lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0815/1039] SUNRPC: Fix sockaddr handling in the svc_xprt_create_error trace point
    Date
    From: Chuck Lever <chuck.lever@oracle.com>

    [ Upstream commit dc6c6fb3d639756a532bcc47d4a9bf9f3965881b ]

    While testing, I got an unexpected KASAN splat:

    Jan 08 13:50:27 oracle-102.nfsv4.dev kernel: BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_svc_xprt_create_err+0x190/0x210 [sunrpc]
    Jan 08 13:50:27 oracle-102.nfsv4.dev kernel: Read of size 28 at addr ffffc9000008f728 by task mount.nfs/4628

    The memcpy() in the TP_fast_assign section of this trace point
    copies the size of the destination buffer in order that the buffer
    won't be overrun.

    In other similar trace points, the source buffer for this memcpy is
    a "struct sockaddr_storage" so the actual length of the source
    buffer is always long enough to prevent the memcpy from reading
    uninitialized or unallocated memory.

    However, for this trace point, the source buffer can be as small as
    a "struct sockaddr_in". For AF_INET sockaddrs, the memcpy() reads
    memory that follows the source buffer, which is not always valid
    memory.

    To avoid copying past the end of the passed-in sockaddr, make the
    source address's length available to the memcpy(). It would be a
    little nicer if the tracing infrastructure was more friendly about
    storing socket addresses that are not AF_INET, but I could not find
    a way to make printk("%pIS") work with a dynamic array.

    Reported-by: KASAN
    Fixes: 4b8f380e46e4 ("SUNRPC: Tracepoint to record errors in svc_xpo_create()")
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/trace/events/sunrpc.h | 5 +++--
    net/sunrpc/svc_xprt.c | 2 +-
    2 files changed, 4 insertions(+), 3 deletions(-)

    diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
    index 3a99358c262b4..52288f1c1b52d 100644
    --- a/include/trace/events/sunrpc.h
    +++ b/include/trace/events/sunrpc.h
    @@ -1744,10 +1744,11 @@ TRACE_EVENT(svc_xprt_create_err,
    const char *program,
    const char *protocol,
    struct sockaddr *sap,
    + size_t salen,
    const struct svc_xprt *xprt
    ),

    - TP_ARGS(program, protocol, sap, xprt),
    + TP_ARGS(program, protocol, sap, salen, xprt),

    TP_STRUCT__entry(
    __field(long, error)
    @@ -1760,7 +1761,7 @@ TRACE_EVENT(svc_xprt_create_err,
    __entry->error = PTR_ERR(xprt);
    __assign_str(program, program);
    __assign_str(protocol, protocol);
    - memcpy(__entry->addr, sap, sizeof(__entry->addr));
    + memcpy(__entry->addr, sap, min(salen, sizeof(__entry->addr)));
    ),

    TP_printk("addr=%pISpc program=%s protocol=%s error=%ld",
    diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
    index 1e99ba1b9d723..008f1b05a7a9f 100644
    --- a/net/sunrpc/svc_xprt.c
    +++ b/net/sunrpc/svc_xprt.c
    @@ -243,7 +243,7 @@ static struct svc_xprt *__svc_xpo_create(struct svc_xprt_class *xcl,
    xprt = xcl->xcl_ops->xpo_create(serv, net, sap, len, flags);
    if (IS_ERR(xprt))
    trace_svc_xprt_create_err(serv->sv_program->pg_name,
    - xcl->xcl_name, sap, xprt);
    + xcl->xcl_name, sap, len, xprt);
    return xprt;
    }

    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 00:11    [W:4.040 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site