From nobody Wed Apr 8 10:15:06 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB790C04A95 for ; Tue, 25 Oct 2022 06:07:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231127AbiJYGHJ (ORCPT ); Tue, 25 Oct 2022 02:07:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57758 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230221AbiJYGHG (ORCPT ); Tue, 25 Oct 2022 02:07:06 -0400 Received: from formenos.hmeau.com (helcar.hmeau.com [216.24.177.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 12A9EABD4D; Mon, 24 Oct 2022 23:07:05 -0700 (PDT) Received: from loth.rohan.me.apana.org.au ([192.168.167.2]) by formenos.hmeau.com with smtp (Exim 4.94.2 #2 (Debian)) id 1onD4l-0064BC-Tl; Tue, 25 Oct 2022 14:06:49 +0800 Received: by loth.rohan.me.apana.org.au (sSMTP sendmail emulation); Tue, 25 Oct 2022 14:06:48 +0800 Date: Tue, 25 Oct 2022 14:06:48 +0800 From: Herbert Xu To: Sabrina Dubroca Cc: Eric Dumazet , syzbot , davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, pabeni@redhat.com, steffen.klassert@secunet.com, syzkaller-bugs@googlegroups.com Subject: [v3 PATCH] af_key: Fix send_acquire race with pfkey_register Message-ID: References: <000000000000fd9a4005ebbeac67@google.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On Mon, Oct 24, 2022 at 09:20:00AM +0200, Sabrina Dubroca wrote: > 2022-10-24, 14:06:12 +0800, Herbert Xu wrote: > > @@ -1697,11 +1699,11 @@ static int pfkey_register(struct sock *sk, stru= ct sk_buff *skb, const struct sad > > pfk->registered |=3D (1<sadb_msg_satype); > > } > > =20 > > - mutex_lock(&pfkey_mutex); > > + spin_lock_bh(&pfkey_alg_lock); > > xfrm_probe_algs(); >=20 > I don't think we can do that: >=20 > void xfrm_probe_algs(void) > { > int i, status; >=20 > BUG_ON(in_softirq()); Indeed. I was also wrong in stating that this bug was created by namespaces. This race has always existed since this code was first added. Reported-by: syzbot+1e9af9185d8850e2c2fa@syzkaller.appspotmail.com Reviewed-by: Eric Dumazet Reviewed-by: Sabrina Dubroca ---8<--- The function pfkey_send_acquire may race with pfkey_register (which could even be in a different name space). This may result in a buffer overrun. Allocating the maximum amount of memory that could be used prevents this. Reported-by: syzbot+1e9af9185d8850e2c2fa@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Herbert Xu diff --git a/net/key/af_key.c b/net/key/af_key.c index c85df5b958d2..213287814328 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -2905,7 +2905,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t) break; if (!aalg->pfkey_supported) continue; - if (aalg_tmpl_set(t, aalg) && aalg->available) + if (aalg_tmpl_set(t, aalg)) sz +=3D sizeof(struct sadb_comb); } return sz + sizeof(struct sadb_prop); @@ -2923,7 +2923,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t) if (!ealg->pfkey_supported) continue; =20 - if (!(ealg_tmpl_set(t, ealg) && ealg->available)) + if (!(ealg_tmpl_set(t, ealg))) continue; =20 for (k =3D 1; ; k++) { @@ -2934,16 +2934,17 @@ static int count_esp_combs(const struct xfrm_tmpl *= t) if (!aalg->pfkey_supported) continue; =20 - if (aalg_tmpl_set(t, aalg) && aalg->available) + if (aalg_tmpl_set(t, aalg)) sz +=3D sizeof(struct sadb_comb); } } return sz + sizeof(struct sadb_prop); } =20 -static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) +static int dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) { struct sadb_prop *p; + int sz =3D 0; int i; =20 p =3D skb_put(skb, sizeof(struct sadb_prop)); @@ -2971,13 +2972,17 @@ static void dump_ah_combs(struct sk_buff *skb, cons= t struct xfrm_tmpl *t) c->sadb_comb_soft_addtime =3D 20*60*60; c->sadb_comb_hard_usetime =3D 8*60*60; c->sadb_comb_soft_usetime =3D 7*60*60; + sz +=3D sizeof(*c); } } + + return sz + sizeof(*p); } =20 -static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) +static int dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) { struct sadb_prop *p; + int sz =3D 0; int i, k; =20 p =3D skb_put(skb, sizeof(struct sadb_prop)); @@ -3019,8 +3024,11 @@ static void dump_esp_combs(struct sk_buff *skb, cons= t struct xfrm_tmpl *t) c->sadb_comb_soft_addtime =3D 20*60*60; c->sadb_comb_hard_usetime =3D 8*60*60; c->sadb_comb_soft_usetime =3D 7*60*60; + sz +=3D sizeof(*c); } } + + return sz + sizeof(*p); } =20 static int key_notify_policy_expire(struct xfrm_policy *xp, const struct k= m_event *c) @@ -3150,6 +3158,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, s= truct xfrm_tmpl *t, struct struct sadb_x_sec_ctx *sec_ctx; struct xfrm_sec_ctx *xfrm_ctx; int ctx_size =3D 0; + int alg_size =3D 0; =20 sockaddr_size =3D pfkey_sockaddr_size(x->props.family); if (!sockaddr_size) @@ -3161,16 +3170,16 @@ static int pfkey_send_acquire(struct xfrm_state *x,= struct xfrm_tmpl *t, struct sizeof(struct sadb_x_policy); =20 if (x->id.proto =3D=3D IPPROTO_AH) - size +=3D count_ah_combs(t); + alg_size =3D count_ah_combs(t); else if (x->id.proto =3D=3D IPPROTO_ESP) - size +=3D count_esp_combs(t); + alg_size =3D count_esp_combs(t); =20 if ((xfrm_ctx =3D x->security)) { ctx_size =3D PFKEY_ALIGN8(xfrm_ctx->ctx_len); size +=3D sizeof(struct sadb_x_sec_ctx) + ctx_size; } =20 - skb =3D alloc_skb(size + 16, GFP_ATOMIC); + skb =3D alloc_skb(size + alg_size + 16, GFP_ATOMIC); if (skb =3D=3D NULL) return -ENOMEM; =20 @@ -3224,10 +3233,13 @@ static int pfkey_send_acquire(struct xfrm_state *x,= struct xfrm_tmpl *t, struct pol->sadb_x_policy_priority =3D xp->priority; =20 /* Set sadb_comb's. */ + alg_size =3D 0; if (x->id.proto =3D=3D IPPROTO_AH) - dump_ah_combs(skb, t); + alg_size =3D dump_ah_combs(skb, t); else if (x->id.proto =3D=3D IPPROTO_ESP) - dump_esp_combs(skb, t); + alg_size =3D dump_esp_combs(skb, t); + + hdr->sadb_msg_len +=3D alg_size / 8; =20 /* security context */ if (xfrm_ctx) { --=20 Email: Herbert Xu Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt