From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
syzbot <syzkaller@googlegroups.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.18 31/50] net: rose: fix a possible stack overflow
Date: Mon, 1 Apr 2019 19:03:14 +0200 [thread overview]
Message-ID: <20190401170044.636756709@linuxfoundation.org> (raw)
In-Reply-To: <20190401170041.257273804@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e5dcc0c3223c45c94100f05f28d8ef814db3d82c ]
rose_write_internal() uses a temp buffer of 100 bytes, but a manual
inspection showed that given arbitrary input, rose_create_facilities()
can fill up to 110 bytes.
Lets use a tailroom of 256 bytes for peace of mind, and remove
the bounce buffer : we can simply allocate a big enough skb
and adjust its length as needed.
syzbot report :
BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:352 [inline]
BUG: KASAN: stack-out-of-bounds in rose_create_facilities net/rose/rose_subr.c:521 [inline]
BUG: KASAN: stack-out-of-bounds in rose_write_internal+0x597/0x15d0 net/rose/rose_subr.c:116
Write of size 7 at addr ffff88808b1ffbef by task syz-executor.0/24854
CPU: 0 PID: 24854 Comm: syz-executor.0 Not tainted 5.0.0+ #97
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x123/0x190 mm/kasan/generic.c:191
memcpy+0x38/0x50 mm/kasan/common.c:131
memcpy include/linux/string.h:352 [inline]
rose_create_facilities net/rose/rose_subr.c:521 [inline]
rose_write_internal+0x597/0x15d0 net/rose/rose_subr.c:116
rose_connect+0x7cb/0x1510 net/rose/af_rose.c:826
__sys_connect+0x266/0x330 net/socket.c:1685
__do_sys_connect net/socket.c:1696 [inline]
__se_sys_connect net/socket.c:1693 [inline]
__x64_sys_connect+0x73/0xb0 net/socket.c:1693
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458079
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f47b8d9dc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458079
RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000004
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f47b8d9e6d4
R13: 00000000004be4a4 R14: 00000000004ceca8 R15: 00000000ffffffff
The buggy address belongs to the page:
page:ffffea00022c7fc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x1fffc0000000000()
raw: 01fffc0000000000 0000000000000000 ffffffff022c0101 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88808b1ffa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88808b1ffb00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 03
>ffff88808b1ffb80: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 04 f3
^
ffff88808b1ffc00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
ffff88808b1ffc80: 00 00 00 00 00 00 00 f1 f1 f1 f1 f1 f1 01 f2 01
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rose/rose_subr.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
--- a/net/rose/rose_subr.c
+++ b/net/rose/rose_subr.c
@@ -105,16 +105,17 @@ void rose_write_internal(struct sock *sk
struct sk_buff *skb;
unsigned char *dptr;
unsigned char lci1, lci2;
- char buffer[100];
- int len, faclen = 0;
+ int maxfaclen = 0;
+ int len, faclen;
+ int reserve;
- len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 1;
+ reserve = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1;
+ len = ROSE_MIN_LEN;
switch (frametype) {
case ROSE_CALL_REQUEST:
len += 1 + ROSE_ADDR_LEN + ROSE_ADDR_LEN;
- faclen = rose_create_facilities(buffer, rose);
- len += faclen;
+ maxfaclen = 256;
break;
case ROSE_CALL_ACCEPTED:
case ROSE_CLEAR_REQUEST:
@@ -123,15 +124,16 @@ void rose_write_internal(struct sock *sk
break;
}
- if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL)
+ skb = alloc_skb(reserve + len + maxfaclen, GFP_ATOMIC);
+ if (!skb)
return;
/*
* Space for AX.25 header and PID.
*/
- skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1);
+ skb_reserve(skb, reserve);
- dptr = skb_put(skb, skb_tailroom(skb));
+ dptr = skb_put(skb, len);
lci1 = (rose->lci >> 8) & 0x0F;
lci2 = (rose->lci >> 0) & 0xFF;
@@ -146,7 +148,8 @@ void rose_write_internal(struct sock *sk
dptr += ROSE_ADDR_LEN;
memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN);
dptr += ROSE_ADDR_LEN;
- memcpy(dptr, buffer, faclen);
+ faclen = rose_create_facilities(dptr, rose);
+ skb_put(skb, faclen);
dptr += faclen;
break;
next prev parent reply other threads:[~2019-04-01 17:41 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-01 17:02 [PATCH 3.18 00/50] 3.18.138-stable review Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 01/50] udf: Fix crash on IO error during truncate Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 02/50] futex: Ensure that futex address is aligned in handle_futex_death() Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 03/50] ext4: fix NULL pointer dereference while journal is aborted Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 04/50] ext4: fix data corruption caused by unaligned direct AIO Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 05/50] ext4: brelse all indirect buffer in ext4_ind_remove_space() Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 06/50] mmc: tmio_mmc_core: dont claim spurious interrupts Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 07/50] media: v4l2-ctrls.c/uvc: zero v4l2_event Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 08/50] Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 09/50] Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 10/50] mmc: block: Allow more than 8 partitions per card Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 11/50] arm64: fix COMPAT_SHMLBA definition for large pages Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 12/50] ARM: 8458/1: bL_switcher: add GIC dependency Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 13/50] android: unconditionally remove callbacks in sync_fence_free() Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 14/50] asm-generic: Fix local variable shadow in __set_fixmap_offset Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 15/50] staging: ashmem: Avoid deadlock with mmap/shrink Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 3.18 16/50] staging: ashmem: Add missing include Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 17/50] staging: ion: Set minimum carveout heap allocation order to PAGE_SHIFT Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 18/50] staging: goldfish: audio: fix compiliation on arm Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 19/50] ARM: 8510/1: rework ARM_CPU_SUSPEND dependencies Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 20/50] arm64/kernel: fix incorrect EL0 check in inv_entry macro Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 21/50] arm64: kernel: Include _AC definition in page.h Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 22/50] ipv6: fix endianness error in icmpv6_err Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 23/50] usb: gadget: configfs: add mutex lock before unregister gadget Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 24/50] video: fbdev: Set pixclock = 0 in goldfishfb Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 25/50] arm64: kconfig: drop CONFIG_RTC_LIB dependency Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 26/50] mmc: mmc: fix switch timeout issue caused by jiffies precision Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 27/50] cfg80211: size various nl80211 messages correctly Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 28/50] dccp: do not use ipv6 header for ipv4 flow Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 29/50] mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 30/50] net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec Greg Kroah-Hartman
2019-04-01 17:03 ` Greg Kroah-Hartman [this message]
2019-04-01 17:03 ` [PATCH 3.18 32/50] Add hlist_add_tail_rcu() (Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net) Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 33/50] packets: Always register packet sk in the same order Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 34/50] tcp: do not use ipv6 header for ipv4 flow Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 35/50] sctp: get sctphdr by offset in sctp_compute_cksum Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 36/50] mac8390: Fix mmio access size probe Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 37/50] ALSA: pcm: Fix possible OOB access in PCM oss plugins Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 38/50] ALSA: pcm: Dont suspend stream in unrecoverable PCM state Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 39/50] scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 40/50] serial: max310x: Fix to avoid potential NULL pointer dereference Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 41/50] USB: serial: cp210x: add new device id Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 42/50] USB: serial: ftdi_sio: add additional NovaTech products Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 43/50] USB: serial: mos7720: fix mos_parport refcount imbalance on error path Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 44/50] Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 45/50] fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 46/50] gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 47/50] KVM: Reject device ioctls from processes other than the VMs creator Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 48/50] xhci: Fix port resume done detection for SS ports with LPM enabled Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 49/50] ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 3.18 50/50] arm64: support keyctl() system call in 32-bit mode Greg Kroah-Hartman
2019-04-01 21:23 ` [PATCH 3.18 00/50] 3.18.138-stable review kernelci.org bot
2019-04-02 19:03 ` Guenter Roeck
2019-04-03 0:05 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190401170044.636756709@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).