lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 317/846] ppp: ensure minimum packet size in ppp_write()
    Date
    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit 44073187990d5629804ce0627525f6ea5cfef171 ]

    It seems pretty clear ppp layer assumed user space
    would always be kind to provide enough data
    in their write() to a ppp device.

    This patch makes sure user provides at least
    2 bytes.

    It adds PPP_PROTO_LEN macro that could replace
    in net-next many occurrences of hard-coded 2 value.

    I replaced only one occurrence to ease backports
    to stable kernels.

    The bug manifests in the following report:

    BUG: KMSAN: uninit-value in ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740
    ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740
    __ppp_xmit_process+0x23e/0x4b0 drivers/net/ppp/ppp_generic.c:1640
    ppp_xmit_process+0x1fe/0x480 drivers/net/ppp/ppp_generic.c:1661
    ppp_write+0x5cb/0x5e0 drivers/net/ppp/ppp_generic.c:513
    do_iter_write+0xb0c/0x1500 fs/read_write.c:853
    vfs_writev fs/read_write.c:924 [inline]
    do_writev+0x645/0xe00 fs/read_write.c:967
    __do_sys_writev fs/read_write.c:1040 [inline]
    __se_sys_writev fs/read_write.c:1037 [inline]
    __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037
    do_syscall_x64 arch/x86/entry/common.c:51 [inline]
    do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    Uninit was created at:
    slab_post_alloc_hook mm/slab.h:524 [inline]
    slab_alloc_node mm/slub.c:3251 [inline]
    __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
    kmalloc_reserve net/core/skbuff.c:354 [inline]
    __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
    alloc_skb include/linux/skbuff.h:1126 [inline]
    ppp_write+0x11d/0x5e0 drivers/net/ppp/ppp_generic.c:501
    do_iter_write+0xb0c/0x1500 fs/read_write.c:853
    vfs_writev fs/read_write.c:924 [inline]
    do_writev+0x645/0xe00 fs/read_write.c:967
    __do_sys_writev fs/read_write.c:1040 [inline]
    __se_sys_writev fs/read_write.c:1037 [inline]
    __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037
    do_syscall_x64 arch/x86/entry/common.c:51 [inline]
    do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: linux-ppp@vger.kernel.org
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Acked-by: Guillaume Nault <gnault@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ppp/ppp_generic.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
    index fb52cd175b45d..829d6ada1704c 100644
    --- a/drivers/net/ppp/ppp_generic.c
    +++ b/drivers/net/ppp/ppp_generic.c
    @@ -69,6 +69,8 @@
    #define MPHDRLEN 6 /* multilink protocol header length */
    #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */

    +#define PPP_PROTO_LEN 2
    +
    /*
    * An instance of /dev/ppp can be associated with either a ppp
    * interface unit or a ppp channel. In both cases, file->private_data
    @@ -497,6 +499,9 @@ static ssize_t ppp_write(struct file *file, const char __user *buf,

    if (!pf)
    return -ENXIO;
    + /* All PPP packets should start with the 2-byte protocol */
    + if (count < PPP_PROTO_LEN)
    + return -EINVAL;
    ret = -ENOMEM;
    skb = alloc_skb(count + pf->hdrlen, GFP_KERNEL);
    if (!skb)
    @@ -1764,7 +1769,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
    }

    ++ppp->stats64.tx_packets;
    - ppp->stats64.tx_bytes += skb->len - 2;
    + ppp->stats64.tx_bytes += skb->len - PPP_PROTO_LEN;

    switch (proto) {
    case PPP_IP:
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 00:11    [W:4.065 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site