Skip to content

Commit

Permalink
SUNRPC: Fix sockaddr handling in the svc_xprt_create_error trace point
Browse files Browse the repository at this point in the history
While testing, I got an unexpected KASAN splat:

Jan 08 13:50:27 oracle-102.nfsv4.dev kernel: BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_svc_xprt_create_err+0x190/0x210 [sunrpc]
Jan 08 13:50:27 oracle-102.nfsv4.dev kernel: Read of size 28 at addr ffffc9000008f728 by task mount.nfs/4628

The memcpy() in the TP_fast_assign section of this trace point
copies the size of the destination buffer in order that the buffer
won't be overrun.

In other similar trace points, the source buffer for this memcpy is
a "struct sockaddr_storage" so the actual length of the source
buffer is always long enough to prevent the memcpy from reading
uninitialized or unallocated memory.

However, for this trace point, the source buffer can be as small as
a "struct sockaddr_in". For AF_INET sockaddrs, the memcpy() reads
memory that follows the source buffer, which is not always valid
memory.

To avoid copying past the end of the passed-in sockaddr, make the
source address's length available to the memcpy(). It would be a
little nicer if the tracing infrastructure was more friendly about
storing socket addresses that are not AF_INET, but I could not find
a way to make printk("%pIS") work with a dynamic array.

Reported-by: KASAN
Fixes: 4b8f380 ("SUNRPC: Tracepoint to record errors in svc_xpo_create()")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
  • Loading branch information
Chuck Lever committed Jan 10, 2022
1 parent 0ea9fc1 commit dc6c6fb
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 3 deletions.
5 changes: 3 additions & 2 deletions include/trace/events/sunrpc.h
Original file line number Diff line number Diff line change
Expand Up @@ -1744,10 +1744,11 @@ TRACE_EVENT(svc_xprt_create_err,
const char *program,
const char *protocol,
struct sockaddr *sap,
size_t salen,
const struct svc_xprt *xprt
),

TP_ARGS(program, protocol, sap, xprt),
TP_ARGS(program, protocol, sap, salen, xprt),

TP_STRUCT__entry(
__field(long, error)
Expand All @@ -1760,7 +1761,7 @@ TRACE_EVENT(svc_xprt_create_err,
__entry->error = PTR_ERR(xprt);
__assign_str(program, program);
__assign_str(protocol, protocol);
memcpy(__entry->addr, sap, sizeof(__entry->addr));
memcpy(__entry->addr, sap, min(salen, sizeof(__entry->addr)));
),

TP_printk("addr=%pISpc program=%s protocol=%s error=%ld",
Expand Down
2 changes: 1 addition & 1 deletion net/sunrpc/svc_xprt.c
Original file line number Diff line number Diff line change
Expand Up @@ -243,7 +243,7 @@ static struct svc_xprt *__svc_xpo_create(struct svc_xprt_class *xcl,
xprt = xcl->xcl_ops->xpo_create(serv, net, sap, len, flags);
if (IS_ERR(xprt))
trace_svc_xprt_create_err(serv->sv_program->pg_name,
xcl->xcl_name, sap, xprt);
xcl->xcl_name, sap, len, xprt);
return xprt;
}

Expand Down

0 comments on commit dc6c6fb

Please sign in to comment.