Kuniyuki Iwashima
dbc9b22d0e
arp: Prevent overflow in arp_req_get(). ...
commit a7d6027790acea24446ddd6632d394096c0f4667 upstream.
syzkaller reported an overflown write in arp_req_get(). [0]
When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour
entry and copies neigh->ha to struct arpreq.arp_ha.sa_data.
The arp_ha here is struct sockaddr, not struct sockaddr_storage, so
the sa_data buffer is just 14 bytes.
In the splat below, 2 bytes are overflown to the next int field,
arp_flags. We initialise the field just after the memcpy(), so it's
not a problem.
However, when dev->addr_len is greater than 22 (e.g. MAX_ADDR_LEN),
arp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)
in arp_ioctl() before calling arp_req_get().
To avoid the overflow, let's limit the max length of memcpy().
Note that commit b5f0de6df6dc ("net: dev: Convert sa_data to flexible
array in struct sockaddr") just silenced syzkaller.
[0]:
memcpy: detected field-spanning write (size 16) of single field "r->arp_ha.sa_data" at net/ipv4/arp.c:1128 (size 14)
WARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128
Modules linked in:
CPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
RIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128
Code: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb <0f> 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6
RSP: 0018:ffffc900050b7998 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001
RBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000
R13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010
FS: 00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261
inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981
sock_do_ioctl+0xdf/0x260 net/socket.c:1204
sock_ioctl+0x3ef/0x650 net/socket.c:1321
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x64/0xce
RIP: 0033:0x7f172b262b8d
Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d
RDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003
RBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000
</TASK>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Reported-by: Bjoern Doebel <doebel@amazon.de>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240215230516.31330-1-kuniyu@amazon.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-03-01 13:16:51 +01:00
2020-08-10 12:06:44 -07:00
2023-10-10 21:53:29 +02:00
2024-02-23 08:42:20 +01:00
2021-04-14 08:42:05 +02:00
2024-03-01 13:16:51 +01:00
2020-09-25 13:58:01 -07:00
2022-07-21 21:20:08 +02:00
2022-10-30 09:41:19 +01:00
2024-03-01 13:16:50 +01:00
2023-06-28 10:28:11 +02:00
2023-10-25 11:54:19 +02:00
2023-03-22 13:30:00 +01:00
2021-12-08 09:03:26 +01:00
2023-10-25 11:54:23 +02:00
2023-10-25 11:54:23 +02:00
2020-10-02 19:11:11 -07:00
2021-01-12 20:18:12 +01:00
2020-08-03 15:29:44 -07:00
2023-04-20 12:10:21 +02:00
2023-12-08 08:46:13 +01:00
2024-02-23 08:41:55 +01:00
2021-12-22 09:30:53 +01:00
2022-01-27 10:54:33 +01:00
2023-07-27 08:44:40 +02:00
2023-07-27 08:44:40 +02:00
2022-07-21 21:20:07 +02:00
2022-07-29 17:19:12 +02:00
2022-01-27 10:54:33 +01:00
2023-12-13 18:27:00 +01:00
2023-09-19 12:20:26 +02:00
2020-08-25 06:28:02 -07:00
2024-02-23 08:42:17 +01:00
2023-06-05 09:07:04 +02:00
2024-02-23 08:42:19 +01:00
2023-03-22 13:29:58 +01:00
2023-08-26 15:26:52 +02:00
2021-06-18 10:00:05 +02:00
2022-02-16 12:54:25 +01:00
2022-12-02 17:40:05 +01:00
2023-02-01 08:23:24 +01:00
2020-10-30 12:57:39 +01:00
2022-11-03 23:57:54 +09:00
2022-06-09 10:21:09 +02:00
2021-11-18 14:04:08 +01:00
2023-06-05 09:07:04 +02:00
2023-12-08 08:46:08 +01:00
2023-11-20 11:06:46 +01:00
2023-07-27 08:44:42 +02:00
2021-08-18 08:59:13 +02:00
2023-05-30 12:57:46 +01:00
2022-11-25 17:45:55 +01:00
2021-05-14 09:50:46 +02:00
2021-12-01 09:19:06 +01:00
2023-07-27 08:44:43 +02:00
2023-12-13 18:27:00 +01:00
2023-10-25 11:54:19 +02:00
2023-11-20 11:06:45 +01:00
2023-07-27 08:44:40 +02:00
2021-08-12 13:22:05 +02:00
2023-12-20 15:44:28 +01:00
2022-05-09 09:05:03 +02:00
2023-10-25 11:54:20 +02:00
2020-08-24 17:31:20 -07:00
2023-09-19 12:20:08 +02:00
2023-01-24 07:20:01 +01:00
2020-10-13 17:11:52 -07:00
2024-02-23 08:42:16 +01:00
2021-07-28 14:35:37 +02:00
2020-07-24 15:41:54 -07:00
2021-08-12 13:22:05 +02:00
2023-01-14 10:15:43 +01:00
2022-03-02 11:42:51 +01:00
2023-11-20 11:06:44 +01:00
2023-05-30 12:57:57 +01:00
2023-06-28 10:28:10 +02:00
2022-06-14 18:32:40 +02:00
2020-10-09 12:29:48 +02:00
dbc9b22d0e