queue-6.6/net-sched-act_skbmod-prevent-kernel-infoleak.patch

   1 From d313eb8b77557a6d5855f42d2234bd592c7b50dd Mon Sep 17 00:00:00 2001
   2 From: Eric Dumazet <edumazet@google.com>
   3 Date: Wed, 3 Apr 2024 13:09:08 +0000
   4 Subject: net/sched: act_skbmod: prevent kernel-infoleak
   5
   6 From: Eric Dumazet <edumazet@google.com>
   7
   8 commit d313eb8b77557a6d5855f42d2234bd592c7b50dd upstream.
   9
  10 syzbot found that tcf_skbmod_dump() was copying four bytes
  11 from kernel stack to user space [1].
  12
  13 The issue here is that 'struct tc_skbmod' has a four bytes hole.
  14
  15 We need to clear the structure before filling fields.
  16
  17 [1]
  18 BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
  19  BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
  20  BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]
  21  BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
  22  BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]
  23  BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185
  24   instrument_copy_to_user include/linux/instrumented.h:114 [inline]
  25   copy_to_user_iter lib/iov_iter.c:24 [inline]
  26   iterate_ubuf include/linux/iov_iter.h:29 [inline]
  27   iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
  28   iterate_and_advance include/linux/iov_iter.h:271 [inline]
  29   _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185
  30   copy_to_iter include/linux/uio.h:196 [inline]
  31   simple_copy_to_iter net/core/datagram.c:532 [inline]
  32   __skb_datagram_iter+0x185/0x1000 net/core/datagram.c:420
  33   skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546
  34   skb_copy_datagram_msg include/linux/skbuff.h:4050 [inline]
  35   netlink_recvmsg+0x432/0x1610 net/netlink/af_netlink.c:1962
  36   sock_recvmsg_nosec net/socket.c:1046 [inline]
  37   sock_recvmsg+0x2c4/0x340 net/socket.c:1068
  38   __sys_recvfrom+0x35a/0x5f0 net/socket.c:2242
  39   __do_sys_recvfrom net/socket.c:2260 [inline]
  40   __se_sys_recvfrom net/socket.c:2256 [inline]
  41   __x64_sys_recvfrom+0x126/0x1d0 net/socket.c:2256
  42  do_syscall_64+0xd5/0x1f0
  43  entry_SYSCALL_64_after_hwframe+0x6d/0x75
  44
  45 Uninit was stored to memory at:
  46   pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253
  47   netlink_trim+0x2c2/0x330 net/netlink/af_netlink.c:1317
  48   netlink_unicast+0x9f/0x1260 net/netlink/af_netlink.c:1351
  49   nlmsg_unicast include/net/netlink.h:1144 [inline]
  50   nlmsg_notify+0x21d/0x2f0 net/netlink/af_netlink.c:2610
  51   rtnetlink_send+0x73/0x90 net/core/rtnetlink.c:741
  52   rtnetlink_maybe_send include/linux/rtnetlink.h:17 [inline]
  53   tcf_add_notify net/sched/act_api.c:2048 [inline]
  54   tcf_action_add net/sched/act_api.c:2071 [inline]
  55   tc_ctl_action+0x146e/0x19d0 net/sched/act_api.c:2119
  56   rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595
  57   netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559
  58   rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613
  59   netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
  60   netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361
  61   netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905
  62   sock_sendmsg_nosec net/socket.c:730 [inline]
  63   __sock_sendmsg+0x30f/0x380 net/socket.c:745
  64   ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
  65   ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
  66   __sys_sendmsg net/socket.c:2667 [inline]
  67   __do_sys_sendmsg net/socket.c:2676 [inline]
  68   __se_sys_sendmsg net/socket.c:2674 [inline]
  69   __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
  70  do_syscall_64+0xd5/0x1f0
  71  entry_SYSCALL_64_after_hwframe+0x6d/0x75
  72
  73 Uninit was stored to memory at:
  74   __nla_put lib/nlattr.c:1041 [inline]
  75   nla_put+0x1c6/0x230 lib/nlattr.c:1099
  76   tcf_skbmod_dump+0x23f/0xc20 net/sched/act_skbmod.c:256
  77   tcf_action_dump_old net/sched/act_api.c:1191 [inline]
  78   tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227
  79   tcf_action_dump+0x1fd/0x460 net/sched/act_api.c:1251
  80   tca_get_fill+0x519/0x7a0 net/sched/act_api.c:1628
  81   tcf_add_notify_msg net/sched/act_api.c:2023 [inline]
  82   tcf_add_notify net/sched/act_api.c:2042 [inline]
  83   tcf_action_add net/sched/act_api.c:2071 [inline]
  84   tc_ctl_action+0x1365/0x19d0 net/sched/act_api.c:2119
  85   rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595
  86   netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559
  87   rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613
  88   netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
  89   netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361
  90   netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905
  91   sock_sendmsg_nosec net/socket.c:730 [inline]
  92   __sock_sendmsg+0x30f/0x380 net/socket.c:745
  93   ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
  94   ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
  95   __sys_sendmsg net/socket.c:2667 [inline]
  96   __do_sys_sendmsg net/socket.c:2676 [inline]
  97   __se_sys_sendmsg net/socket.c:2674 [inline]
  98   __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
  99  do_syscall_64+0xd5/0x1f0
 100  entry_SYSCALL_64_after_hwframe+0x6d/0x75
 101
 102 Local variable opt created at:
 103   tcf_skbmod_dump+0x9d/0xc20 net/sched/act_skbmod.c:244
 104   tcf_action_dump_old net/sched/act_api.c:1191 [inline]
 105   tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227
 106
 107 Bytes 188-191 of 248 are uninitialized
 108 Memory access of size 248 starts at ffff888117697680
 109 Data copied to user address 00007ffe56d855f0
 110
 111 Fixes: 86da71b57383 ("net_sched: Introduce skbmod action")
 112 Signed-off-by: Eric Dumazet <edumazet@google.com>
 113 Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
 114 Link: https://lore.kernel.org/r/20240403130908.93421-1-edumazet@google.com
 115 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 116 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 117 ---
 118  net/sched/act_skbmod.c |   10 +++++-----
 119  1 file changed, 5 insertions(+), 5 deletions(-)
 120
 121 --- a/net/sched/act_skbmod.c
 122 +++ b/net/sched/act_skbmod.c
 123 @@ -241,13 +241,13 @@ static int tcf_skbmod_dump(struct sk_buf
 124         struct tcf_skbmod *d = to_skbmod(a);
 125         unsigned char *b = skb_tail_pointer(skb);
 126         struct tcf_skbmod_params  *p;
 127 -       struct tc_skbmod opt = {
 128 -               .index   = d->tcf_index,
 129 -               .refcnt  = refcount_read(&d->tcf_refcnt) - ref,
 130 -               .bindcnt = atomic_read(&d->tcf_bindcnt) - bind,
 131 -       };
 132 +       struct tc_skbmod opt;
 133         struct tcf_t t;
 134
 135 +       memset(&opt, 0, sizeof(opt));
 136 +       opt.index   = d->tcf_index;
 137 +       opt.refcnt  = refcount_read(&d->tcf_refcnt) - ref,
 138 +       opt.bindcnt = atomic_read(&d->tcf_bindcnt) - bind;
 139         spin_lock_bh(&d->tcf_lock);
 140         opt.action = d->tcf_action;
 141         p = rcu_dereference_protected(d->skbmod_p,