From: Dan Carpenter <dan.carpenter@oracle.com>
To: Hillf Danton <hdanton@sina.com>, Sasha Levin <sashal@kernel.org>,
Archie Pusaka <apusaka@chromium.org>
Cc: syzbot <syzbot+3ed6361bf59830ca9138@syzkaller.appspotmail.com>,
linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, Miao-chen Chou <mcchou@chromium.org>,
Marcel Holtmann <marcel@holtmann.org>,
Johan Hedberg <johan.hedberg@intel.com>,
syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: slab-out-of-bounds Read in add_adv_patterns_monitor
Date: Tue, 2 Feb 2021 10:51:11 +0300 [thread overview]
Message-ID: <20210202075110.GR2696@kadam> (raw)
In-Reply-To: <20210131100154.14452-1-hdanton@sina.com>
Sasha, do your stable patch picker scripts look at syzbot fix commands
to select patches to back port? In this case a bug was fixed while
adding a new feature. No one noticed the bug fix and there was no Fixes
tag.
On Sun, Jan 31, 2021 at 06:01:54PM +0800, Hillf Danton wrote:
> On Thu, 28 Jan 2021 09:08:24 -0800
> > syzbot found the following issue on:
> >
> > HEAD commit: b491e6a7 net: lapb: Add locking to the lapb module
> > git tree: net
> > console output: https://syzkaller.appspot.com/x/log.txt?x=17ba0f2cd00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=be33d8015c9de024
> > dashboard link: https://syzkaller.appspot.com/bug?extid=3ed6361bf59830ca9138
> > compiler: gcc (GCC) 10.1.0-syz 20200507
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10628ae8d00000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12964b80d00000
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+3ed6361bf59830ca9138@syzkaller.appspotmail.com
> >
> > IPVS: ftp: loaded support on port[0] = 21
> > ==================================================================
> > BUG: KASAN: slab-out-of-bounds in add_adv_patterns_monitor+0x91f/0xa90 net/bluetooth/mgmt.c:4266
> > Read of size 1 at addr ffff888013251b29 by task syz-executor387/8480
> >
> > CPU: 1 PID: 8480 Comm: syz-executor387 Not tainted 5.11.0-rc4-syzkaller #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > Call Trace:
> > __dump_stack lib/dump_stack.c:79 [inline]
> > dump_stack+0x107/0x163 lib/dump_stack.c:120
> > print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:230
> > __kasan_report mm/kasan/report.c:396 [inline]
> > kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413
> > add_adv_patterns_monitor+0x91f/0xa90 net/bluetooth/mgmt.c:4266
> > hci_mgmt_cmd net/bluetooth/hci_sock.c:1603 [inline]
> > hci_sock_sendmsg+0x1b98/0x21d0 net/bluetooth/hci_sock.c:1738
> > sock_sendmsg_nosec net/socket.c:652 [inline]
> > sock_sendmsg+0xcf/0x120 net/socket.c:672
> > sock_write_iter+0x289/0x3c0 net/socket.c:999
> > call_write_iter include/linux/fs.h:1901 [inline]
> > new_sync_write+0x426/0x650 fs/read_write.c:518
> > vfs_write+0x791/0xa30 fs/read_write.c:605
> > ksys_write+0x1ee/0x250 fs/read_write.c:658
> > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> > entry_SYSCALL_64_after_hwframe+0x44/0xa9
> > RIP: 0033:0x447579
> > Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 0e fc ff c3 66 2e 0f 1f 84 00 00 00 00
> > RSP: 002b:00007ffe0f4194b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> > RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000447579
> > RDX: 0000000000000009 RSI: 0000000020000000 RDI: 0000000000000004
> > RBP: 00000000018e1914 R08: 00000000018e1914 R09: 00007ffe0f4194a0
> > R10: 00007ffe0f4194c0 R11: 0000000000000246 R12: 0000000000000004
> > R13: 0000000000000072 R14: 00000000018e1914 R15: 0000000000000000
> >
> > Allocated by task 8480:
> > kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
> > kasan_set_track mm/kasan/common.c:46 [inline]
> > set_alloc_info mm/kasan/common.c:401 [inline]
> > ____kasan_kmalloc.constprop.0+0x82/0xa0 mm/kasan/common.c:429
> > kmalloc include/linux/slab.h:557 [inline]
> > hci_mgmt_cmd net/bluetooth/hci_sock.c:1508 [inline]
> > hci_sock_sendmsg+0x9b8/0x21d0 net/bluetooth/hci_sock.c:1738
> > sock_sendmsg_nosec net/socket.c:652 [inline]
> > sock_sendmsg+0xcf/0x120 net/socket.c:672
> > sock_write_iter+0x289/0x3c0 net/socket.c:999
> > call_write_iter include/linux/fs.h:1901 [inline]
> > new_sync_write+0x426/0x650 fs/read_write.c:518
> > vfs_write+0x791/0xa30 fs/read_write.c:605
> > ksys_write+0x1ee/0x250 fs/read_write.c:658
> > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> > entry_SYSCALL_64_after_hwframe+0x44/0xa9
> >
> > The buggy address belongs to the object at ffff888013251b20
> > which belongs to the cache kmalloc-16 of size 16
> > The buggy address is located 9 bytes inside of
> > 16-byte region [ffff888013251b20, ffff888013251b30)
> > The buggy address belongs to the page:
> > page:00000000a4467645 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13251
> > flags: 0xfff00000000200(slab)
> > raw: 00fff00000000200 ffffea00004ed440 0000000300000003 ffff888010041b40
> > raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000
> > page dumped because: kasan: bad access detected
> >
> > Memory state around the buggy address:
> > ffff888013251a00: fb fb fc fc fb fb fc fc 00 00 fc fc fb fb fc fc
> > ffff888013251a80: 00 00 fc fc 00 00 fc fc fb fb fc fc 00 00 fc fc
> > >ffff888013251b00: 00 00 fc fc 00 01 fc fc fb fb fc fc fa fb fc fc
> > ^
> > ffff888013251b80: 00 00 fc fc fa fb fc fc fa fb fc fc 00 00 fc fc
> > ffff888013251c00: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc
> > ==================================================================
>
> Fix b139553db5cd ("Bluetooth: Add handler of MGMT_OP_ADD_ADV_PATTERNS_MONITOR")
> by adding the right-hand buffer boundary check.
>
> --- a/net/bluetooth/mgmt.c
> +++ b/net/bluetooth/mgmt.c
> @@ -4238,7 +4238,9 @@ static int add_adv_patterns_monitor(stru
>
> BT_DBG("request for %s", hdev->name);
>
> - if (len <= sizeof(*cp) || cp->pattern_count == 0) {
> + if (len <= sizeof(*cp) || cp->pattern_count == 0 ||
> + len < sizeof(*cp) + cp->pattern_count *
> + sizeof(struct mgmt_adv_pattern)) {
> err = mgmt_cmd_status(sk, hdev->id,
> MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
> MGMT_STATUS_INVALID_PARAMS);
>
I think this was already fixed on Jan 22 commit b4a221ea8a1f ("Bluetooth:
advmon offload MSFT add rssi support").
expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
if (len != expected_size) {
Now someone needs to backport it to stable.
regards,
dan carpenter
next prev parent reply other threads:[~2021-02-02 7:53 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-28 17:08 KASAN: slab-out-of-bounds Read in add_adv_patterns_monitor syzbot
[not found] ` <20210131100154.14452-1-hdanton@sina.com>
2021-02-02 7:51 ` Dan Carpenter [this message]
2021-02-02 8:10 ` Dan Carpenter
2021-03-20 8:27 ` [syzbot] " syzbot
2022-05-12 13:04 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210202075110.GR2696@kadam \
--to=dan.carpenter@oracle.com \
--cc=apusaka@chromium.org \
--cc=hdanton@sina.com \
--cc=johan.hedberg@intel.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=mcchou@chromium.org \
--cc=netdev@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=syzbot+3ed6361bf59830ca9138@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.