	Prevent overflow of sk_msg in sk_msg_clone()	2018-12-21 09:12:49 -08:00
dcb
dccp	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
decnet
dns_resolver	dns: Allow the dns resolver to retrieve a server set	2018-10-04 09:40:52 -07:00
dsa	net: dsa: Fix tagging attribute location	2018-11-30 17:17:39 -08:00
ethernet
hsr
ieee802154
ife
ipv4	tcp: fix a race in inet_diag_dump_icsk()	2018-12-20 19:23:22 -08:00
ipv6	ipv6: frags: Fix bogus skb->sk in reassembled packets	2018-12-20 16:31:36 -08:00
iucv	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
kcm
key
l2tp	l2tp: fix a sock refcnt leak in l2tp_tunnel_register	2018-11-14 22:49:31 -08:00
l3mdev
lapb
llc	llc: do not use sk_eat_skb()	2018-10-22 19:59:20 -07:00
mac80211	mac80211: free skb fraglist before freeing the skb	2018-12-19 09:40:17 +01:00
mac802154	mac802154: Remove VLA usage of skcipher	2018-09-28 12:46:07 +08:00
mpls	net/mpls: Handle kernel side filtering of route dumps	2018-10-16 00:14:07 -07:00
ncsi	net/ncsi: Add NCSI Broadcom OEM command	2018-10-17 22:14:54 -07:00
netfilter	netfilter: nf_conncount: use rb_link_node_rcu() instead of rb_link_node()	2018-12-13 01:14:58 +01:00
netlabel
netlink	net: netlink: rename NETLINK_DUMP_STRICT_CHK -> NETLINK_GET_STRICT_CHK	2018-12-14 11:44:31 -08:00
netrom
nfc	Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-10-24 14:43:41 +01:00
nsh
openvswitch	openvswitch: fix spelling mistake "execeeds" -> "exceeds"	2018-11-30 13:18:09 -08:00
packet	packet: validate address length	2018-12-21 09:11:25 -08:00
phonet
psample
qrtr
rds	rds: Fix warning.	2018-12-19 20:53:18 -08:00
rfkill
rose
rxrpc	rxrpc: Fix life check	2018-11-15 11:35:40 -08:00
sched	net/sched: cls_flower: Remove old entries from rhashtable	2018-12-19 16:36:55 -08:00
sctp	sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event	2018-12-10 11:53:42 -08:00
smc	net/smc: fix TCP fallback socket release	2018-12-18 22:02:51 -08:00
strparser	bpf, sockmap: convert to generic sk_msg interface	2018-10-15 12:23:19 -07:00
sunrpc	SUNRPC: Remove xprt_connect_status()	2018-12-18 11:04:10 -05:00
switchdev
tipc	tipc: check group dests after tipc_wait_for_cond()	2018-12-18 15:44:23 -08:00
tls	net/tls: allocate tls context using GFP_ATOMIC	2018-12-19 16:28:50 -08:00
unix	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
vmw_vsock	VSOCK: Send reset control packet when socket is partially bound	2018-12-18 11:53:42 -08:00
wimax
wireless	nl80211: fix memory leak if validate_pae_over_nl80211() fails	2018-12-19 09:40:17 +01:00
x25	net/x25: handle call collisions	2018-11-29 14:25:36 -08:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-19 11:03:06 -07:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2018-12-18 11:43:26 -08:00
compat.c
Kconfig	bpf, sockmap: convert to generic sk_msg interface	2018-10-15 12:23:19 -07:00
Makefile
socket.c	socket: do a generic_file_splice_read when proto_ops has no splice_read	2018-11-17 21:34:11 -08:00
sysctl_net.c