af_key: fix buffer overread in verify_address_len()
authorEric Biggers <ebiggers@google.com>
Sat, 30 Dec 2017 00:13:05 +0000 (18:13 -0600)
committerSteffen Klassert <steffen.klassert@secunet.com>
Sat, 30 Dec 2017 08:52:07 +0000 (09:52 +0100)
commit06b335cb51af018d5feeff5dd4fd53847ddb675a
treea161f1f1247dc7da62d218081dea4e6d3100ac12
parent862591bf4f519d1b8d859af720fafeaebdd0162a
af_key: fix buffer overread in verify_address_len()

If a message sent to a PF_KEY socket ended with one of the extensions
that takes a 'struct sadb_address' but there were not enough bytes
remaining in the message for the ->sa_family member of the 'struct
sockaddr' which is supposed to follow, then verify_address_len() read
past the end of the message, into uninitialized memory.  Fix it by
returning -EINVAL in this case.

This bug was found using syzkaller with KMSAN.

Reproducer:

#include <linux/pfkeyv2.h>
#include <sys/socket.h>
#include <unistd.h>

int main()
{
int sock = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
char buf[24] = { 0 };
struct sadb_msg *msg = (void *)buf;
struct sadb_address *addr = (void *)(msg + 1);

msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_DELETE;
msg->sadb_msg_len = 3;
addr->sadb_address_len = 1;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;

write(sock, buf, 24);
}

Reported-by: Alexander Potapenko <glider@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/key/af_key.c