Message ID | 20240110061400.3356108-1-linma@zju.edu.cn |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel+bounces-21740-ouuuleilei=gmail.com@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:2411:b0:101:2151:f287 with SMTP id m17csp605682dyi; Tue, 9 Jan 2024 22:14:53 -0800 (PST) X-Google-Smtp-Source: AGHT+IG64Gi3s6UTqoa0PRD11PaO5qS5+1n7ExBwMgLSfamfMnAQ7HSPNtG+figxyIefyI0QcNWP X-Received: by 2002:a17:90a:6b08:b0:28c:6f69:fb23 with SMTP id v8-20020a17090a6b0800b0028c6f69fb23mr362858pjj.50.1704867293593; Tue, 09 Jan 2024 22:14:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1704867293; cv=none; d=google.com; s=arc-20160816; b=BpIIyZI3+6uv+P903+68LHUbzUJ/waBC7vN+LIUuucwzqY1GCiH0qn1RZpaXrs4WDR KKtAP9jsxYivM0P+hQe4T2FpE4NYnIR5T6Ak+jW0soNnTIXvhKMytkLaM/jTd+40ZAeI kkl7exIJhGYwl56EfY6p/ofI5ueZxK9J9azjjn22jZxEN8nGRM1qlZ0eE8XtyCVpQNdm IL2gBhFYyv2329Zx7PR1greexTsnrQHnH897/vYNYIpVG48WXSWqNcgGrfOyK0cO4+Kp 0vlZhfQemIwEy3BXw8NDRu8igkqu7t2WGFgC7ZUXPXlumCdVxY3ZAiMtZvoeigojo6j4 ZkYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-unsubscribe:list-subscribe:list-id:precedence:message-id:date :subject:cc:to:from; bh=WTjwNuQFlQB34eHl5REmxcsbf/qBZjQ9qxcuCx+RLhk=; fh=O2SKoTMdd02ChjNlOHdY+33HetP1A8x86C5WOiLcuKM=; b=m9iYXVos77VIcTOO53aR9p5Ofl/xXrOf2SEm0vWuDIUpPoEAis5ajQLYP0tIuctDel fEgYaPI0JriYX6PxOuiwB5c/s2/iY1k7y1bfp412yw+OX4RVyO/x2zAylFiIxSceIixv C4dK7zsphPsq7OKR3A6O+z2HVpwHRObROPvd4B5ekhIxVsz638lH8NhDn3cV3MagskNg 9kv4opnyBJQUZ0AV4qVZd/6z2dClQKeD2Pegw5O6LQiICRtKzSJxiijq/bqALwQZR0SI YAuZQJlJDH9pT2V6+Uu2mt/WcgAKxeu7EuCQ6QM3ESSvt2t91IoHHQelXOqN1n8G1rsA oiAQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel+bounces-21740-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-21740-ouuuleilei=gmail.com@vger.kernel.org" Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [2604:1380:45e3:2400::1]) by mx.google.com with ESMTPS id t22-20020a17090ae51600b0028bc9ee10absi707860pjy.107.2024.01.09.22.14.53 for <ouuuleilei@gmail.com> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jan 2024 22:14:53 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-21740-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel+bounces-21740-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-21740-ouuuleilei=gmail.com@vger.kernel.org" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 5E9042895DA for <ouuuleilei@gmail.com>; Wed, 10 Jan 2024 06:14:53 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 14760364C0; Wed, 10 Jan 2024 06:14:36 +0000 (UTC) Received: from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net [20.231.56.155]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 0D477320E; Wed, 10 Jan 2024 06:14:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from localhost.localdomain (unknown [125.119.244.129]) by mail-app2 (Coremail) with SMTP id by_KCgBn31avNZ5lTRsgAA--.8423S4; Wed, 10 Jan 2024 14:14:09 +0800 (CST) From: Lin Ma <linma@zju.edu.cn> To: quic_subashab@quicinc.com, quic_stranche@quicinc.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lin Ma <linma@zju.edu.cn> Subject: [PATCH net v1] net: qualcomm: rmnet: fix global oob in rmnet_policy Date: Wed, 10 Jan 2024 14:14:00 +0800 Message-Id: <20240110061400.3356108-1-linma@zju.edu.cn> X-Mailer: git-send-email 2.17.1 X-CM-TRANSID: by_KCgBn31avNZ5lTRsgAA--.8423S4 X-Coremail-Antispam: 1UD129KBjvJXoWxGFy3XF45Xr45tr1UGF1xKrg_yoWruw1DpF yDXryxGr48try8XFsrJw1rJr15X3WDAa1UGr4xJr1rAFyDKw17JryUtFy5Ar1DCrZ0yFy2 qwnrAr4Fyr15JaUanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUyv14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26F4U JVW0owA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwCF04k20xvY0x0EwIxG rwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4 vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IY x2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26c xKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAF wI0_Jr0_GrUvcSsGvfC2KfnxnUUI43ZEXa7VUbXdbUUUUUU== X-CM-SenderInfo: qtrwiiyqvtljo62m3hxhgxhubq/ Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: <linux-kernel.vger.kernel.org> List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org> List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org> X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1787682927170285658 X-GMAIL-MSGID: 1787682927170285658 |
Series |
[net,v1] net: qualcomm: rmnet: fix global oob in rmnet_policy
|
|
Commit Message
Lin Ma
Jan. 10, 2024, 6:14 a.m. UTC
The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See bug trace below: ================================================================== BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395 kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline] __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697 nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdcf2072359 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 </TASK> The buggy address belongs to the variable: rmnet_policy+0x30/0xe0 The buggy address belongs to the physical page: page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 >ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 ^ ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 According to the comment of `nla_parse_nested_deprecated`, the maxtype should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink") Signed-off-by: Lin Ma <linma@zju.edu.cn> --- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Comments
On 1/9/2024 11:14 PM, Lin Ma wrote: > The variable rmnet_link_ops assign a *bigger* maxtype which leads to a > global out-of-bounds read when parsing the netlink attributes. See bug > trace below: > > ================================================================== > BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] > BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 > Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 > > CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 > print_address_description mm/kasan/report.c:284 [inline] > print_report+0x172/0x475 mm/kasan/report.c:395 > kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 > validate_nla lib/nlattr.c:386 [inline] > __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 > __nla_parse+0x3e/0x50 lib/nlattr.c:697 > nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] > __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 > rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 > rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 > netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 > netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] > netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 > netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 > sock_sendmsg_nosec net/socket.c:714 [inline] > sock_sendmsg+0x154/0x190 net/socket.c:734 > ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 > ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 > __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x7fdcf2072359 > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e > RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 > RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 > RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 > </TASK> > > The buggy address belongs to the variable: > rmnet_policy+0x30/0xe0 > > The buggy address belongs to the physical page: > page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 > flags: 0x200000000001000(reserved|node=0|zone=2) > raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 > raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 > ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 >> ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 > ^ > ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 > ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 > > According to the comment of `nla_parse_nested_deprecated`, the maxtype > should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. > > Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink") > Signed-off-by: Lin Ma <linma@zju.edu.cn> > --- > drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c > index 39d24e07f306..5b69b9268c75 100644 > --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c > +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c > @@ -396,7 +396,7 @@ static int rmnet_fill_info(struct sk_buff *skb, const struct net_device *dev) > > struct rtnl_link_ops rmnet_link_ops __read_mostly = { > .kind = "rmnet", > - .maxtype = __IFLA_RMNET_MAX, > + .maxtype = IFLA_RMNET_MAX, > .priv_size = sizeof(struct rmnet_priv), > .setup = rmnet_vnd_setup, > .validate = rmnet_rtnl_validate, Thanks for fixing this Reviewed-by: Subash Abhinov Kasiviswanathan <quic_subashab@quicinc.com>
On Wed, Jan 10, 2024 at 02:14:00PM +0800, Lin Ma wrote: > The variable rmnet_link_ops assign a *bigger* maxtype which leads to a > global out-of-bounds read when parsing the netlink attributes. See bug > trace below: > > ================================================================== > BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] > BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 > Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 > > CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 > print_address_description mm/kasan/report.c:284 [inline] > print_report+0x172/0x475 mm/kasan/report.c:395 > kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 > validate_nla lib/nlattr.c:386 [inline] > __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 > __nla_parse+0x3e/0x50 lib/nlattr.c:697 > nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] > __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 > rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 > rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 > netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 > netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] > netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 > netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 > sock_sendmsg_nosec net/socket.c:714 [inline] > sock_sendmsg+0x154/0x190 net/socket.c:734 > ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 > ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 > __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x7fdcf2072359 > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e > RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 > RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 > RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 > </TASK> > > The buggy address belongs to the variable: > rmnet_policy+0x30/0xe0 > > The buggy address belongs to the physical page: > page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 > flags: 0x200000000001000(reserved|node=0|zone=2) > raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 > raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 > ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 > >ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 > ^ > ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 > ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 > > According to the comment of `nla_parse_nested_deprecated`, the maxtype > should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. > > Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink") > Signed-off-by: Lin Ma <linma@zju.edu.cn> Thanks, I agree with your analysis, proposed fix, and that the problem was introduced in it's current form by the cited commit. Reviewed-by: Simon Horman <horms@kernel.org>
Wed, Jan 10, 2024 at 07:14:00AM CET, linma@zju.edu.cn wrote: >The variable rmnet_link_ops assign a *bigger* maxtype which leads to a >global out-of-bounds read when parsing the netlink attributes. See bug >trace below: > >================================================================== >BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] >BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 >Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 > >CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 >Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 >Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 > print_address_description mm/kasan/report.c:284 [inline] > print_report+0x172/0x475 mm/kasan/report.c:395 > kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 > validate_nla lib/nlattr.c:386 [inline] > __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 > __nla_parse+0x3e/0x50 lib/nlattr.c:697 > nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] > __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 > rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 > rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 > netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 > netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] > netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 > netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 > sock_sendmsg_nosec net/socket.c:714 [inline] > sock_sendmsg+0x154/0x190 net/socket.c:734 > ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 > ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 > __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd >RIP: 0033:0x7fdcf2072359 >Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 >RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e >RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 >RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 >RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 >R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 >R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 > </TASK> > >The buggy address belongs to the variable: > rmnet_policy+0x30/0xe0 > >The buggy address belongs to the physical page: >page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 >flags: 0x200000000001000(reserved|node=0|zone=2) >raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 >raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 >page dumped because: kasan: bad access detected > >Memory state around the buggy address: > ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 > ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 >>ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 > ^ > ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 > ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 > >According to the comment of `nla_parse_nested_deprecated`, the maxtype >should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. > >Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink") >Signed-off-by: Lin Ma <linma@zju.edu.cn> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Btw, any idea why this rmnet thing, which clearly looks like a softdevice, is in vendor directory where drivers for real devices should reside?
On 1/10/2024 9:32 AM, Jiri Pirko wrote: > Wed, Jan 10, 2024 at 07:14:00AM CET, linma@zju.edu.cn wrote: >> The variable rmnet_link_ops assign a *bigger* maxtype which leads to a >> global out-of-bounds read when parsing the netlink attributes. See bug >> trace below: >> >> ================================================================== >> BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] >> BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 >> Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 >> >> CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 >> Call Trace: >> <TASK> >> __dump_stack lib/dump_stack.c:88 [inline] >> dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 >> print_address_description mm/kasan/report.c:284 [inline] >> print_report+0x172/0x475 mm/kasan/report.c:395 >> kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 >> validate_nla lib/nlattr.c:386 [inline] >> __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 >> __nla_parse+0x3e/0x50 lib/nlattr.c:697 >> nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] >> __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 >> rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 >> rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 >> netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 >> netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] >> netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 >> netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 >> sock_sendmsg_nosec net/socket.c:714 [inline] >> sock_sendmsg+0x154/0x190 net/socket.c:734 >> ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 >> ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 >> __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 >> do_syscall_x64 arch/x86/entry/common.c:50 [inline] >> do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 >> entry_SYSCALL_64_after_hwframe+0x63/0xcd >> RIP: 0033:0x7fdcf2072359 >> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 >> RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e >> RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 >> RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 >> RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 >> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 >> R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 >> </TASK> >> >> The buggy address belongs to the variable: >> rmnet_policy+0x30/0xe0 >> >> The buggy address belongs to the physical page: >> page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 >> flags: 0x200000000001000(reserved|node=0|zone=2) >> raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 >> raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 >> page dumped because: kasan: bad access detected >> >> Memory state around the buggy address: >> ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 >> ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 >>> ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 >> ^ >> ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 >> ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 >> >> According to the comment of `nla_parse_nested_deprecated`, the maxtype >> should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. >> >> Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink") >> Signed-off-by: Lin Ma <linma@zju.edu.cn> > > Reviewed-by: Jiri Pirko <jiri@nvidia.com> > > Btw, any idea why this rmnet thing, which clearly looks like a > softdevice, is in vendor directory where drivers for real devices should > reside? > I believe we had discussed this during the initial implementation patch series and concluded to move the code to drivers. Link for reference - https://lkml.kernel.org/netdev/217d998fd9d869f0e5ded0d1add3f550@codeaurora.org/
Wed, Jan 10, 2024 at 07:16:38PM CET, quic_subashab@quicinc.com wrote: >On 1/10/2024 9:32 AM, Jiri Pirko wrote: >> Wed, Jan 10, 2024 at 07:14:00AM CET, linma@zju.edu.cn wrote: >> > The variable rmnet_link_ops assign a *bigger* maxtype which leads to a >> > global out-of-bounds read when parsing the netlink attributes. See bug >> > trace below: >> > >> > ================================================================== >> > BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] >> > BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 >> > Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 >> > >> > CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 >> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 >> > Call Trace: >> > <TASK> >> > __dump_stack lib/dump_stack.c:88 [inline] >> > dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 >> > print_address_description mm/kasan/report.c:284 [inline] >> > print_report+0x172/0x475 mm/kasan/report.c:395 >> > kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 >> > validate_nla lib/nlattr.c:386 [inline] >> > __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 >> > __nla_parse+0x3e/0x50 lib/nlattr.c:697 >> > nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] >> > __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 >> > rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 >> > rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 >> > netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 >> > netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] >> > netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 >> > netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 >> > sock_sendmsg_nosec net/socket.c:714 [inline] >> > sock_sendmsg+0x154/0x190 net/socket.c:734 >> > ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 >> > ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 >> > __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 >> > do_syscall_x64 arch/x86/entry/common.c:50 [inline] >> > do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 >> > entry_SYSCALL_64_after_hwframe+0x63/0xcd >> > RIP: 0033:0x7fdcf2072359 >> > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 >> > RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e >> > RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 >> > RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 >> > RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 >> > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 >> > R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 >> > </TASK> >> > >> > The buggy address belongs to the variable: >> > rmnet_policy+0x30/0xe0 >> > >> > The buggy address belongs to the physical page: >> > page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 >> > flags: 0x200000000001000(reserved|node=0|zone=2) >> > raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 >> > raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 >> > page dumped because: kasan: bad access detected >> > >> > Memory state around the buggy address: >> > ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 >> > ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 >> > > ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 >> > ^ >> > ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 >> > ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 >> > >> > According to the comment of `nla_parse_nested_deprecated`, the maxtype >> > should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. >> > >> > Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink") >> > Signed-off-by: Lin Ma <linma@zju.edu.cn> >> >> Reviewed-by: Jiri Pirko <jiri@nvidia.com> >> >> Btw, any idea why this rmnet thing, which clearly looks like a >> softdevice, is in vendor directory where drivers for real devices should >> reside? >> > >I believe we had discussed this during the initial implementation patch >series and concluded to move the code to drivers. Link for reference - > >https://lkml.kernel.org/netdev/217d998fd9d869f0e5ded0d1add3f550@codeaurora.org/ Okay, I forgot of course. Still, this is quite odd beast :/
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Wed, 10 Jan 2024 14:14:00 +0800 you wrote: > The variable rmnet_link_ops assign a *bigger* maxtype which leads to a > global out-of-bounds read when parsing the netlink attributes. See bug > trace below: > > ================================================================== > BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] > BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 > Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 > > [...] Here is the summary with links: - [net,v1] net: qualcomm: rmnet: fix global oob in rmnet_policy https://git.kernel.org/netdev/net/c/b33fb5b801c6 You are awesome, thank you!
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c index 39d24e07f306..5b69b9268c75 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c @@ -396,7 +396,7 @@ static int rmnet_fill_info(struct sk_buff *skb, const struct net_device *dev) struct rtnl_link_ops rmnet_link_ops __read_mostly = { .kind = "rmnet", - .maxtype = __IFLA_RMNET_MAX, + .maxtype = IFLA_RMNET_MAX, .priv_size = sizeof(struct rmnet_priv), .setup = rmnet_vnd_setup, .validate = rmnet_rtnl_validate,