LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] ethtool: fix a potential missing-check bug
@ 2018-04-30  1:31 Wenwen Wang
  2018-04-30 14:20 ` Edward Cree
  2018-04-30 16:46 ` Shannon Nelson
  0 siblings, 2 replies; 3+ messages in thread
From: Wenwen Wang @ 2018-04-30  1:31 UTC (permalink / raw)
  To: Wenwen Wang
  Cc: Kangjie Lu, David S. Miller, Florian Fainelli, Andrew Lunn,
	Russell King, Edward Cree, Inbar Karmy, Eugenia Emantayev,
	Al Viro, Yury Norov, Vidya Sagar Ravipati, Alan Brady,
	Stephen Hemminger, open list:NETWORKING [GENERAL],
	open list

In ethtool_get_rxnfc(), the object "info" is firstly copied from
user-space. If the FLOW_RSS flag is set in the member field flow_type of
"info" (and cmd is ETHTOOL_GRXFH), info needs to be copied again from
user-space because FLOW_RSS is newer and has new definition, as mentioned
in the comment. However, given that the user data resides in user-space, a
malicious user can race to change the data after the first copy. By doing
so, the user can inject inconsistent data. For example, in the second
copy, the FLOW_RSS flag could be cleared in the field flow_type of "info".
In the following execution, "info" will be used in the function
ops->get_rxnfc(). Such inconsistent data can potentially lead to unexpected
information leakage since ops->get_rxnfc() will prepare various types of
data according to flow_type, and the prepared data will be eventually
copied to user-space. This inconsistent data may also cause undefined
behaviors based on how ops->get_rxnfc() is implemented.

This patch re-verifies the flow_type field of "info" after the second copy.
If the value is not as expected, an error code will be returned.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
---
 net/core/ethtool.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 03416e6..a121034 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1032,6 +1032,8 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
 		info_size = sizeof(info);
 		if (copy_from_user(&info, useraddr, info_size))
 			return -EFAULT;
+		if (!(info.flow_type & FLOW_RSS))
+			return -EINVAL;
 	}
 
 	if (info.cmd == ETHTOOL_GRXCLSRLALL) {
-- 
2.7.4

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] ethtool: fix a potential missing-check bug
  2018-04-30  1:31 [PATCH] ethtool: fix a potential missing-check bug Wenwen Wang
@ 2018-04-30 14:20 ` Edward Cree
  2018-04-30 16:46 ` Shannon Nelson
  1 sibling, 0 replies; 3+ messages in thread
From: Edward Cree @ 2018-04-30 14:20 UTC (permalink / raw)
  To: Wenwen Wang
  Cc: Kangjie Lu, David S. Miller, Florian Fainelli, Andrew Lunn,
	Russell King, Inbar Karmy, Eugenia Emantayev, Al Viro,
	Yury Norov, Vidya Sagar Ravipati, Alan Brady, Stephen Hemminger,
	open list:NETWORKING [GENERAL],
	open list

On 30/04/18 02:31, Wenwen Wang wrote:
> In ethtool_get_rxnfc(), the object "info" is firstly copied from
> user-space. If the FLOW_RSS flag is set in the member field flow_type of
> "info" (and cmd is ETHTOOL_GRXFH), info needs to be copied again from
> user-space because FLOW_RSS is newer and has new definition, as mentioned
> in the comment. However, given that the user data resides in user-space, a
> malicious user can race to change the data after the first copy. By doing
> so, the user can inject inconsistent data. For example, in the second
> copy, the FLOW_RSS flag could be cleared in the field flow_type of "info".
> In the following execution, "info" will be used in the function
> ops->get_rxnfc(). Such inconsistent data can potentially lead to unexpected
> information leakage since ops->get_rxnfc() will prepare various types of
> data according to flow_type, and the prepared data will be eventually
> copied to user-space. This inconsistent data may also cause undefined
> behaviors based on how ops->get_rxnfc() is implemented.
I'm not sure there's actually an issue here, since the only purpose of the
 FLOW_RSS check is to avoid faulting/trampling user memory when the user
 process only has the short version of 'info'.
If userland subsequently removes the FLOW_RSS flag, then all that will
 happen is that info_size is larger than it ought to be; that cannot affect
 ops->get_rxnfc() since it isn't passed; the op should already be treating
 'info' as unsafe/user-controlled.
The only way this could lead to information leakage would be if in the non-
 FLOW_RSS case ops->get_rxnfc() was writing things it shouldn't into the
 latter part of 'info' and was getting away with it so far as that was
 never copied_to_user; that seems improbable to me, but I suppose you might
 want to do the check anyway as belt-and-braces security.
(A cleaner approach might be to only copy_from_user() the extra region of
 'info', leaving the previously-copied part alone.  That way each byte is
 only copied_from_user once and thus cannot change.)

-Ed

> This patch re-verifies the flow_type field of "info" after the second copy.
> If the value is not as expected, an error code will be returned.
>
> Signed-off-by: Wenwen Wang <wang6495@umn.edu>
> ---
>  net/core/ethtool.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/net/core/ethtool.c b/net/core/ethtool.c
> index 03416e6..a121034 100644
> --- a/net/core/ethtool.c
> +++ b/net/core/ethtool.c
> @@ -1032,6 +1032,8 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
>  		info_size = sizeof(info);
>  		if (copy_from_user(&info, useraddr, info_size))
>  			return -EFAULT;
> +		if (!(info.flow_type & FLOW_RSS))
> +			return -EINVAL;
>  	}
>  
>  	if (info.cmd == ETHTOOL_GRXCLSRLALL) {

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] ethtool: fix a potential missing-check bug
  2018-04-30  1:31 [PATCH] ethtool: fix a potential missing-check bug Wenwen Wang
  2018-04-30 14:20 ` Edward Cree
@ 2018-04-30 16:46 ` Shannon Nelson
  1 sibling, 0 replies; 3+ messages in thread
From: Shannon Nelson @ 2018-04-30 16:46 UTC (permalink / raw)
  To: Wenwen Wang
  Cc: Kangjie Lu, David S. Miller, Florian Fainelli, Andrew Lunn,
	Russell King, Edward Cree, Inbar Karmy, Eugenia Emantayev,
	Al Viro, Yury Norov, Vidya Sagar Ravipati, Alan Brady,
	Stephen Hemminger, open list:NETWORKING [GENERAL],
	open list

On 4/29/2018 6:31 PM, Wenwen Wang wrote:
> In ethtool_get_rxnfc(), the object "info" is firstly copied from
> user-space. If the FLOW_RSS flag is set in the member field flow_type of
> "info" (and cmd is ETHTOOL_GRXFH), info needs to be copied again from
> user-space because FLOW_RSS is newer and has new definition, as mentioned
> in the comment. However, given that the user data resides in user-space, a
> malicious user can race to change the data after the first copy. By doing
> so, the user can inject inconsistent data. For example, in the second
> copy, the FLOW_RSS flag could be cleared in the field flow_type of "info".
> In the following execution, "info" will be used in the function
> ops->get_rxnfc(). Such inconsistent data can potentially lead to unexpected
> information leakage since ops->get_rxnfc() will prepare various types of
> data according to flow_type, and the prepared data will be eventually
> copied to user-space. This inconsistent data may also cause undefined
> behaviors based on how ops->get_rxnfc() is implemented.
> 
> This patch re-verifies the flow_type field of "info" after the second copy.
> If the value is not as expected, an error code will be returned.
> 
> Signed-off-by: Wenwen Wang <wang6495@umn.edu>
> ---
>   net/core/ethtool.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/net/core/ethtool.c b/net/core/ethtool.c
> index 03416e6..a121034 100644
> --- a/net/core/ethtool.c
> +++ b/net/core/ethtool.c
> @@ -1032,6 +1032,8 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
>   		info_size = sizeof(info);
>   		if (copy_from_user(&info, useraddr, info_size))
>   			return -EFAULT;

You might add a comment here to explain why the second check; otherwise 
someone might come along later and remove this check as redundant code.

sln

> +		if (!(info.flow_type & FLOW_RSS))
> +			return -EINVAL;
>   	}
>   
>   	if (info.cmd == ETHTOOL_GRXCLSRLALL) {
> 

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2018-04-30 16:47 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-30  1:31 [PATCH] ethtool: fix a potential missing-check bug Wenwen Wang
2018-04-30 14:20 ` Edward Cree
2018-04-30 16:46 ` Shannon Nelson

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).