github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-08-05 06:47:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
2c4a1efcf6
linux/drivers/net/ethernet/broadcom
History
Kees Cook ce098da149 skbuff: Introduce slab_build_skb() 
syzkaller reported:

  BUG: KASAN: slab-out-of-bounds in __build_skb_around+0x235/0x340 net/core/skbuff.c:294
  Write of size 32 at addr ffff88802aa172c0 by task syz-executor413/5295

For bpf_prog_test_run_skb(), which uses a kmalloc()ed buffer passed to
build_skb().

When build_skb() is passed a frag_size of 0, it means the buffer came
from kmalloc. In these cases, ksize() is used to find its actual size,
but since the allocation may not have been made to that size, actually
perform the krealloc() call so that all the associated buffer size
checking will be correctly notified (and use the "new" pointer so that
compiler hinting works correctly). Split this logic out into a new
interface, slab_build_skb(), but leave the original 0 checking for now
to catch any stragglers.

Reported-by: syzbot+fda18eaa8c12534ccb3b@syzkaller.appspotmail.com
Link: https://groups.google.com/g/syzkaller-bugs/c/UnIKxTtU5-0/m/-wbXinkgAQAJ
Fixes: 38931d8989 ("mm: Make ksize() a reporting-only function")
Cc: Pavel Begunkov <asml.silence@gmail.com>
Cc: pepsipu <soopthegoop@gmail.com>
Cc: syzbot+fda18eaa8c12534ccb3b@syzkaller.appspotmail.com
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: kasan-dev <kasan-dev@googlegroups.com>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: ast@kernel.org
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Hao Luo <haoluo@google.com>
Cc: Jesper Dangaard Brouer <hawk@kernel.org>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: jolsa@kernel.org
Cc: KP Singh <kpsingh@kernel.org>
Cc: martin.lau@linux.dev
Cc: Stanislav Fomichev <sdf@google.com>
Cc: song@kernel.org
Cc: Yonghong Song <yhs@fb.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221208060256.give.994-kees@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-12-09 19:47:41 -08:00
..
bnx2x Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-11-29 13:04:52 -08:00
bnxt bnxt: report FEC block stats via standard interface 2022-12-01 16:34:52 -08:00
genet net: bcmgenet: Remove the unused function 2022-12-09 19:46:52 -08:00
b44.c net: Remove the obsolte u64_stats_fetch_*_irq() users (drivers). 2022-10-28 20:13:54 -07:00
b44.h
bcm63xx_enet.c
bcm63xx_enet.h
bcm4908_enet.c net: broadcom: bcm4908_enet: report queued and transmitted bytes 2022-11-02 20:38:04 -07:00
bcm4908_enet.h
bcmsysport.c net: systemport: Add support for RDMA overflow statistic counter 2022-10-31 20:05:03 -07:00
bcmsysport.h net: systemport: Add support for RDMA overflow statistic counter 2022-10-31 20:05:03 -07:00
bgmac-bcma-mdio.c
bgmac-bcma.c
bgmac-platform.c
bgmac.c net: bgmac: Drop free_netdev() from bgmac_enet_remove() 2022-11-11 19:48:35 -08:00
bgmac.h
bnx2_fw.h
bnx2.c skbuff: Introduce slab_build_skb() 2022-12-09 19:47:41 -08:00
bnx2.h
cnic_defs.h
cnic_if.h
cnic.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
cnic.h
Kconfig net: broadcom: Add PTP_1588_CLOCK_OPTIONAL dependency for BCMGENET under ARCH_BCM2835 2022-11-30 20:37:03 -08:00
Makefile
sb1250-mac.c
tg3.c ptp: tg3: convert .adjfreq to .adjfine 2022-11-11 10:58:39 +00:00
tg3.h
unimac.h