• Kees Cook's avatar
    skbuff: Introduce slab_build_skb() · ce098da1
    Kees Cook authored
    syzkaller reported:
    
      BUG: KASAN: slab-out-of-bounds in __build_skb_around+0x235/0x340 net/core/skbuff.c:294
      Write of size 32 at addr ffff88802aa172c0 by task syz-executor413/5295
    
    For bpf_prog_test_run_skb(), which uses a kmalloc()ed buffer passed to
    build_skb().
    
    When build_skb() is passed a frag_size of 0, it means the buffer came
    from kmalloc. In these cases, ksize() is used to find its actual size,
    but since the allocation may not have been made to that size, actually
    perform the krealloc() call so that all the associated buffer size
    checking will be correctly notified (and use the "new" pointer so that
    compiler hinting works correctly). Split this logic out into a new
    interface, slab_build_skb(), but leave the original 0 checking for now
    to catch any stragglers.
    
    Reported-by: syzbot+fda18eaa8c12534ccb3b@syzkaller.appspotmail.com
    Link: https://groups.google.com/g/syzkaller-bugs/c/UnIKxTtU5-0/m/-wbXinkgAQAJ
    Fixes: 38931d89 ("mm: Make ksize() a reporting-only function")
    Cc: Pavel Begunkov <asml.silence@gmail.com>
    Cc: pepsipu <soopthegoop@gmail.com>
    Cc: syzbot+fda18eaa8c12534ccb3b@syzkaller.appspotmail.com
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: kasan-dev <kasan-dev@googlegroups.com>
    Cc: Andrii Nakryiko <andrii@kernel.org>
    Cc: ast@kernel.org
    Cc: Daniel Borkmann <daniel@iogearbox.net>
    Cc: Hao Luo <haoluo@google.com>
    Cc: Jesper Dangaard Brouer <hawk@kernel.org>
    Cc: John Fastabend <john.fastabend@gmail.com>
    Cc: jolsa@kernel.org
    Cc: KP Singh <kpsingh@kernel.org>
    Cc: martin.lau@linux.dev
    Cc: Stanislav Fomichev <sdf@google.com>
    Cc: song@kernel.org
    Cc: Yonghong Song <yhs@fb.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/r/20221208060256.give.994-kees@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    ce098da1
skbuff.c 168 KB