[PATCH] ieee802154: check device type

[PATCH] ieee802154: check device type

[Vegard Nossum]

I've observed a NULL pointer dereference in ieee802154_del_iface() during
netlink fuzzing. It's the ->wpan_phy dereference here:

        phy = dev->ieee802154_ptr->wpan_phy;

My bet is that we're not checking that this is an IEEE802154 interface,
so let's do what ieee802154_nl_get_dev() is doing. (Maybe we should even
be calling this directly?)

Cc: Lennert Buytenhek <buytenh@wantstofly.org>
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Cc: Sergey Lapin <slapin@ossfans.org>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
---
 net/ieee802154/nl-phy.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index 77d7301..dc2960b 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -286,9 +286,12 @@ int ieee802154_del_iface(struct sk_buff *skb, struct genl_info *info)
 	if (name[nla_len(info->attrs[IEEE802154_ATTR_DEV_NAME]) - 1] != '\0')
 		return -EINVAL; /* name should be null-terminated */
 
+	rc = -ENODEV;
 	dev = dev_get_by_name(genl_info_net(info), name);
 	if (!dev)
-		return -ENODEV;
+		return rc;
+	if (dev->type != ARPHRD_IEEE802154)
+		goto out;
 
 	phy = dev->ieee802154_ptr->wpan_phy;
 	BUG_ON(!phy);
@@ -342,6 +345,7 @@ nla_put_failure:
 	nlmsg_free(msg);
 out_dev:
 	wpan_phy_put(phy);
+out:
 	if (dev)
 		dev_put(dev);
 
-- 
1.9.1

Re: [PATCH] ieee802154: check device type

[Alexander Aring]

Hi,

On 07/20/2016 10:43 AM, Vegard Nossum wrote:
> I've observed a NULL pointer dereference in ieee802154_del_iface() during
> netlink fuzzing. It's the ->wpan_phy dereference here:
> 
>         phy = dev->ieee802154_ptr->wpan_phy;
> 
> My bet is that we're not checking that this is an IEEE802154 interface,
> so let's do what ieee802154_nl_get_dev() is doing. (Maybe we should even
> be calling this directly?)
> 
> Cc: Lennert Buytenhek <buytenh@wantstofly.org>
> Cc: Alexander Aring <alex.aring@gmail.com>
> Cc: Marcel Holtmann <marcel@holtmann.org>
> Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
> Cc: Sergey Lapin <slapin@ossfans.org>
> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>

Acked-by: Alexander Aring <aar@pengutronix.de>

thanks for letting us known that this bug exists.

Unfortunate I don't care much about this code. This code is part of the
old UAPI for 802.15.4 subsystems and there are many bugs known.

Nevertheless I added my ack here and would like that Marcel apply this
patch into his bluetooth tree repository.

The new netlink api exists since 3.19 and highly recommended to don't
use the old stuff. The ieee802154 never got out the experimental state,
there was a patch [0] which globally remove the experimental Kconfig
entry, but no maintainer ever said that this branch isn't in
experimental state anymore.

I will prepare a RFC series to remove all deprecated handling which we
have replacements for it, these are:

 - old netlink api
 - af_802154 raw sockets, will replaced by AF_PACKET RAW

- Alex

[0] https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/net/ieee802154/Kconfig?id=f4671a90c418b5aae14b61a9fc9d79c629403ca0