net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

Reproducer available at [1].

The ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc
pointer from msg->vcc and uses it directly without any validation. This
pointer comes from userspace via sendmsg() and can be arbitrarily forged:

int fd = socket(AF_ATMSVC, SOCK_DGRAM, 0);
ioctl(fd, ATMSIGD_CTRL); // become ATM signaling daemon
struct msghdr msg = { .msg_iov = &iov, ... };
*(unsigned long *)(buf + 4) = 0xdeadbeef; // fake vcc pointer
sendmsg(fd, &msg, 0); // kernel dereferences 0xdeadbeef

In normal operation, the kernel sends the vcc pointer to the signaling
daemon via sigd_enq() when processing operations like connect(), bind(),
or listen(). The daemon is expected to return the same pointer when
responding. However, a malicious daemon can send arbitrary pointer values.

Fix this by introducing find_get_vcc() which validates the pointer by
searching through vcc_hash (similar to how sigd_close() iterates over
all VCCs), and acquires a reference via sock_hold() if found.

Since struct atm_vcc embeds struct sock as its first member, they share
the same lifetime. Therefore using sock_hold/sock_put is sufficient to
keep the vcc alive while it is being used.

Note that there may be a race with sigd_close() which could mark the vcc
with various flags (e.g., ATM_VF_RELEASED) after find_get_vcc() returns.
However, sock_hold() guarantees the memory remains valid, so this race
only affects the logical state, not memory safety.

[1]: https://gist.github.com/mrpre/1ba5949c45529c511152e2f4c755b0f3
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+1f22cb1769f249df9fa0@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69039850.a70a0220.5b2ed.005d.GAE@google.com/T/
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Link: https://patch.msgid.link/20260205095501.131890-1-jiayuan.chen@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

authored by

Jiayuan Chen and committed by

Paolo Abeni 4 months ago ae88a5d2 6d2f142b

+54 -2

1 changed file

expand all

net

atm

signaling.c

+54 -2

net/atm/signaling.c

··· 22 22 23 23 struct atm_vcc *sigd = NULL; 24 24 25 + /* 26 + * find_get_vcc - validate and get a reference to a vcc pointer 27 + * @vcc: the vcc pointer to validate 28 + * 29 + * This function validates that @vcc points to a registered VCC in vcc_hash. 30 + * If found, it increments the socket reference count and returns the vcc. 31 + * The caller must call sock_put(sk_atm(vcc)) when done. 32 + * 33 + * Returns the vcc pointer if valid, NULL otherwise. 34 + */ 35 + static struct atm_vcc *find_get_vcc(struct atm_vcc *vcc) 36 + { 37 + int i; 38 + 39 + read_lock(&vcc_sklist_lock); 40 + for (i = 0; i < VCC_HTABLE_SIZE; i++) { 41 + struct sock *s; 42 + 43 + sk_for_each(s, &vcc_hash[i]) { 44 + if (atm_sk(s) == vcc) { 45 + sock_hold(s); 46 + read_unlock(&vcc_sklist_lock); 47 + return vcc; 48 + } 49 + } 50 + } 51 + read_unlock(&vcc_sklist_lock); 52 + return NULL; 53 + } 54 + 25 55 static void sigd_put_skb(struct sk_buff *skb) 26 56 { 27 57 if (!sigd) { ··· 99 69 100 70 msg = (struct atmsvc_msg *) skb->data; 101 71 WARN_ON(refcount_sub_and_test(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc)); 102 - vcc = *(struct atm_vcc **) &msg->vcc; 72 + 73 + vcc = find_get_vcc(*(struct atm_vcc **)&msg->vcc); 74 + if (!vcc) { 75 + pr_debug("invalid vcc pointer in msg\n"); 76 + dev_kfree_skb(skb); 77 + return -EINVAL; 78 + } 79 + 103 80 pr_debug("%d (0x%lx)\n", (int)msg->type, (unsigned long)vcc); 104 81 sk = sk_atm(vcc); 105 82 ··· 137 100 clear_bit(ATM_VF_WAITING, &vcc->flags); 138 101 break; 139 102 case as_indicate: 140 - vcc = *(struct atm_vcc **)&msg->listen_vcc; 103 + /* Release the reference from msg->vcc, we'll use msg->listen_vcc instead */ 104 + sock_put(sk); 105 + 106 + vcc = find_get_vcc(*(struct atm_vcc **)&msg->listen_vcc); 107 + if (!vcc) { 108 + pr_debug("invalid listen_vcc pointer in msg\n"); 109 + dev_kfree_skb(skb); 110 + return -EINVAL; 111 + } 112 + 141 113 sk = sk_atm(vcc); 142 114 pr_debug("as_indicate!!!\n"); 143 115 lock_sock(sk); ··· 161 115 sk->sk_state_change(sk); 162 116 as_indicate_complete: 163 117 release_sock(sk); 118 + /* Paired with find_get_vcc(msg->listen_vcc) above */ 119 + sock_put(sk); 164 120 return 0; 165 121 case as_close: 166 122 set_bit(ATM_VF_RELEASED, &vcc->flags); ··· 179 131 break; 180 132 default: 181 133 pr_alert("bad message type %d\n", (int)msg->type); 134 + /* Paired with find_get_vcc(msg->vcc) above */ 135 + sock_put(sk); 182 136 return -EINVAL; 183 137 } 184 138 sk->sk_state_change(sk); 185 139 out: 186 140 dev_kfree_skb(skb); 141 + /* Paired with find_get_vcc(msg->vcc) above */ 142 + sock_put(sk); 187 143 return 0; 188 144 } 189 145

Configure Feed

Configure Feed