From: Kuniyuki Iwashima <kuniyu@amazon•com>
To: <keescook@chromium•org>
Cc: <davem@davemloft•net>, <edumazet@google•com>,
<gustavoars@kernel•org>, <kuba@kernel•org>, <kuni1840@gmail•com>,
<kuniyu@amazon•com>, <leitao@debian•org>,
<netdev@vger•kernel.org>, <pabeni@redhat•com>,
<syzkaller@googlegroups•com>, <willemdebruijn.kernel@gmail•com>
Subject: Re: [PATCH v2 net 2/2] af_packet: Fix warning of fortified memcpy() in packet_getname().
Date: Thu, 20 Jul 2023 10:02:36 -0700 [thread overview]
Message-ID: <20230720170236.3939-1-kuniyu@amazon.com> (raw)
In-Reply-To: <202307200753.7B071AC7B@keescook>
From: Kees Cook <keescook@chromium•org>
Date: Thu, 20 Jul 2023 08:04:53 -0700
> On Wed, Jul 19, 2023 at 05:44:10PM -0700, Kuniyuki Iwashima wrote:
> > syzkaller found a warning in packet_getname() [0], where we try to
> > copy 16 bytes to sockaddr_ll.sll_addr[8].
> >
> > Some devices (ip6gre, vti6, ip6tnl) have 16 bytes address expressed
> > by struct in6_addr. Also, Infiniband has 32 bytes as MAX_ADDR_LEN.
> >
> > The write seems to overflow, but actually not since we use struct
> > sockaddr_storage defined in __sys_getsockname() and its size is 128
> > (_K_SS_MAXSIZE) bytes. Thus, we have sufficient room after sll_addr[]
> > as __data[].
>
> Ah, so the issue here is that the UAPI for sll_addr is lying about its
> size. I think a better fix here is to fix the structure (without
> breaking UAPI sizes or names):
Doesn't it forcify sll_addr here ?
>
> diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
> index 9efc42382fdb..4d0ad22f83b5 100644
> --- a/include/uapi/linux/if_packet.h
> +++ b/include/uapi/linux/if_packet.h
> @@ -18,7 +18,11 @@ struct sockaddr_ll {
> unsigned short sll_hatype;
> unsigned char sll_pkttype;
> unsigned char sll_halen;
> - unsigned char sll_addr[8];
> + union {
> + unsigned char sll_addr[8];
> + /* Actual length is in sll_halen. */
> + __DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
> + };
> };
>
> /* Packet types */
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 85ff90a03b0c..8e3ddec4c3d5 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -3601,7 +3601,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
> if (dev) {
> sll->sll_hatype = dev->type;
> sll->sll_halen = dev->addr_len;
> - memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
> + memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
> } else {
> sll->sll_hatype = 0; /* Bad: we have no ARPHRD_UNSPEC */
> sll->sll_halen = 0;
>
> We can't rename sll_data nor change it's size, as userspace uses it
> pretty extensively:
> https://codesearch.debian.net/search?q=sizeof.*sll_addr&literal=0
>
> --
> Kees Cook
prev parent reply other threads:[~2023-07-20 17:03 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-20 0:44 [PATCH v2 net 0/2] net: Fix error/warning by -fstrict-flex-arrays=3 Kuniyuki Iwashima
2023-07-20 0:44 ` [PATCH v2 net 1/2] af_unix: Fix fortify_panic() in unix_bind_bsd() Kuniyuki Iwashima
2023-07-20 14:39 ` Kees Cook
2023-07-20 17:09 ` Kuniyuki Iwashima
2023-07-20 0:44 ` [PATCH v2 net 2/2] af_packet: Fix warning of fortified memcpy() in packet_getname() Kuniyuki Iwashima
2023-07-20 14:06 ` Willem de Bruijn
2023-07-20 15:04 ` Kees Cook
2023-07-20 17:02 ` Kuniyuki Iwashima [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230720170236.3939-1-kuniyu@amazon.com \
--to=kuniyu@amazon$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=gustavoars@kernel$(echo .)org \
--cc=keescook@chromium$(echo .)org \
--cc=kuba@kernel$(echo .)org \
--cc=kuni1840@gmail$(echo .)com \
--cc=leitao@debian$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=syzkaller@googlegroups$(echo .)com \
--cc=willemdebruijn.kernel@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox