Alexander Potapenko
2580c4c17a
tun: bail out from tun_get_user() if the skb is empty
KMSAN (https://github.com/google/kmsan) reported accessing uninitialized
skb->data[0] in the case the skb is empty (i.e. skb->len is 0):
================================================
BUG: KMSAN: use of uninitialized memory in tun_get_user+0x19ba/0x3770
CPU: 0 PID: 3051 Comm: probe Not tainted 4.13.0+ #3140
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
...
__msan_warning_32+0x66/0xb0 mm/kmsan/kmsan_instr.c:477
tun_get_user+0x19ba/0x3770 drivers/net/tun.c:1301
tun_chr_write_iter+0x19f/0x300 drivers/net/tun.c:1365
call_write_iter ./include/linux/fs.h:1743
new_sync_write fs/read_write.c:457
__vfs_write+0x6c3/0x7f0 fs/read_write.c:470
vfs_write+0x3e4/0x770 fs/read_write.c:518
SYSC_write+0x12f/0x2b0 fs/read_write.c:565
SyS_write+0x55/0x80 fs/read_write.c:557
do_syscall_64+0x242/0x330 arch/x86/entry/common.c:284
entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:245
...
origin:
...
kmsan_poison_shadow+0x6e/0xc0 mm/kmsan/kmsan.c:211
slab_alloc_node mm/slub.c:2732
__kmalloc_node_track_caller+0x351/0x370 mm/slub.c:4351
__kmalloc_reserve net/core/skbuff.c:138
__alloc_skb+0x26a/0x810 net/core/skbuff.c:231
alloc_skb ./include/linux/skbuff.h:903
alloc_skb_with_frags+0x1d7/0xc80 net/core/skbuff.c:4756
sock_alloc_send_pskb+0xabf/0xfe0 net/core/sock.c:2037
tun_alloc_skb drivers/net/tun.c:1144
tun_get_user+0x9a8/0x3770 drivers/net/tun.c:1274
tun_chr_write_iter+0x19f/0x300 drivers/net/tun.c:1365
call_write_iter ./include/linux/fs.h:1743
new_sync_write fs/read_write.c:457
__vfs_write+0x6c3/0x7f0 fs/read_write.c:470
vfs_write+0x3e4/0x770 fs/read_write.c:518
SYSC_write+0x12f/0x2b0 fs/read_write.c:565
SyS_write+0x55/0x80 fs/read_write.c:557
do_syscall_64+0x242/0x330 arch/x86/entry/common.c:284
return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:245
================================================
Make sure tun_get_user() doesn't touch skb->data[0] unless there is
actual data.
C reproducer below:
==========================
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <fcntl.h>
#include <linux/if_tun.h>
#include <netinet/ip.h>
#include <net/if.h>
#include <string.h>
#include <sys/ioctl.h>
int main()
{
int sock = socket(PF_INET, SOCK_STREAM, IPPROTO_IP);
int tun_fd = open("/dev/net/tun", O_RDWR);
struct ifreq req;
memset(&req, 0, sizeof(struct ifreq));
strcpy((char*)&req.ifr_name, "gre0");
req.ifr_flags = IFF_UP | IFF_MULTICAST;
ioctl(tun_fd, TUNSETIFF, &req);
ioctl(sock, SIOCSIFFLAGS, "gre0");
write(tun_fd, "hi", 0);
return 0;
}
==========================
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-09-28 08:37:28 -07:00
..
2017-09-22 23:38:45 +02:00
2017-09-01 09:22:50 +02:00
2017-09-06 22:41:21 -07:00
2017-09-22 17:28:59 -10:00
2017-09-12 20:03:53 -07:00
2017-09-10 20:40:00 -07:00
2017-09-14 11:59:30 +02:00
2017-09-13 11:04:14 -07:00
2017-09-15 20:43:33 -07:00
2017-09-20 00:51:01 +02:00
2017-09-19 23:10:51 +02:00
2017-09-20 17:42:42 +08:00
2017-09-14 13:43:16 -07:00
2017-09-07 14:03:05 -07:00
2017-09-14 11:59:30 +02:00
2017-09-07 13:51:13 -07:00
2017-09-21 08:02:39 +10:00
2017-09-07 12:53:14 -07:00
2017-09-07 09:25:15 -07:00
2017-09-14 11:59:30 +02:00
2017-09-14 17:34:43 +02:00
2017-09-07 11:59:42 -07:00
2017-09-05 12:19:08 -07:00
2017-09-07 13:51:13 -07:00
2017-09-23 05:47:04 -10:00
2017-09-22 17:23:41 -10:00
2017-09-22 12:05:43 +02:00
2017-09-15 20:43:33 -07:00
2017-09-20 16:01:36 -07:00
2017-09-14 11:59:30 +02:00
2017-09-01 16:42:54 +10:00
2017-09-07 13:23:37 -07:00
2017-09-05 11:08:17 -07:00
2017-09-19 08:39:32 -07:00
2017-09-14 18:13:32 -07:00
2017-09-10 20:40:00 -07:00
2017-09-14 11:59:30 +02:00
2017-09-13 18:53:16 -07:00
2017-09-08 15:38:22 +02:00
2017-09-18 14:51:02 +02:00
2017-09-28 08:37:28 -07:00
2017-09-18 17:29:01 -07:00
2017-09-11 12:29:40 -04:00
2017-09-12 13:30:06 -07:00
2017-09-05 11:08:17 -07:00
2017-09-20 13:56:06 -05:00
2017-09-22 15:11:46 +01:00
2017-09-15 20:43:33 -07:00
2017-09-12 15:58:45 +02:00
2017-09-14 11:59:30 +02:00
2017-09-14 11:59:30 +02:00
2017-09-09 14:44:39 -07:00
2017-09-08 18:26:51 -07:00
2017-09-11 13:04:32 -07:00
2017-09-07 13:51:13 -07:00
2017-09-09 14:34:38 -07:00
2017-09-15 20:43:33 -07:00
2017-09-04 10:52:30 -07:00
2017-09-13 10:56:00 -07:00
2017-09-19 08:36:19 +02:00
2017-09-15 15:16:49 -04:00
2017-09-15 20:43:33 -07:00
2017-09-05 12:45:03 -07:00
2017-09-14 18:54:01 -07:00
2017-09-14 18:13:32 -07:00
2017-09-08 11:20:04 +08:00
2017-09-05 12:45:03 -07:00
2017-09-14 11:59:30 +02:00
2017-09-14 18:13:32 -07:00
2017-08-30 14:03:42 -06:00
2017-09-08 18:26:49 -07:00
2017-09-14 13:33:33 -07:00
2017-09-07 21:11:05 -07:00
2017-09-09 14:44:39 -07:00
2017-09-15 20:43:33 -07:00
2017-09-22 06:40:47 -10:00