| From: Eric Dumazet <edumazet@google.com> |
| Date: Wed, 13 Jun 2018 09:13:39 -0700 |
| Subject: netfilter: nf_queue: augment nfqa_cfg_policy |
| |
| commit ba062ebb2cd561d404e0fba8ee4b3f5ebce7cbfc upstream. |
| |
| Three attributes are currently not verified, thus can trigger KMSAN |
| warnings such as : |
| |
| BUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline] |
| BUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:59 [inline] |
| BUG: KMSAN: uninit-value in nfqnl_recv_config+0x939/0x17d0 net/netfilter/nfnetlink_queue.c:1268 |
| CPU: 1 PID: 4521 Comm: syz-executor120 Not tainted 4.17.0+ #5 |
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| Call Trace: |
| __dump_stack lib/dump_stack.c:77 [inline] |
| dump_stack+0x185/0x1d0 lib/dump_stack.c:113 |
| kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117 |
| __msan_warning_32+0x70/0xc0 mm/kmsan/kmsan_instr.c:620 |
| __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline] |
| __fswab32 include/uapi/linux/swab.h:59 [inline] |
| nfqnl_recv_config+0x939/0x17d0 net/netfilter/nfnetlink_queue.c:1268 |
| nfnetlink_rcv_msg+0xb2e/0xc80 net/netfilter/nfnetlink.c:212 |
| netlink_rcv_skb+0x37e/0x600 net/netlink/af_netlink.c:2448 |
| nfnetlink_rcv+0x2fe/0x680 net/netfilter/nfnetlink.c:513 |
| netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] |
| netlink_unicast+0x1680/0x1750 net/netlink/af_netlink.c:1336 |
| netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901 |
| sock_sendmsg_nosec net/socket.c:629 [inline] |
| sock_sendmsg net/socket.c:639 [inline] |
| ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117 |
| __sys_sendmsg net/socket.c:2155 [inline] |
| __do_sys_sendmsg net/socket.c:2164 [inline] |
| __se_sys_sendmsg net/socket.c:2162 [inline] |
| __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162 |
| do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287 |
| entry_SYSCALL_64_after_hwframe+0x44/0xa9 |
| RIP: 0033:0x43fd59 |
| RSP: 002b:00007ffde0e30d28 EFLAGS: 00000213 ORIG_RAX: 000000000000002e |
| RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd59 |
| RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 |
| RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 |
| R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401680 |
| R13: 0000000000401710 R14: 0000000000000000 R15: 0000000000000000 |
| |
| Uninit was created at: |
| kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline] |
| kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:189 |
| kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:315 |
| kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan.c:322 |
| slab_post_alloc_hook mm/slab.h:446 [inline] |
| slab_alloc_node mm/slub.c:2753 [inline] |
| __kmalloc_node_track_caller+0xb35/0x11b0 mm/slub.c:4395 |
| __kmalloc_reserve net/core/skbuff.c:138 [inline] |
| __alloc_skb+0x2cb/0x9e0 net/core/skbuff.c:206 |
| alloc_skb include/linux/skbuff.h:988 [inline] |
| netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline] |
| netlink_sendmsg+0x76e/0x1350 net/netlink/af_netlink.c:1876 |
| sock_sendmsg_nosec net/socket.c:629 [inline] |
| sock_sendmsg net/socket.c:639 [inline] |
| ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117 |
| __sys_sendmsg net/socket.c:2155 [inline] |
| __do_sys_sendmsg net/socket.c:2164 [inline] |
| __se_sys_sendmsg net/socket.c:2162 [inline] |
| __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162 |
| do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287 |
| entry_SYSCALL_64_after_hwframe+0x44/0xa9 |
| |
| Fixes: fdb694a01f1f ("netfilter: Add fail-open support") |
| Fixes: 829e17a1a602 ("[NETFILTER]: nfnetlink_queue: allow changing queue length through netlink") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: syzbot <syzkaller@googlegroups.com> |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| [bwh: Backported to 3.16: adjust filename] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| net/netfilter/nfnetlink_queue_core.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/net/netfilter/nfnetlink_queue_core.c |
| +++ b/net/netfilter/nfnetlink_queue_core.c |
| @@ -1039,6 +1039,9 @@ nfqnl_recv_unsupp(struct sock *ctnl, str |
| static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = { |
| [NFQA_CFG_CMD] = { .len = sizeof(struct nfqnl_msg_config_cmd) }, |
| [NFQA_CFG_PARAMS] = { .len = sizeof(struct nfqnl_msg_config_params) }, |
| + [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 }, |
| + [NFQA_CFG_MASK] = { .type = NLA_U32 }, |
| + [NFQA_CFG_FLAGS] = { .type = NLA_U32 }, |
| }; |
| |
| static const struct nf_queue_handler nfqh = { |