mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Samuel PageandJakub Kicinski
2b66974a1b
A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its
data area. tipc_get_gap_ack_blks() only verifies that the record's len
field is self-consistent with its ugack_cnt/bgack_cnt counts
(sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check
that the record actually fits in the message data area, msg_data_sz().
The unicast caller tipc_link_proto_rcv() bounds it ("if (glen > dlen)
break;"), but the broadcast caller tipc_bcast_sync_rcv() discards the
returned size, so tipc_link_advance_transmq() copies the record off the
receive skb with an attacker-controlled count:
this_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt),
GFP_ATOMIC);
A TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one
ordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its
data area is short, carrying a Gap ACK record with len = 0x400,
bgack_cnt = 0xff and ugack_cnt = 0. len then equals
struct_size(p, gacks, 255), so the consistency check passes and ga is
non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out
of the much smaller skb:
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60
Read of size 1024 at addr ffff0000c7030d38 by task poc864/69
Call trace:
kmemdup_noprof+0x48/0x60
tipc_link_advance_transmq+0x86c/0xb80
tipc_link_bc_ack_rcv+0x19c/0x1e0
tipc_bcast_sync_rcv+0x1c4/0x2c4
tipc_rcv+0x85c/0x1340
tipc_l2_rcv_msg+0xac/0x104
The buggy address belongs to the object at ffff0000c7030d00
which belongs to the cache skbuff_small_head of size 704
The buggy address is located 56 bytes inside of
allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0)
The copied-out bytes are subsequently consumed as gap/ack values, but
the read is already out of bounds at the kmemdup() regardless of how
they are used.
The unicast STATE path drops such a message: "if (glen > dlen) break;"
skips the rest of STATE_MSG handling and the skb is freed. Make the
broadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record
against msg_data_sz() and, when it does not fit, reports it back through
tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than
processed. ga is not cleared on this path: ga == NULL already means
"legacy peer without Selective ACK", a distinct legitimate state.
Fixes: d7626b5acf ("tipc: introduce Gap ACK blocks for broadcast link")
Cc: stable@vger.kernel.org
Signed-off-by: Samuel Page <sam@bynar.io>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260625143815.1525412-1-sam@bynar.io
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
128 lines
4.6 KiB
C
128 lines
4.6 KiB
C
/*
|
|
* net/tipc/bcast.h: Include file for TIPC broadcast code
|
|
*
|
|
* Copyright (c) 2003-2006, 2014-2015, Ericsson AB
|
|
* Copyright (c) 2005, 2010-2011, Wind River Systems
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. Neither the names of the copyright holders nor the names of its
|
|
* contributors may be used to endorse or promote products derived from
|
|
* this software without specific prior written permission.
|
|
*
|
|
* Alternatively, this software may be distributed under the terms of the
|
|
* GNU General Public License ("GPL") version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
|
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
|
|
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#ifndef _TIPC_BCAST_H
|
|
#define _TIPC_BCAST_H
|
|
|
|
#include "core.h"
|
|
|
|
struct tipc_node;
|
|
struct tipc_msg;
|
|
struct tipc_nl_msg;
|
|
struct tipc_nlist;
|
|
struct tipc_nitem;
|
|
extern const char tipc_bclink_name[];
|
|
extern unsigned long sysctl_tipc_bc_retruni;
|
|
|
|
#define TIPC_METHOD_EXPIRE msecs_to_jiffies(5000)
|
|
|
|
#define BCLINK_MODE_BCAST 0x1
|
|
#define BCLINK_MODE_RCAST 0x2
|
|
#define BCLINK_MODE_SEL 0x4
|
|
|
|
struct tipc_nlist {
|
|
struct list_head list;
|
|
u32 self;
|
|
u16 remote;
|
|
bool local;
|
|
};
|
|
|
|
void tipc_nlist_init(struct tipc_nlist *nl, u32 self);
|
|
void tipc_nlist_purge(struct tipc_nlist *nl);
|
|
void tipc_nlist_add(struct tipc_nlist *nl, u32 node);
|
|
void tipc_nlist_del(struct tipc_nlist *nl, u32 node);
|
|
|
|
/* Cookie to be used between socket and broadcast layer
|
|
* @rcast: replicast (instead of broadcast) was used at previous xmit
|
|
* @mandatory: broadcast/replicast indication was set by user
|
|
* @deferredq: defer queue to make message in order
|
|
* @expires: re-evaluate non-mandatory transmit method if we are past this
|
|
*/
|
|
struct tipc_mc_method {
|
|
bool rcast;
|
|
bool mandatory;
|
|
struct sk_buff_head deferredq;
|
|
unsigned long expires;
|
|
};
|
|
|
|
int tipc_bcast_init(struct net *net);
|
|
void tipc_bcast_stop(struct net *net);
|
|
void tipc_bcast_add_peer(struct net *net, struct tipc_link *l,
|
|
struct sk_buff_head *xmitq);
|
|
void tipc_bcast_remove_peer(struct net *net, struct tipc_link *rcv_bcl);
|
|
void tipc_bcast_inc_bearer_dst_cnt(struct net *net, int bearer_id);
|
|
void tipc_bcast_dec_bearer_dst_cnt(struct net *net, int bearer_id);
|
|
int tipc_bcast_get_mtu(struct net *net);
|
|
void tipc_bcast_toggle_rcast(struct net *net, bool supp);
|
|
int tipc_mcast_xmit(struct net *net, struct sk_buff_head *pkts,
|
|
struct tipc_mc_method *method, struct tipc_nlist *dests,
|
|
u16 *cong_link_cnt);
|
|
int tipc_bcast_xmit(struct net *net, struct sk_buff_head *pkts,
|
|
u16 *cong_link_cnt);
|
|
int tipc_bcast_rcv(struct net *net, struct tipc_link *l, struct sk_buff *skb);
|
|
void tipc_bcast_ack_rcv(struct net *net, struct tipc_link *l,
|
|
struct tipc_msg *hdr);
|
|
int tipc_bcast_sync_rcv(struct net *net, struct tipc_link *l,
|
|
struct tipc_msg *hdr,
|
|
struct sk_buff_head *retrq, bool *valid);
|
|
int tipc_nl_add_bc_link(struct net *net, struct tipc_nl_msg *msg,
|
|
struct tipc_link *bcl);
|
|
int tipc_nl_bc_link_set(struct net *net, struct nlattr *attrs[]);
|
|
int tipc_bclink_reset_stats(struct net *net, struct tipc_link *l);
|
|
|
|
u32 tipc_bcast_get_mode(struct net *net);
|
|
u32 tipc_bcast_get_broadcast_ratio(struct net *net);
|
|
|
|
void tipc_mcast_filter_msg(struct net *net, struct sk_buff_head *defq,
|
|
struct sk_buff_head *inputq);
|
|
|
|
static inline void tipc_bcast_lock(struct net *net)
|
|
{
|
|
spin_lock_bh(&tipc_net(net)->bclock);
|
|
}
|
|
|
|
static inline void tipc_bcast_unlock(struct net *net)
|
|
{
|
|
spin_unlock_bh(&tipc_net(net)->bclock);
|
|
}
|
|
|
|
static inline struct tipc_link *tipc_bc_sndlink(struct net *net)
|
|
{
|
|
return tipc_net(net)->bcl;
|
|
}
|
|
|
|
#endif
|