]>
Commit | Line | Data |
---|---|---|
4d4b606b GKH |
1 | From foo@baz Tue Apr 10 23:19:25 CEST 2018 |
2 | From: Eric Dumazet <edumazet@google.com> | |
3 | Date: Thu, 5 Apr 2018 06:39:27 -0700 | |
4 | Subject: ip_tunnel: better validate user provided tunnel names | |
5 | ||
6 | From: Eric Dumazet <edumazet@google.com> | |
7 | ||
8 | ||
9 | [ Upstream commit 9cb726a212a82c88c98aa9f0037fd04777cd8fe5 ] | |
10 | ||
11 | Use dev_valid_name() to make sure user does not provide illegal | |
12 | device name. | |
13 | ||
14 | syzbot caught the following bug : | |
15 | ||
16 | BUG: KASAN: stack-out-of-bounds in strlcpy include/linux/string.h:300 [inline] | |
17 | BUG: KASAN: stack-out-of-bounds in __ip_tunnel_create+0xca/0x6b0 net/ipv4/ip_tunnel.c:257 | |
18 | Write of size 20 at addr ffff8801ac79f810 by task syzkaller268107/4482 | |
19 | ||
20 | CPU: 0 PID: 4482 Comm: syzkaller268107 Not tainted 4.16.0+ #1 | |
21 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 | |
22 | Call Trace: | |
23 | __dump_stack lib/dump_stack.c:17 [inline] | |
24 | dump_stack+0x1b9/0x29f lib/dump_stack.c:53 | |
25 | print_address_description+0x6c/0x20b mm/kasan/report.c:256 | |
26 | kasan_report_error mm/kasan/report.c:354 [inline] | |
27 | kasan_report.cold.7+0xac/0x2f5 mm/kasan/report.c:412 | |
28 | check_memory_region_inline mm/kasan/kasan.c:260 [inline] | |
29 | check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 | |
30 | memcpy+0x37/0x50 mm/kasan/kasan.c:303 | |
31 | strlcpy include/linux/string.h:300 [inline] | |
32 | __ip_tunnel_create+0xca/0x6b0 net/ipv4/ip_tunnel.c:257 | |
33 | ip_tunnel_create net/ipv4/ip_tunnel.c:352 [inline] | |
34 | ip_tunnel_ioctl+0x818/0xd40 net/ipv4/ip_tunnel.c:861 | |
35 | ipip_tunnel_ioctl+0x1c5/0x420 net/ipv4/ipip.c:350 | |
36 | dev_ifsioc+0x43e/0xb90 net/core/dev_ioctl.c:334 | |
37 | dev_ioctl+0x69a/0xcc0 net/core/dev_ioctl.c:525 | |
38 | sock_ioctl+0x47e/0x680 net/socket.c:1015 | |
39 | vfs_ioctl fs/ioctl.c:46 [inline] | |
40 | file_ioctl fs/ioctl.c:500 [inline] | |
41 | do_vfs_ioctl+0x1cf/0x1650 fs/ioctl.c:684 | |
42 | ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701 | |
43 | SYSC_ioctl fs/ioctl.c:708 [inline] | |
44 | SyS_ioctl+0x24/0x30 fs/ioctl.c:706 | |
45 | do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287 | |
46 | entry_SYSCALL_64_after_hwframe+0x42/0xb7 | |
47 | ||
48 | Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") | |
49 | Signed-off-by: Eric Dumazet <edumazet@google.com> | |
50 | Reported-by: syzbot <syzkaller@googlegroups.com> | |
51 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
52 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
53 | --- | |
54 | net/ipv4/ip_tunnel.c | 11 ++++++----- | |
55 | 1 file changed, 6 insertions(+), 5 deletions(-) | |
56 | ||
57 | --- a/net/ipv4/ip_tunnel.c | |
58 | +++ b/net/ipv4/ip_tunnel.c | |
59 | @@ -253,13 +253,14 @@ static struct net_device *__ip_tunnel_cr | |
60 | struct net_device *dev; | |
61 | char name[IFNAMSIZ]; | |
62 | ||
63 | - if (parms->name[0]) | |
64 | + err = -E2BIG; | |
65 | + if (parms->name[0]) { | |
66 | + if (!dev_valid_name(parms->name)) | |
67 | + goto failed; | |
68 | strlcpy(name, parms->name, IFNAMSIZ); | |
69 | - else { | |
70 | - if (strlen(ops->kind) > (IFNAMSIZ - 3)) { | |
71 | - err = -E2BIG; | |
72 | + } else { | |
73 | + if (strlen(ops->kind) > (IFNAMSIZ - 3)) | |
74 | goto failed; | |
75 | - } | |
76 | strlcpy(name, ops->kind, IFNAMSIZ); | |
77 | strncat(name, "%d", 2); | |
78 | } |