releases/4.4.181/xfrm-policy-fix-out-of-bound-array-accesses-in-__xfr.patch

   1 From 139e4b56034f179a53e41e3037df24bb7ce92cb0 Mon Sep 17 00:00:00 2001
   2 From: YueHaibing <yuehaibing@huawei.com>
   3 Date: Thu, 28 Feb 2019 15:18:59 +0800
   4 Subject: xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink
   5
   6 [ Upstream commit b805d78d300bcf2c83d6df7da0c818b0fee41427 ]
   7
   8 UBSAN report this:
   9
  10 UBSAN: Undefined behaviour in net/xfrm/xfrm_policy.c:1289:24
  11 index 6 is out of range for type 'unsigned int [6]'
  12 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.162-514.55.6.9.x86_64+ #13
  13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
  14  0000000000000000 1466cf39b41b23c9 ffff8801f6b07a58 ffffffff81cb35f4
  15  0000000041b58ab3 ffffffff83230f9c ffffffff81cb34e0 ffff8801f6b07a80
  16  ffff8801f6b07a20 1466cf39b41b23c9 ffffffff851706e0 ffff8801f6b07ae8
  17 Call Trace:
  18  <IRQ>  [<ffffffff81cb35f4>] __dump_stack lib/dump_stack.c:15 [inline]
  19  <IRQ>  [<ffffffff81cb35f4>] dump_stack+0x114/0x1a0 lib/dump_stack.c:51
  20  [<ffffffff81d94225>] ubsan_epilogue+0x12/0x8f lib/ubsan.c:164
  21  [<ffffffff81d954db>] __ubsan_handle_out_of_bounds+0x16e/0x1b2 lib/ubsan.c:382
  22  [<ffffffff82a25acd>] __xfrm_policy_unlink+0x3dd/0x5b0 net/xfrm/xfrm_policy.c:1289
  23  [<ffffffff82a2e572>] xfrm_policy_delete+0x52/0xb0 net/xfrm/xfrm_policy.c:1309
  24  [<ffffffff82a3319b>] xfrm_policy_timer+0x30b/0x590 net/xfrm/xfrm_policy.c:243
  25  [<ffffffff813d3927>] call_timer_fn+0x237/0x990 kernel/time/timer.c:1144
  26  [<ffffffff813d8e7e>] __run_timers kernel/time/timer.c:1218 [inline]
  27  [<ffffffff813d8e7e>] run_timer_softirq+0x6ce/0xb80 kernel/time/timer.c:1401
  28  [<ffffffff8120d6f9>] __do_softirq+0x299/0xe10 kernel/softirq.c:273
  29  [<ffffffff8120e676>] invoke_softirq kernel/softirq.c:350 [inline]
  30  [<ffffffff8120e676>] irq_exit+0x216/0x2c0 kernel/softirq.c:391
  31  [<ffffffff82c5edab>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
  32  [<ffffffff82c5edab>] smp_apic_timer_interrupt+0x8b/0xc0 arch/x86/kernel/apic/apic.c:926
  33  [<ffffffff82c5c985>] apic_timer_interrupt+0xa5/0xb0 arch/x86/entry/entry_64.S:735
  34  <EOI>  [<ffffffff81188096>] ? native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:52
  35  [<ffffffff810834d7>] arch_safe_halt arch/x86/include/asm/paravirt.h:111 [inline]
  36  [<ffffffff810834d7>] default_idle+0x27/0x430 arch/x86/kernel/process.c:446
  37  [<ffffffff81085f05>] arch_cpu_idle+0x15/0x20 arch/x86/kernel/process.c:437
  38  [<ffffffff8132abc3>] default_idle_call+0x53/0x90 kernel/sched/idle.c:92
  39  [<ffffffff8132b32d>] cpuidle_idle_call kernel/sched/idle.c:156 [inline]
  40  [<ffffffff8132b32d>] cpu_idle_loop kernel/sched/idle.c:251 [inline]
  41  [<ffffffff8132b32d>] cpu_startup_entry+0x60d/0x9a0 kernel/sched/idle.c:299
  42  [<ffffffff8113e119>] start_secondary+0x3c9/0x560 arch/x86/kernel/smpboot.c:245
  43
  44 The issue is triggered as this:
  45
  46 xfrm_add_policy
  47     -->verify_newpolicy_info  //check the index provided by user with XFRM_POLICY_MAX
  48                               //In my case, the index is 0x6E6BB6, so it pass the check.
  49     -->xfrm_policy_construct  //copy the user's policy and set xfrm_policy_timer
  50     -->xfrm_policy_insert
  51         --> __xfrm_policy_link //use the orgin dir, in my case is 2
  52         --> xfrm_gen_index   //generate policy index, there is 0x6E6BB6
  53
  54 then xfrm_policy_timer be fired
  55
  56 xfrm_policy_timer
  57    --> xfrm_policy_id2dir  //get dir from (policy index & 7), in my case is 6
  58    --> xfrm_policy_delete
  59       --> __xfrm_policy_unlink //access policy_count[dir], trigger out of range access
  60
  61 Add xfrm_policy_id2dir check in verify_newpolicy_info, make sure the computed dir is
  62 valid, to fix the issue.
  63
  64 Reported-by: Hulk Robot <hulkci@huawei.com>
  65 Fixes: e682adf021be ("xfrm: Try to honor policy index if it's supplied by user")
  66 Signed-off-by: YueHaibing <yuehaibing@huawei.com>
  67 Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
  68 Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
  69 Signed-off-by: Sasha Levin <sashal@kernel.org>
  70 ---
  71  net/xfrm/xfrm_user.c |    2 +-
  72  1 file changed, 1 insertion(+), 1 deletion(-)
  73
  74 --- a/net/xfrm/xfrm_user.c
  75 +++ b/net/xfrm/xfrm_user.c
  76 @@ -1340,7 +1340,7 @@ static int verify_newpolicy_info(struct
  77         ret = verify_policy_dir(p->dir);
  78         if (ret)
  79                 return ret;
  80 -       if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir))
  81 +       if (p->index && (xfrm_policy_id2dir(p->index) != p->dir))
  82                 return -EINVAL;
  83
  84         return 0;