CVE-2023-53752 — net: deal with integer overflows in kmalloc_reserve()

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

net: deal with integer overflows in kmalloc_reserve()

Blamed commit changed: ptr = kmalloc(size); if (ptr) size = ksize(ptr);

size = kmalloc_size_roundup(size); ptr = kmalloc(size);

This allowed various crash as reported by syzbot [1] and Kyle Zeng.

Problem is that if @size is bigger than 0x80000001, kmalloc_size_roundup(size) returns 2^32.

kmalloc_reserve() uses a 32bit variable (obj_size), so 2^32 is truncated to 0.

kmalloc(0) returns ZERO_SIZE_PTR which is not handled by skb allocations.

Following trace can be triggered if a netdev->mtu is set close to 0x7fffffff

We might in the future limit netdev->mtu to more sensible limit (like KMALLOC_MAX_SIZE).

This patch is based on a syzbot report, and also a report and tentative fix from Kyle Zeng.

[1] BUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline] BUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 Write of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554

CPU: 1 PID: 22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106 print_report+0xe4/0x4b4…

Most recent entries from all

CVE-2023-53752 — net: deal with integer overflows in kmalloc_reserve()