From: Kees Cook <keescook@chromium•org>
To: Kuniyuki Iwashima <kuniyu@amazon•com>
Cc: "David S. Miller" <davem@davemloft•net>,
Eric Dumazet <edumazet@google•com>,
Jakub Kicinski <kuba@kernel•org>, Paolo Abeni <pabeni@redhat•com>,
Willem de Bruijn <willemdebruijn.kernel@gmail•com>,
"Gustavo A. R. Silva" <gustavoars@kernel•org>,
Breno Leitao <leitao@debian•org>,
Kuniyuki Iwashima <kuni1840@gmail•com>,
netdev@vger•kernel.org, syzkaller <syzkaller@googlegroups•com>
Subject: Re: [PATCH v2 net 2/2] af_packet: Fix warning of fortified memcpy() in packet_getname().
Date: Thu, 20 Jul 2023 08:04:53 -0700 [thread overview]
Message-ID: <202307200753.7B071AC7B@keescook> (raw)
In-Reply-To: <20230720004410.87588-3-kuniyu@amazon.com>
On Wed, Jul 19, 2023 at 05:44:10PM -0700, Kuniyuki Iwashima wrote:
> syzkaller found a warning in packet_getname() [0], where we try to
> copy 16 bytes to sockaddr_ll.sll_addr[8].
>
> Some devices (ip6gre, vti6, ip6tnl) have 16 bytes address expressed
> by struct in6_addr. Also, Infiniband has 32 bytes as MAX_ADDR_LEN.
>
> The write seems to overflow, but actually not since we use struct
> sockaddr_storage defined in __sys_getsockname() and its size is 128
> (_K_SS_MAXSIZE) bytes. Thus, we have sufficient room after sll_addr[]
> as __data[].
Ah, so the issue here is that the UAPI for sll_addr is lying about its
size. I think a better fix here is to fix the structure (without
breaking UAPI sizes or names):
diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
index 9efc42382fdb..4d0ad22f83b5 100644
--- a/include/uapi/linux/if_packet.h
+++ b/include/uapi/linux/if_packet.h
@@ -18,7 +18,11 @@ struct sockaddr_ll {
unsigned short sll_hatype;
unsigned char sll_pkttype;
unsigned char sll_halen;
- unsigned char sll_addr[8];
+ union {
+ unsigned char sll_addr[8];
+ /* Actual length is in sll_halen. */
+ __DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
+ };
};
/* Packet types */
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 85ff90a03b0c..8e3ddec4c3d5 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3601,7 +3601,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
if (dev) {
sll->sll_hatype = dev->type;
sll->sll_halen = dev->addr_len;
- memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
+ memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
} else {
sll->sll_hatype = 0; /* Bad: we have no ARPHRD_UNSPEC */
sll->sll_halen = 0;
We can't rename sll_data nor change it's size, as userspace uses it
pretty extensively:
https://codesearch.debian.net/search?q=sizeof.*sll_addr&literal=0
--
Kees Cook
next prev parent reply other threads:[~2023-07-20 15:04 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-20 0:44 [PATCH v2 net 0/2] net: Fix error/warning by -fstrict-flex-arrays=3 Kuniyuki Iwashima
2023-07-20 0:44 ` [PATCH v2 net 1/2] af_unix: Fix fortify_panic() in unix_bind_bsd() Kuniyuki Iwashima
2023-07-20 14:39 ` Kees Cook
2023-07-20 17:09 ` Kuniyuki Iwashima
2023-07-20 0:44 ` [PATCH v2 net 2/2] af_packet: Fix warning of fortified memcpy() in packet_getname() Kuniyuki Iwashima
2023-07-20 14:06 ` Willem de Bruijn
2023-07-20 15:04 ` Kees Cook [this message]
2023-07-20 17:02 ` Kuniyuki Iwashima
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202307200753.7B071AC7B@keescook \
--to=keescook@chromium$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=gustavoars@kernel$(echo .)org \
--cc=kuba@kernel$(echo .)org \
--cc=kuni1840@gmail$(echo .)com \
--cc=kuniyu@amazon$(echo .)com \
--cc=leitao@debian$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=syzkaller@googlegroups$(echo .)com \
--cc=willemdebruijn.kernel@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox