[PATCH net-next 0/3] llc: do not run the state machine on out of service connections

[Kees Cook <kees@kernel.org>]

Hi,

syzbot found a KASAN/UBSAN out of bounds report in the LLC connection
state machine, and has now bisected a reproducer for it:

  https://lore.kernel.org/all/6a95888b.4d659fcc.734b4.0051.GAE@google.com

  BUG: KASAN: global-out-of-bounds in llc_qualify_conn_ev net/llc/llc_conn.c:394
  The buggy address belongs to the variable:
   llc_temp_state_transitions+0x58/0x60

  UBSAN: array-index-out-of-bounds in net/llc/llc_conn.c:681:8
  index -1 is out of range for type 'int[12][5]'

llc_conn_state_table[] and llc_offset_table[] are indexed with
"llc->state - 1" because connection states are 1-based, and
LLC_CONN_OUT_OF_SVC is 0, so a connection in that pseudo state indexes
both tables with -1.

Add bounds checking, regularize connect(2) errno, and add KUnit tests
for it all. See the respective patches for way more details. :)

While I did build testing and convinced myself that the KUnit tests
(which pass only with the fixes applied) are sensible, I would like
more eyes on these changes, as I'm not entirely sure the best way to
test them in the real world.

Note that this collides with proposed patch[1] which also noted we
needed to do better sanity checking of llc->state in llc_conn_service().
Since this check is needed in llc_conn_state_process() as well, I made
it a common function and did other work of keeping the sizes of things
double-checked with static asserts.

-Kees

[1] https://lore.kernel.org/all/8fa3c9e6d5dcf328979ed2bdc27817c11a5eff91.1787752861.git.zihanx@nebusec.ai/

Kees Cook (3):
  llc: do not run the state machine on out of service connections
  llc: report a closed connection for out of service sockets
  llc: add KUnit tests for the connection state machine bounds

 net/llc/Kconfig            |  14 ++++
 include/net/llc_c_st.h     |   2 +-
 net/llc/llc_conn.c         |  42 ++++++++++-
 net/llc/llc_if.c           |  12 ++-
 net/llc/tests/conn_kunit.c | 146 +++++++++++++++++++++++++++++++++++++
 5 files changed, 213 insertions(+), 3 deletions(-)
 create mode 100644 net/llc/tests/conn_kunit.c

-- 
2.34.1