• Xin Long's avatar
    scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly · c88f0e6b
    Xin Long authored
    ChunYu found a kernel crash by syzkaller:
    
    [  651.617875] kasan: CONFIG_KASAN_INLINE enabled
    [  651.618217] kasan: GPF could be caused by NULL-ptr deref or user memory access
    [  651.618731] general protection fault: 0000 [#1] SMP KASAN
    [  651.621543] CPU: 1 PID: 9539 Comm: scsi Not tainted 4.11.0.cov #32
    [  651.621938] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
    [  651.622309] task: ffff880117780000 task.stack: ffff8800a3188000
    [  651.622762] RIP: 0010:skb_release_data+0x26c/0x590
    [...]
    [  651.627260] Call Trace:
    [  651.629156]  skb_release_all+0x4f/0x60
    [  651.629450]  consume_skb+0x1a5/0x600
    [  651.630705]  netlink_unicast+0x505/0x720
    [  651.632345]  netlink_sendmsg+0xab2/0xe70
    [  651.633704]  sock_sendmsg+0xcf/0x110
    [  651.633942]  ___sys_sendmsg+0x833/0x980
    [  651.637117]  __sys_sendmsg+0xf3/0x240
    [  651.638820]  SyS_sendmsg+0x32/0x50
    [  651.639048]  entry_SYSCALL_64_fastpath+0x1f/0xc2
    
    It's caused by skb_shared_info at the end of sk_buff was overwritten by
    ISCSI_KEVENT_IF_ERROR when parsing nlmsg info from skb in iscsi_if_rx.
    
    During the loop if skb->len == nlh->nlmsg_len and both are sizeof(*nlh),
    ev = nlmsg_data(nlh) will acutally get skb_shinfo(SKB) instead and set a
    new value to skb_shinfo(SKB)->nr_frags by ev->type.
    
    This patch is to fix it by checking nlh->nlmsg_len properly there to
    avoid over accessing sk_buff.
    Reported-by: default avatarChunYu Wang <chunwang@redhat.com>
    Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
    Acked-by: default avatarChris Leech <cleech@redhat.com>
    Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
    c88f0e6b
scsi_transport_iscsi.c 138 KB