* [PATCH] net: ath10k: fix memcpy size from untrusted input [not found] <87tuzbihbg.fsf@codeaurora.org> @ 2020-06-16 13:25 ` Zekun Shen 0 siblings, 0 replies; 4+ messages in thread From: Zekun Shen @ 2020-06-16 13:25 UTC (permalink / raw) Cc: netdev, linux-wireless, linux-kernel, ath10k, Zekun Shen, Jakub Kicinski, David S. Miller, Kalle Valo A compromized ath10k peripheral is able to control the size argument of memcpy in ath10k_pci_hif_exchange_bmi_msg. The min result from previous line is not used as the size argument for memcpy. Instead, xfer.resp_len comes from untrusted stream dma input. The value comes from "nbytes" in ath10k_pci_bmi_recv_data, which is set inside _ath10k_ce_completed_recv_next_nolock with the line nbytes = __le16_to_cpu(sdesc.nbytes); sdesc is a stream dma region which device can write to. Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> --- KASAN report stacktrace: [ 6.293972] ================================================================== [ 6.295696] BUG: KASAN: slab-out-of-bounds in ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.297031] Read of size 9769 at addr ffff888034c49c00 by task kworker/u2:2/82 [ 6.298054] [ 6.298288] CPU: 0 PID: 82 Comm: kworker/u2:2 Tainted: G W 5.6.0 #51 [ 6.299410] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/4 [ 6.301107] Workqueue: ath10k_wq ath10k_core_register_work [ath10k_core] [ 6.302203] Call Trace: [ 6.302596] dump_stack+0x75/0x9b [ 6.303114] ? ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.304096] print_address_description.constprop.5+0x16/0x310 [ 6.304933] ? ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.305898] ? ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.306873] __kasan_report+0x158/0x1c0 [ 6.307441] ? ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.308432] kasan_report+0xe/0x20 [ 6.308938] check_memory_region+0x15d/0x1b0 [ 6.309564] memcpy+0x1f/0x50 [ 6.310006] ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.310947] ? ath10k_pci_rx_replenish_retry+0x170/0x170 [ath10k_pci] [ 6.311875] ? check_unmap+0x64e/0x1bb0 [ 6.312439] ? _raw_write_lock+0xd0/0xd0 [ 6.313045] ? log_store.constprop.29+0x267/0x440 [ 6.313732] ? debug_dma_free_coherent+0x1c0/0x220 [ 6.314440] ? debug_dma_alloc_coherent+0x2f0/0x2f0 [ 6.315156] ath10k_bmi_get_target_info+0x1b8/0x350 [ath10k_core] [ 6.316058] ? apic_timer_interrupt+0xa/0x20 [ 6.316710] ? ath10k_bmi_done+0x330/0x330 [ath10k_core] [ 6.317509] ? ath10k_pci_diag_write_mem+0x31e/0x570 [ath10k_pci] [ 6.318402] ? __kasan_check_read+0x10/0x10 [ 6.319037] ? _raw_spin_lock_irqsave+0x7b/0xd0 [ 6.319755] ? _raw_write_lock_irqsave+0xd0/0xd0 [ 6.320463] ? lock_timer_base+0xbc/0x150 [ 6.321047] ? enqueue_timer+0xda/0x270 [ 6.321612] ? mod_timer+0x406/0xad0 [ 6.322147] ? timer_reduce+0xb00/0xb00 [ 6.322707] ? _raw_write_lock_irqsave+0xd0/0xd0 [ 6.323380] ? ath10k_pci_sleep.part.14+0x163/0x1c0 [ath10k_pci] [ 6.324248] ? ath10k_bus_pci_write32+0x158/0x1b0 [ath10k_pci] [ 6.325099] ? ath10k_pci_hif_power_up+0x256/0x690 [ath10k_pci] [ 6.325970] ? __switch_to_asm+0x40/0x70 [ 6.326565] ath10k_core_register_work+0x799/0x2070 [ath10k_core] [ 6.327453] ? __switch_to_asm+0x34/0x70 [ 6.328028] ? __switch_to_asm+0x40/0x70 [ 6.328603] ? __switch_to+0x5d5/0xde0 [ 6.329144] ? __switch_to_asm+0x34/0x70 [ 6.329754] ? ath10k_core_stop+0xf0/0xf0 [ath10k_core] [ 6.330521] ? __schedule+0x88c/0x1820 [ 6.331068] ? read_word_at_a_time+0xe/0x20 [ 6.331675] ? strscpy+0xa3/0x320 [ 6.332162] process_one_work+0x83c/0x14c0 [ 6.332777] worker_thread+0x82/0xee0 [ 6.333335] ? __kthread_parkme+0x8a/0x100 [ 6.333955] ? process_one_work+0x14c0/0x14c0 [ 6.334592] kthread+0x2f1/0x3a0 [ 6.335070] ? kthread_create_on_node+0xc0/0xc0 [ 6.335785] ret_from_fork+0x35/0x40 [ 6.367721] ================================================================== drivers/net/wireless/ath/ath10k/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c index 1d941d53f..ad28d9156 100644 --- a/drivers/net/wireless/ath/ath10k/pci.c +++ b/drivers/net/wireless/ath/ath10k/pci.c @@ -2184,7 +2184,7 @@ int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar, if (ret == 0 && resp_len) { *resp_len = min(*resp_len, xfer.resp_len); - memcpy(resp, tresp, xfer.resp_len); + memcpy(resp, tresp, *resp_len); } err_dma: kfree(treq); -- 2.17.1 _______________________________________________ ath10k mailing list ath10k@lists.infradead.org http://lists.infradead.org/mailman/listinfo/ath10k ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] net: ath10k: fix memcpy size from untrusted input @ 2020-06-16 13:25 ` Zekun Shen 0 siblings, 0 replies; 4+ messages in thread From: Zekun Shen @ 2020-06-16 13:25 UTC (permalink / raw) Cc: Zekun Shen, Kalle Valo, David S. Miller, Jakub Kicinski, ath10k, linux-wireless, netdev, linux-kernel A compromized ath10k peripheral is able to control the size argument of memcpy in ath10k_pci_hif_exchange_bmi_msg. The min result from previous line is not used as the size argument for memcpy. Instead, xfer.resp_len comes from untrusted stream dma input. The value comes from "nbytes" in ath10k_pci_bmi_recv_data, which is set inside _ath10k_ce_completed_recv_next_nolock with the line nbytes = __le16_to_cpu(sdesc.nbytes); sdesc is a stream dma region which device can write to. Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> --- KASAN report stacktrace: [ 6.293972] ================================================================== [ 6.295696] BUG: KASAN: slab-out-of-bounds in ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.297031] Read of size 9769 at addr ffff888034c49c00 by task kworker/u2:2/82 [ 6.298054] [ 6.298288] CPU: 0 PID: 82 Comm: kworker/u2:2 Tainted: G W 5.6.0 #51 [ 6.299410] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/4 [ 6.301107] Workqueue: ath10k_wq ath10k_core_register_work [ath10k_core] [ 6.302203] Call Trace: [ 6.302596] dump_stack+0x75/0x9b [ 6.303114] ? ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.304096] print_address_description.constprop.5+0x16/0x310 [ 6.304933] ? ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.305898] ? ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.306873] __kasan_report+0x158/0x1c0 [ 6.307441] ? ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.308432] kasan_report+0xe/0x20 [ 6.308938] check_memory_region+0x15d/0x1b0 [ 6.309564] memcpy+0x1f/0x50 [ 6.310006] ath10k_pci_hif_exchange_bmi_msg+0xb2f/0x14d0 [ath10k_pci] [ 6.310947] ? ath10k_pci_rx_replenish_retry+0x170/0x170 [ath10k_pci] [ 6.311875] ? check_unmap+0x64e/0x1bb0 [ 6.312439] ? _raw_write_lock+0xd0/0xd0 [ 6.313045] ? log_store.constprop.29+0x267/0x440 [ 6.313732] ? debug_dma_free_coherent+0x1c0/0x220 [ 6.314440] ? debug_dma_alloc_coherent+0x2f0/0x2f0 [ 6.315156] ath10k_bmi_get_target_info+0x1b8/0x350 [ath10k_core] [ 6.316058] ? apic_timer_interrupt+0xa/0x20 [ 6.316710] ? ath10k_bmi_done+0x330/0x330 [ath10k_core] [ 6.317509] ? ath10k_pci_diag_write_mem+0x31e/0x570 [ath10k_pci] [ 6.318402] ? __kasan_check_read+0x10/0x10 [ 6.319037] ? _raw_spin_lock_irqsave+0x7b/0xd0 [ 6.319755] ? _raw_write_lock_irqsave+0xd0/0xd0 [ 6.320463] ? lock_timer_base+0xbc/0x150 [ 6.321047] ? enqueue_timer+0xda/0x270 [ 6.321612] ? mod_timer+0x406/0xad0 [ 6.322147] ? timer_reduce+0xb00/0xb00 [ 6.322707] ? _raw_write_lock_irqsave+0xd0/0xd0 [ 6.323380] ? ath10k_pci_sleep.part.14+0x163/0x1c0 [ath10k_pci] [ 6.324248] ? ath10k_bus_pci_write32+0x158/0x1b0 [ath10k_pci] [ 6.325099] ? ath10k_pci_hif_power_up+0x256/0x690 [ath10k_pci] [ 6.325970] ? __switch_to_asm+0x40/0x70 [ 6.326565] ath10k_core_register_work+0x799/0x2070 [ath10k_core] [ 6.327453] ? __switch_to_asm+0x34/0x70 [ 6.328028] ? __switch_to_asm+0x40/0x70 [ 6.328603] ? __switch_to+0x5d5/0xde0 [ 6.329144] ? __switch_to_asm+0x34/0x70 [ 6.329754] ? ath10k_core_stop+0xf0/0xf0 [ath10k_core] [ 6.330521] ? __schedule+0x88c/0x1820 [ 6.331068] ? read_word_at_a_time+0xe/0x20 [ 6.331675] ? strscpy+0xa3/0x320 [ 6.332162] process_one_work+0x83c/0x14c0 [ 6.332777] worker_thread+0x82/0xee0 [ 6.333335] ? __kthread_parkme+0x8a/0x100 [ 6.333955] ? process_one_work+0x14c0/0x14c0 [ 6.334592] kthread+0x2f1/0x3a0 [ 6.335070] ? kthread_create_on_node+0xc0/0xc0 [ 6.335785] ret_from_fork+0x35/0x40 [ 6.367721] ================================================================== drivers/net/wireless/ath/ath10k/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c index 1d941d53f..ad28d9156 100644 --- a/drivers/net/wireless/ath/ath10k/pci.c +++ b/drivers/net/wireless/ath/ath10k/pci.c @@ -2184,7 +2184,7 @@ int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar, if (ret == 0 && resp_len) { *resp_len = min(*resp_len, xfer.resp_len); - memcpy(resp, tresp, xfer.resp_len); + memcpy(resp, tresp, *resp_len); } err_dma: kfree(treq); -- 2.17.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] net: ath10k: fix memcpy size from untrusted input 2020-06-16 13:25 ` Zekun Shen (?) @ 2020-06-23 7:44 ` Kalle Valo -1 siblings, 0 replies; 4+ messages in thread From: Kalle Valo @ 2020-06-23 7:44 UTC (permalink / raw) To: Zekun Shen Zekun Shen <bruceshenzk@gmail.com> wrote: > A compromized ath10k peripheral is able to control the size argument > of memcpy in ath10k_pci_hif_exchange_bmi_msg. > > The min result from previous line is not used as the size argument > for memcpy. Instead, xfer.resp_len comes from untrusted stream dma > input. The value comes from "nbytes" in ath10k_pci_bmi_recv_data, > which is set inside _ath10k_ce_completed_recv_next_nolock with the line > > nbytes = __le16_to_cpu(sdesc.nbytes); > > sdesc is a stream dma region which device can write to. > > Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Patch applied to ath-next branch of ath.git, thanks. aed95297250f ath10k: pci: fix memcpy size of bmi response -- https://patchwork.kernel.org/patch/11607461/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] net: ath10k: fix memcpy size from untrusted input 2020-06-16 13:25 ` Zekun Shen (?) (?) @ 2020-06-23 7:44 ` Kalle Valo -1 siblings, 0 replies; 4+ messages in thread From: Kalle Valo @ 2020-06-23 7:44 UTC (permalink / raw) To: Zekun Shen Cc: netdev, linux-wireless, linux-kernel, ath10k, Jakub Kicinski, David S. Miller Zekun Shen <bruceshenzk@gmail.com> wrote: > A compromized ath10k peripheral is able to control the size argument > of memcpy in ath10k_pci_hif_exchange_bmi_msg. > > The min result from previous line is not used as the size argument > for memcpy. Instead, xfer.resp_len comes from untrusted stream dma > input. The value comes from "nbytes" in ath10k_pci_bmi_recv_data, > which is set inside _ath10k_ce_completed_recv_next_nolock with the line > > nbytes = __le16_to_cpu(sdesc.nbytes); > > sdesc is a stream dma region which device can write to. > > Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Patch applied to ath-next branch of ath.git, thanks. aed95297250f ath10k: pci: fix memcpy size of bmi response -- https://patchwork.kernel.org/patch/11607461/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches _______________________________________________ ath10k mailing list ath10k@lists.infradead.org http://lists.infradead.org/mailman/listinfo/ath10k ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-06-23 7:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <87tuzbihbg.fsf@codeaurora.org>
2020-06-16 13:25 ` [PATCH] net: ath10k: fix memcpy size from untrusted input Zekun Shen
2020-06-16 13:25 ` Zekun Shen
2020-06-23 7:44 ` Kalle Valo
2020-06-23 7:44 ` Kalle Valo
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.