• Eric Dumazet's avatar
    tcp: fix slab-out-of-bounds in tcp_zerocopy_receive() · 3afb0961
    Eric Dumazet authored
    Apparently a refactoring patch brought a bug, that was caught
    by syzbot [1]
    
    Original code was correct, do not try to be smarter than the
    compiler :/
    
    [1]
    BUG: KASAN: slab-out-of-bounds in tcp_zerocopy_receive net/ipv4/tcp.c:1807 [inline]
    BUG: KASAN: slab-out-of-bounds in do_tcp_getsockopt.isra.0+0x2c6c/0x3120 net/ipv4/tcp.c:3654
    Read of size 4 at addr ffff8880943cf188 by task syz-executor.2/17508
    
    CPU: 0 PID: 17508 Comm: syz-executor.2 Not tainted 5.3.0-rc7+ #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0x172/0x1f0 lib/dump_stack.c:113
     print_address_description.cold+0xd4/0x306 mm/kasan/report.c:351
     __kasan_report.cold+0x1b/0x36 mm/kasan/report.c:482
     kasan_report+0x12/0x17 mm/kasan/common.c:618
     __asan_report_load4_noabort+0x14/0x20 mm/kasan/generic_report.c:131
     tcp_zerocopy_receive net/ipv4/tcp.c:1807 [inline]
     do_tcp_getsockopt.isra.0+0x2c6c/0x3120 net/ipv4/tcp.c:3654
     tcp_getsockopt+0xbf/0xe0 net/ipv4/tcp.c:3680
     sock_common_getsockopt+0x94/0xd0 net/core/sock.c:3098
     __sys_getsockopt+0x16d/0x310 net/socket.c:2129
     __do_sys_getsockopt net/socket.c:2144 [inline]
     __se_sys_getsockopt net/socket.c:2141 [inline]
     __x64_sys_getsockopt+0xbe/0x150 net/socket.c:2141
     do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
    
    Fixes: d8e18a51 ("net: Use skb accessors in network core")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
    Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    3afb0961
tcp.c 104 KB