linux/net/sctp
Xin Long 09279e615c sctp: initialize _pad of sockaddr_in before copying to user memory
Syzbot report a kernel-infoleak:

  BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
  Call Trace:
    _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
    copy_to_user include/linux/uaccess.h:174 [inline]
    sctp_getsockopt_peer_addrs net/sctp/socket.c:5911 [inline]
    sctp_getsockopt+0x1668e/0x17f70 net/sctp/socket.c:7562
    ...
  Uninit was stored to memory at:
    sctp_transport_init net/sctp/transport.c:61 [inline]
    sctp_transport_new+0x16d/0x9a0 net/sctp/transport.c:115
    sctp_assoc_add_peer+0x532/0x1f70 net/sctp/associola.c:637
    sctp_process_param net/sctp/sm_make_chunk.c:2548 [inline]
    sctp_process_init+0x1a1b/0x3ed0 net/sctp/sm_make_chunk.c:2361
    ...
  Bytes 8-15 of 16 are uninitialized

It was caused by that th _pad field (the 8-15 bytes) of a v4 addr (saved in
struct sockaddr_in) wasn't initialized, but directly copied to user memory
in sctp_getsockopt_peer_addrs().

So fix it by calling memset(addr->v4.sin_zero, 0, 8) to initialize _pad of
sockaddr_in before copying it to user memory in sctp_v4_addr_to_user(), as
sctp_v6_addr_to_user() does.

Reported-by: syzbot+86b5c7c236a22616a72f@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Tested-by: Alexander Potapenko <glider@google.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-01 18:08:19 -07:00
..
associola.c sctp: add SCTP_FUTURE_ASSOC for SCTP_PEER_ADDR_THLDS sockopt 2019-01-30 00:44:06 -08:00
auth.c sctp: move up sctp_auth_init_hmacs() in sctp_endpoint_init() 2019-03-08 11:42:49 -08:00
bind_addr.c sctp: add sock_reuseport for the sock in __sctp_hash_endpoint 2018-11-12 09:09:51 -08:00
chunk.c sctp: chunk.c: correct format string for size_t in printk 2019-02-28 10:33:40 -08:00
debug.c sctp: add SCTP_CID_I_DATA and SCTP_CID_I_FWD_TSN conversion in sctp_cname 2018-02-12 11:40:01 -05:00
diag.c inet_diag: fix reporting cgroup classid and fallback to priority 2019-02-12 13:35:57 -05:00
endpointola.c sctp: move up sctp_auth_init_hmacs() in sctp_endpoint_init() 2019-03-08 11:42:49 -08:00
input.c sctp: add sock_reuseport for the sock in __sctp_hash_endpoint 2018-11-12 09:09:51 -08:00
inqueue.c sctp: fix the issue that the cookie-ack with auth can't get processed 2018-05-02 11:15:33 -04:00
ipv6.c sctp: set flow sport from saddr only when it's 0 2019-01-24 18:13:57 -08:00
Kconfig sctp: whitespace fixes 2018-07-24 14:10:42 -07:00
Makefile sctp: rename sctp_diag.c as diag.c 2018-02-13 13:56:31 -05:00
objcnt.c proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
offload.c sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment 2019-02-13 19:31:43 -05:00
output.c sctp: increase sk_wmem_alloc when head->truesize is increased 2018-11-27 15:42:31 -08:00
outqueue.c sctp: add SCTP_FUTURE_ASOC and SCTP_CURRENT_ASSOC for SCTP_STREAM_SCHEDULER sockopt 2019-01-30 00:44:08 -08:00
primitive.c sctp: rename enum sctp_event to sctp_event_type 2018-11-19 12:25:43 -08:00
proc.c sctp: remove useless start_fail from sctp_ht_iter in proc 2018-08-27 15:13:17 -07:00
protocol.c sctp: initialize _pad of sockaddr_in before copying to user memory 2019-04-01 18:08:19 -07:00
sm_make_chunk.c sctp: set chunk transport correctly when it's a new asoc 2019-01-24 18:13:57 -08:00
sm_sideeffect.c sctp: rename enum sctp_event to sctp_event_type 2018-11-19 12:25:43 -08:00
sm_statefuns.c sctp: delay the authentication for the duplicated cookie-echo chunk 2018-05-07 23:39:10 -04:00
sm_statetable.c sctp: rename enum sctp_event to sctp_event_type 2018-11-19 12:25:43 -08:00
socket.c sctp: use memdup_user instead of vmemdup_user 2019-03-20 11:09:47 -07:00
stream_interleave.c sctp: convert to genradix 2019-03-12 10:04:02 -07:00
stream_sched_prio.c net/sctp: Make wrappers for accessing in/out streams 2018-08-11 12:25:15 -07:00
stream_sched_rr.c net/sctp: Make wrappers for accessing in/out streams 2018-08-11 12:25:15 -07:00
stream_sched.c net/sctp: Make wrappers for accessing in/out streams 2018-08-11 12:25:15 -07:00
stream.c sctp: convert to genradix 2019-03-12 10:04:02 -07:00
sysctl.c sctp: support sysctl to allow users to use stream interleave 2017-12-15 13:52:22 -05:00
transport.c sctp: don't compare hb_timer expire date before starting it 2019-02-22 11:11:54 -08:00
tsnmap.c sctp: Fix FSF address in file headers 2013-12-06 12:37:56 -05:00
ulpevent.c sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg 2018-05-10 17:48:36 -04:00
ulpqueue.c sctp: add subscribe per asoc 2018-11-19 12:25:43 -08:00