linux-stable/net/netfilter/ipvs
Jinghao Jia 146b6f1112 ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
Under certain kernel configurations when building with Clang/LLVM, the
compiler does not generate a return or jump as the terminator
instruction for ip_vs_protocol_init(), triggering the following objtool
warning during build time:

  vmlinux.o: warning: objtool: ip_vs_protocol_init() falls through to next function __initstub__kmod_ip_vs_rr__935_123_ip_vs_rr_init6()

At runtime, this either causes an oops when trying to load the ipvs
module or a boot-time panic if ipvs is built-in. This same issue has
been reported by the Intel kernel test robot previously.

Digging deeper into both LLVM and the kernel code reveals this to be a
undefined behavior problem. ip_vs_protocol_init() uses a on-stack buffer
of 64 chars to store the registered protocol names and leaves it
uninitialized after definition. The function calls strnlen() when
concatenating protocol names into the buffer. With CONFIG_FORTIFY_SOURCE
strnlen() performs an extra step to check whether the last byte of the
input char buffer is a null character (commit 3009f891bb ("fortify:
Allow strlen() and strnlen() to pass compile-time known lengths")).
This, together with possibly other configurations, cause the following
IR to be generated:

  define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #5 section ".init.text" align 16 !kcfi_type !29 {
    %1 = alloca [64 x i8], align 16
    ...

  14:                                               ; preds = %11
    %15 = getelementptr inbounds i8, ptr %1, i64 63
    %16 = load i8, ptr %15, align 1
    %17 = tail call i1 @llvm.is.constant.i8(i8 %16)
    %18 = icmp eq i8 %16, 0
    %19 = select i1 %17, i1 %18, i1 false
    br i1 %19, label %20, label %23

  20:                                               ; preds = %14
    %21 = call i64 @strlen(ptr noundef nonnull dereferenceable(1) %1) #23
    ...

  23:                                               ; preds = %14, %11, %20
    %24 = call i64 @strnlen(ptr noundef nonnull dereferenceable(1) %1, i64 noundef 64) #24
    ...
  }

The above code calculates the address of the last char in the buffer
(value %15) and then loads from it (value %16). Because the buffer is
never initialized, the LLVM GVN pass marks value %16 as undefined:

  %13 = getelementptr inbounds i8, ptr %1, i64 63
  br i1 undef, label %14, label %17

This gives later passes (SCCP, in particular) more DCE opportunities by
propagating the undef value further, and eventually removes everything
after the load on the uninitialized stack location:

  define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #0 section ".init.text" align 16 !kcfi_type !11 {
    %1 = alloca [64 x i8], align 16
    ...

  12:                                               ; preds = %11
    %13 = getelementptr inbounds i8, ptr %1, i64 63
    unreachable
  }

In this way, the generated native code will just fall through to the
next function, as LLVM does not generate any code for the unreachable IR
instruction and leaves the function without a terminator.

Zero the on-stack buffer to avoid this possible UB.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202402100205.PWXIz1ZK-lkp@intel.com/
Co-developed-by: Ruowen Qin <ruqin@redhat.com>
Signed-off-by: Ruowen Qin <ruqin@redhat.com>
Signed-off-by: Jinghao Jia <jinghao7@illinois.edu>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2024-11-28 13:14:23 +01:00
..
ip_vs_app.c ipvs: fix WARNING in ip_vs_app_net_cleanup() 2022-11-02 09:39:14 +01:00
ip_vs_conn.c ipvs: Simplify the allocation of ip_vs_conn slab caches 2024-01-29 15:43:20 +01:00
ip_vs_core.c ip_tunnel: convert __be16 tunnel flags to bitmaps 2024-04-01 10:49:28 +01:00
ip_vs_ctl.c net: convert to nla_get_*_default() 2024-11-11 10:32:06 -08:00
ip_vs_dh.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_est.c Kill sched.h dependency on rcupdate.h 2023-12-27 11:50:20 -05:00
ip_vs_fo.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_ftp.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
ip_vs_lblc.c netfilter: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:42 +01:00
ip_vs_lblcr.c netfilter: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:42 +01:00
ip_vs_lc.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_mh.c netfilter: ipvs: Use the bitmap API to allocate bitmaps 2022-07-21 00:55:39 +02:00
ip_vs_nfct.c netfilter: nf_conntrack_sip: fix expectation clash 2019-07-16 13:16:59 +02:00
ip_vs_nq.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_ovf.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_pe_sip.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_pe.c ipvs: don't ignore errors in case refcounting ip_vs module fails 2019-10-24 11:53:19 +02:00
ip_vs_proto_ah_esp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
ip_vs_proto_sctp.c ipvs: Avoid unnecessary calls to skb_is_gso_sctp 2024-06-26 00:54:45 +02:00
ip_vs_proto_tcp.c ipvs: adjust the debug info in function set_tcp_state 2020-10-20 13:54:46 +02:00
ip_vs_proto_udp.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
ip_vs_proto.c ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() 2024-11-28 13:14:23 +01:00
ip_vs_rr.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_sched.c ipvs: don't ignore errors in case refcounting ip_vs module fails 2019-10-24 11:53:19 +02:00
ip_vs_sed.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_sh.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_sync.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
ip_vs_twos.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_wlc.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_wrr.c ipvs: add missing module descriptions 2023-11-08 13:52:33 +01:00
ip_vs_xmit.c inet: introduce dst_rtable() helper 2024-04-30 18:32:38 -07:00
Kconfig ipvs: increase ip_vs_conn_tab_bits range for 64BIT 2023-06-01 21:16:38 +02:00
Makefile ipvs: add weighted random twos choice algorithm 2021-01-26 01:09:46 +01:00