|
Jiri Slaby |
ef7db2 |
From: Eric Dumazet <edumazet@google.com>
|
|
Jiri Slaby |
ef7db2 |
Date: Fri, 17 Feb 2023 18:24:54 +0000
|
|
Jiri Slaby |
ef7db2 |
Subject: [PATCH] scm: add user copy checks to put_cmsg()
|
|
Jiri Slaby |
ef7db2 |
References: bsc#1012628
|
|
Jiri Slaby |
ef7db2 |
Patch-mainline: 6.2.3
|
|
Jiri Slaby |
ef7db2 |
Git-commit: 5f1eb1ff58ea122e24adf0bc940f268ed2227462
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
[ Upstream commit 5f1eb1ff58ea122e24adf0bc940f268ed2227462 ]
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
This is a followup of commit 2558b8039d05 ("net: use a bounce
|
|
Jiri Slaby |
ef7db2 |
buffer for copying skb->mark")
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
x86 and powerpc define user_access_begin, meaning
|
|
Jiri Slaby |
ef7db2 |
that they are not able to perform user copy checks
|
|
Jiri Slaby |
ef7db2 |
when using user_write_access_begin() / unsafe_copy_to_user()
|
|
Jiri Slaby |
ef7db2 |
and friends [1]
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
Instead of waiting bugs to trigger on other arches,
|
|
Jiri Slaby |
ef7db2 |
add a check_object_size() in put_cmsg() to make sure
|
|
Jiri Slaby |
ef7db2 |
that new code tested on x86 with CONFIG_HARDENED_USERCOPY=y
|
|
Jiri Slaby |
ef7db2 |
will perform more security checks.
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
[1] We can not generically call check_object_size() from
|
|
Jiri Slaby |
ef7db2 |
unsafe_copy_to_user() because UACCESS is enabled at this point.
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
|
Jiri Slaby |
ef7db2 |
Cc: Kees Cook <keescook@chromium.org>
|
|
Jiri Slaby |
ef7db2 |
Acked-by: Kees Cook <keescook@chromium.org>
|
|
Jiri Slaby |
ef7db2 |
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
Jiri Slaby |
ef7db2 |
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
Jiri Slaby |
ef7db2 |
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
|
|
Jiri Slaby |
ef7db2 |
---
|
|
Jiri Slaby |
ef7db2 |
net/core/scm.c | 2 ++
|
|
Jiri Slaby |
ef7db2 |
1 file changed, 2 insertions(+)
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
diff --git a/net/core/scm.c b/net/core/scm.c
|
|
Jiri Slaby |
ef7db2 |
index 5c356f0d..acb7d776 100644
|
|
Jiri Slaby |
ef7db2 |
--- a/net/core/scm.c
|
|
Jiri Slaby |
ef7db2 |
+++ b/net/core/scm.c
|
|
Jiri Slaby |
ef7db2 |
@@ -229,6 +229,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
|
|
Jiri Slaby |
ef7db2 |
if (msg->msg_control_is_user) {
|
|
Jiri Slaby |
ef7db2 |
struct cmsghdr __user *cm = msg->msg_control_user;
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
+ check_object_size(data, cmlen - sizeof(*cm), true);
|
|
Jiri Slaby |
ef7db2 |
+
|
|
Jiri Slaby |
ef7db2 |
if (!user_write_access_begin(cm, cmlen))
|
|
Jiri Slaby |
ef7db2 |
goto efault;
|
|
Jiri Slaby |
ef7db2 |
|
|
Jiri Slaby |
ef7db2 |
--
|
|
Jiri Slaby |
ef7db2 |
2.35.3
|
|
Jiri Slaby |
ef7db2 |
|