Revision 633593a808980f82d251d0ca89730d8bb8b0220c authored by Eric Dumazet on 10 March 2022, 00:11:45 UTC, committed by Jakub Kicinski on 10 March 2022, 22:46:42 UTC
syzbot reported a kernel infoleak [1] of 4 bytes. After analysis, it turned out r->idiag_expires is not initialized if inet_sctp_diag_fill() calls inet_diag_msg_common_fill() Make sure to clear idiag_timer/idiag_retrans/idiag_expires and let inet_diag_msg_sctpasoc_fill() fill them again if needed. [1] BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:154 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668 instrument_copy_to_user include/linux/instrumented.h:121 [inline] copyout lib/iov_iter.c:154 [inline] _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668 copy_to_iter include/linux/uio.h:162 [inline] simple_copy_to_iter+0xf3/0x140 net/core/datagram.c:519 __skb_datagram_iter+0x2d5/0x11b0 net/core/datagram.c:425 skb_copy_datagram_iter+0xdc/0x270 net/core/datagram.c:533 skb_copy_datagram_msg include/linux/skbuff.h:3696 [inline] netlink_recvmsg+0x669/0x1c80 net/netlink/af_netlink.c:1977 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] __sys_recvfrom+0x795/0xa10 net/socket.c:2097 __do_sys_recvfrom net/socket.c:2115 [inline] __se_sys_recvfrom net/socket.c:2111 [inline] __x64_sys_recvfrom+0x19d/0x210 net/socket.c:2111 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3247 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4975 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1158 [inline] netlink_dump+0x3e5/0x16c0 net/netlink/af_netlink.c:2248 __netlink_dump_start+0xcf8/0xe90 net/netlink/af_netlink.c:2373 netlink_dump_start include/linux/netlink.h:254 [inline] inet_diag_handler_cmd+0x2e7/0x400 net/ipv4/inet_diag.c:1341 sock_diag_rcv_msg+0x24a/0x620 netlink_rcv_skb+0x40c/0x7e0 net/netlink/af_netlink.c:2494 sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:277 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x1093/0x1360 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x14d9/0x1720 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] sock_write_iter+0x594/0x690 net/socket.c:1061 do_iter_readv_writev+0xa7f/0xc70 do_iter_write+0x52c/0x1500 fs/read_write.c:851 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Bytes 68-71 of 2508 are uninitialized Memory access of size 2508 starts at ffff888114f9b000 Data copied to user address 00007f7fe09ff2e0 CPU: 1 PID: 3478 Comm: syz-executor306 Not tainted 5.17.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Vlad Yasevich <vyasevich@gmail.com> Cc: Neil Horman <nhorman@tuxdriver.com> Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Link: https://lore.kernel.org/r/20220310001145.297371-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 26183cf
File | Mode | Size |
---|---|---|
atomic | ||
basic | ||
clang-tools | ||
coccinelle | ||
dtc | ||
dummy-tools | ||
gcc-plugins | ||
gdb | ||
genksyms | ||
kconfig | ||
ksymoops | ||
mod | ||
package | ||
selinux | ||
tracing | ||
.gitignore | -rw-r--r-- | 146 bytes |
Kbuild.include | -rw-r--r-- | 7.3 KB |
Kconfig.include | -rw-r--r-- | 2.6 KB |
Lindent | -rwxr-xr-x | 502 bytes |
Makefile | -rw-r--r-- | 1.4 KB |
Makefile.asm-generic | -rw-r--r-- | 1.8 KB |
Makefile.build | -rw-r--r-- | 19.2 KB |
Makefile.clang | -rw-r--r-- | 1.6 KB |
Makefile.clean | -rw-r--r-- | 2.2 KB |
Makefile.compiler | -rw-r--r-- | 2.7 KB |
Makefile.debug | -rw-r--r-- | 706 bytes |
Makefile.dtbinst | -rw-r--r-- | 999 bytes |
Makefile.extrawarn | -rw-r--r-- | 2.8 KB |
Makefile.gcc-plugins | -rw-r--r-- | 2.6 KB |
Makefile.headersinst | -rw-r--r-- | 2.9 KB |
Makefile.host | -rw-r--r-- | 4.6 KB |
Makefile.kasan | -rw-r--r-- | 1.7 KB |
Makefile.kcov | -rw-r--r-- | 333 bytes |
Makefile.kcsan | -rw-r--r-- | 1004 bytes |
Makefile.lib | -rw-r--r-- | 19.0 KB |
Makefile.modfinal | -rw-r--r-- | 2.7 KB |
Makefile.modinst | -rw-r--r-- | 2.4 KB |
Makefile.modpost | -rw-r--r-- | 4.4 KB |
Makefile.package | -rw-r--r-- | 6.9 KB |
Makefile.ubsan | -rw-r--r-- | 770 bytes |
Makefile.userprogs | -rw-r--r-- | 1.6 KB |
adjust_autoksyms.sh | -rwxr-xr-x | 2.1 KB |
as-version.sh | -rwxr-xr-x | 2.0 KB |
asn1_compiler.c | -rw-r--r-- | 35.3 KB |
bin2c.c | -rw-r--r-- | 743 bytes |
bloat-o-meter | -rwxr-xr-x | 3.4 KB |
bootgraph.pl | -rwxr-xr-x | 5.6 KB |
bpf_doc.py | -rwxr-xr-x | 25.0 KB |
cc-can-link.sh | -rwxr-xr-x | 166 bytes |
cc-version.sh | -rwxr-xr-x | 1.5 KB |
check-sysctl-docs | -rwxr-xr-x | 4.4 KB |
check_extable.sh | -rwxr-xr-x | 4.9 KB |
checkdeclares.pl | -rwxr-xr-x | 1.1 KB |
checkincludes.pl | -rwxr-xr-x | 1.9 KB |
checkkconfigsymbols.py | -rwxr-xr-x | 15.4 KB |
checkpatch.pl | -rwxr-xr-x | 224.7 KB |
checkstack.pl | -rwxr-xr-x | 5.9 KB |
checksyscalls.sh | -rwxr-xr-x | 7.4 KB |
checkversion.pl | -rwxr-xr-x | 2.2 KB |
cleanfile | -rwxr-xr-x | 3.5 KB |
cleanpatch | -rwxr-xr-x | 5.1 KB |
coccicheck | -rwxr-xr-x | 7.9 KB |
config | -rwxr-xr-x | 4.7 KB |
const_structs.checkpatch | -rw-r--r-- | 1.4 KB |
decode_stacktrace.sh | -rwxr-xr-x | 6.6 KB |
decodecode | -rwxr-xr-x | 2.9 KB |
depmod.sh | -rwxr-xr-x | 1.4 KB |
dev-needs.sh | -rwxr-xr-x | 6.1 KB |
diffconfig | -rwxr-xr-x | 3.7 KB |
documentation-file-ref-check | -rwxr-xr-x | 5.7 KB |
export_report.pl | -rwxr-xr-x | 4.5 KB |
extract-ikconfig | -rwxr-xr-x | 1.7 KB |
extract-module-sig.pl | -rwxr-xr-x | 3.7 KB |
extract-sys-certs.pl | -rwxr-xr-x | 3.7 KB |
extract-vmlinux | -rwxr-xr-x | 1.7 KB |
extract_xc3028.pl | -rwxr-xr-x | 44.6 KB |
faddr2line | -rwxr-xr-x | 6.2 KB |
file-size.sh | -rwxr-xr-x | 86 bytes |
find-unused-docs.sh | -rwxr-xr-x | 1.3 KB |
gcc-goto.sh | -rwxr-xr-x | 511 bytes |
gcc-ld | -rwxr-xr-x | 711 bytes |
gcc-x86_32-has-stack-protector.sh | -rwxr-xr-x | 408 bytes |
gcc-x86_64-has-stack-protector.sh | -rwxr-xr-x | 198 bytes |
gen_autoksyms.sh | -rwxr-xr-x | 1.4 KB |
gen_ksymdeps.sh | -rwxr-xr-x | 556 bytes |
generate_initcall_order.pl | -rwxr-xr-x | 5.9 KB |
get_abi.pl | -rwxr-xr-x | 25.3 KB |
get_dvb_firmware | -rwxr-xr-x | 24.5 KB |
get_feat.pl | -rwxr-xr-x | 14.3 KB |
get_maintainer.pl | -rwxr-xr-x | 67.1 KB |
gfp-translate | -rwxr-xr-x | 1.7 KB |
headerdep.pl | -rwxr-xr-x | 3.5 KB |
headers_install.sh | -rwxr-xr-x | 3.4 KB |
insert-sys-cert.c | -rw-r--r-- | 8.9 KB |
jobserver-exec | -rwxr-xr-x | 2.2 KB |
kallsyms.c | -rw-r--r-- | 18.1 KB |
kernel-doc | -rwxr-xr-x | 68.9 KB |
ld-version.sh | -rwxr-xr-x | 1.7 KB |
leaking_addresses.pl | -rwxr-xr-x | 12.8 KB |
link-vmlinux.sh | -rwxr-xr-x | 10.8 KB |
makelst | -rwxr-xr-x | 808 bytes |
markup_oops.pl | -rwxr-xr-x | 7.9 KB |
min-tool-version.sh | -rwxr-xr-x | 558 bytes |
mkcompile_h | -rwxr-xr-x | 2.5 KB |
mksysmap | -rwxr-xr-x | 1.3 KB |
mkuboot.sh | -rwxr-xr-x | 414 bytes |
module.lds.S | -rw-r--r-- | 1.5 KB |
modules-check.sh | -rwxr-xr-x | 427 bytes |
nsdeps | -rw-r--r-- | 1.7 KB |
objdiff | -rwxr-xr-x | 2.8 KB |
pahole-flags.sh | -rwxr-xr-x | 519 bytes |
parse-maintainers.pl | -rwxr-xr-x | 4.5 KB |
patch-kernel | -rwxr-xr-x | 9.9 KB |
profile2linkerlist.pl | -rwxr-xr-x | 414 bytes |
prune-kernel | -rwxr-xr-x | 708 bytes |
recordmcount.c | -rw-r--r-- | 16.7 KB |
recordmcount.h | -rw-r--r-- | 19.4 KB |
recordmcount.pl | -rwxr-xr-x | 17.6 KB |
remove-stale-files | -rwxr-xr-x | 1.6 KB |
setlocalversion | -rwxr-xr-x | 3.6 KB |
show_delta | -rwxr-xr-x | 3.0 KB |
sign-file.c | -rw-r--r-- | 9.8 KB |
sorttable.c | -rw-r--r-- | 8.8 KB |
sorttable.h | -rw-r--r-- | 12.9 KB |
spdxcheck-test.sh | -rw-r--r-- | 277 bytes |
spdxcheck.py | -rwxr-xr-x | 10.1 KB |
spelling.txt | -rw-r--r-- | 32.2 KB |
sphinx-pre-install | -rwxr-xr-x | 24.4 KB |
split-man.pl | -rwxr-xr-x | 604 bytes |
stackdelta | -rwxr-xr-x | 1.8 KB |
stackusage | -rwxr-xr-x | 794 bytes |
subarch.include | -rw-r--r-- | 619 bytes |
syscallhdr.sh | -rwxr-xr-x | 1.9 KB |
syscallnr.sh | -rwxr-xr-x | 1.5 KB |
syscalltbl.sh | -rwxr-xr-x | 1.5 KB |
tags.sh | -rwxr-xr-x | 10.4 KB |
test_fortify.sh | -rw-r--r-- | 1.8 KB |
tools-support-relr.sh | -rwxr-xr-x | 546 bytes |
unifdef.c | -rw-r--r-- | 34.8 KB |
ver_linux | -rwxr-xr-x | 2.6 KB |
xen-hypercalls.sh | -rwxr-xr-x | 386 bytes |
xz_wrap.sh | -rwxr-xr-x | 563 bytes |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...