From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Martin K. Petersen" <martin.petersen@oracle.com>,
"Chris Leech" <cleech@redhat.com>,
"Xin Long" <lucien.xin@gmail.com>,
"ChunYu Wang" <chunwang@redhat.com>
Subject: [PATCH 3.2 64/74] scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly
Date: Mon, 09 Oct 2017 13:30:34 +0100 [thread overview]
Message-ID: <lsq.1507552234.401760506@decadent.org.uk> (raw)
In-Reply-To: <lsq.1507552233.547064726@decadent.org.uk>
3.2.94-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
commit c88f0e6b06f4092995688211a631bb436125d77b upstream.
ChunYu found a kernel crash by syzkaller:
[ 651.617875] kasan: CONFIG_KASAN_INLINE enabled
[ 651.618217] kasan: GPF could be caused by NULL-ptr deref or user memory access
[ 651.618731] general protection fault: 0000 [#1] SMP KASAN
[ 651.621543] CPU: 1 PID: 9539 Comm: scsi Not tainted 4.11.0.cov #32
[ 651.621938] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[ 651.622309] task: ffff880117780000 task.stack: ffff8800a3188000
[ 651.622762] RIP: 0010:skb_release_data+0x26c/0x590
[...]
[ 651.627260] Call Trace:
[ 651.629156] skb_release_all+0x4f/0x60
[ 651.629450] consume_skb+0x1a5/0x600
[ 651.630705] netlink_unicast+0x505/0x720
[ 651.632345] netlink_sendmsg+0xab2/0xe70
[ 651.633704] sock_sendmsg+0xcf/0x110
[ 651.633942] ___sys_sendmsg+0x833/0x980
[ 651.637117] __sys_sendmsg+0xf3/0x240
[ 651.638820] SyS_sendmsg+0x32/0x50
[ 651.639048] entry_SYSCALL_64_fastpath+0x1f/0xc2
It's caused by skb_shared_info at the end of sk_buff was overwritten by
ISCSI_KEVENT_IF_ERROR when parsing nlmsg info from skb in iscsi_if_rx.
During the loop if skb->len == nlh->nlmsg_len and both are sizeof(*nlh),
ev = nlmsg_data(nlh) will acutally get skb_shinfo(SKB) instead and set a
new value to skb_shinfo(SKB)->nr_frags by ev->type.
This patch is to fix it by checking nlh->nlmsg_len properly there to
avoid over accessing sk_buff.
Reported-by: ChunYu Wang <chunwang@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/scsi_transport_iscsi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2079,7 +2079,7 @@ iscsi_if_rx(struct sk_buff *skb)
uint32_t group;
nlh = nlmsg_hdr(skb);
- if (nlh->nlmsg_len < sizeof(*nlh) ||
+ if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) ||
skb->len < nlh->nlmsg_len) {
break;
}
next prev parent reply other threads:[~2017-10-09 13:20 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-09 12:30 [PATCH 3.2 00/74] 3.2.94-rc1 review Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 51/74] ext3: preserve i_mode if ext2_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 24/74] btrfs: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 16/74] scsi: sun_esp: fix device reference leaks Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 49/74] ext2: preserve i_mode if ext2_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 59/74] [media] saa7164: fix double fetch PCIe access condition Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 06/74] perf/core: Correct event creation with PERF_FORMAT_GROUP Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 01/74] sched/fair, cpumask: Export for_each_cpu_wrap() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 08/74] usb: Fix typo in the definition of Endpoint[out]Request Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 43/74] Input: i8042 - fix crash at boot time Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 57/74] [media] saa7164: fix endian conversion in saa7164_bus_set() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 32/74] IB/core: Add inline function to validate port Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 19/74] PCI: Mark Haswell Power Control Unit as having non-compliant BARs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 66/74] l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 31/74] IB/core: Create common start/end port functions Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 62/74] video: fbdev: aty: do not leak uninitialized padding in clk to userspace Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 70/74] m32r: add definition of ioremap_wc to io.h Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 69/74] perf/x86: Check if user fp is valid Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 07/74] usb: usbip: set buffer pointers to NULL after free Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 20/74] PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11 Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 37/74] cfg80211: Check if PMKID attribute is of expected size Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 36/74] tpm: fix a kernel memory leak in tpm-sysfs.c Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 47/74] vt: fix unchecked __put_user() in tioclinux ioctls Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 30/74] drm/i915: Disable MSI for all pre-gen5 Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 67/74] netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 17/74] MIPS: Fix mips_atomic_set() retry condition Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 14/74] af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers Ben Hutchings
2017-10-09 12:30 ` Ben Hutchings [this message]
2017-10-09 12:30 ` [PATCH 3.2 02/74] sched/topology: Fix building of overlapping sched-groups Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 40/74] fs/dcache.c: fix spin lockup issue on nlru->lock Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 22/74] MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn' Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 38/74] cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 27/74] parisc: use compat_sys_keyctl() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 39/74] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 46/74] mm: fix overflow check in expand_upwards() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 45/74] ubifs: Don't leak kernel memory to the MTD Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 18/74] USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 74/74] cpuset: PF_SPREAD_PAGE and PF_SPREAD_SLAB should be atomic flags Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 05/74] [media] mceusb: fix memory leaks in error path Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 58/74] [media] saa7164: fix sparse warnings Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 04/74] wlcore: fix 64K page support Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 23/74] Add USB quirk for HVR-950q to avoid intermittent device resets Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 71/74] m32r: add io*_rep helpers Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 35/74] rtc: rtc-nuc900: fix loop timeout test Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 42/74] powerpc: Fix emulation of mfocrf in emulate_step() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 54/74] ext4: preserve i_mode if __ext4_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 29/74] ipv6: dad: don't remove dynamic addresses if link is down Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 63/74] xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 50/74] ext3: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 73/74] sched: add macros to define bitops for task atomic flags Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 65/74] Bluetooth: Properly check L2CAP config option output buffer length Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 25/74] PCI/PM: Restore the status of PCI devices across hibernation Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 44/74] ubifs: Correctly evict xattr inodes Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 52/74] reiserfs: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 55/74] ext4: " Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 13/74] xhci: Limit USB2 port wake support for AMD Promontory hosts Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 72/74] net sched filters: fix notification of filter delete with proper handle Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 12/74] udf: Fix deadlock between writeback and udf_setsize() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 26/74] scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 21/74] PM / Domains: Fix unsafe iteration over modified list of device links Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 53/74] reiserfs: preserve i_mode if __reiserfs_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 48/74] ext2: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 28/74] ipv6: always add flag an address that failed DAD with DADFAILED Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 41/74] powerpc/asm: Mark cr0 as clobbered in mftb() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 34/74] s390/syscalls: Fix out of bounds arguments access Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 11/74] udf: Fix races with i_size changes during readpage Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 60/74] nl80211: check for the required netlink attributes presence Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 15/74] scsi: bnx2i: missing error code in bnx2i_ep_connect() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 61/74] kvm: nVMX: Don't allow L2 to access the hardware CR8 Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 68/74] MIPS: Refactor 'clear_page' and 'copy_page' functions Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 33/74] RDMA/uverbs: Check port number supplied by user verbs cmds Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 09/74] PCI: Correct PCI_STD_RESOURCE_END usage Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 03/74] mwifiex: fixup error cases in mwifiex_add_virtual_intf() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 56/74] btrfs: preserve i_mode if __btrfs_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 10/74] md: don't use flush_signals in userspace processes Ben Hutchings
2017-10-09 15:53 ` [PATCH 3.2 00/74] 3.2.94-rc1 review Guenter Roeck
2017-10-09 17:21 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1507552234.401760506@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=chunwang@redhat.com \
--cc=cleech@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lucien.xin@gmail.com \
--cc=martin.petersen@oracle.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome