lkml.org 
[lkml]   [2021]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.12 061/178] net: qrtr: fix OOB Read in qrtr_endpoint_post
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit ad9d24c9429e2159d1e279dc3a83191ccb4daf1d ]

    Syzbot reported slab-out-of-bounds Read in
    qrtr_endpoint_post. The problem was in wrong
    _size_ type:

    if (len != ALIGN(size, 4) + hdrlen)
    goto err;

    If size from qrtr_hdr is 4294967293 (0xfffffffd), the result of
    ALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293
    in header this check won't fail and

    skb_put_data(skb, data + hdrlen, size);

    will read out of bound from data, which is hdrlen allocated block.

    Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets")
    Reported-and-tested-by: syzbot+1917d778024161609247@syzkaller.appspotmail.com
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/qrtr/qrtr.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
    index 1e4fb568fa84..24f10bf7d8a3 100644
    --- a/net/qrtr/qrtr.c
    +++ b/net/qrtr/qrtr.c
    @@ -435,7 +435,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
    struct qrtr_sock *ipc;
    struct sk_buff *skb;
    struct qrtr_cb *cb;
    - unsigned int size;
    + size_t size;
    unsigned int ver;
    size_t hdrlen;

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-06-21 18:46    [W:4.118 / U:0.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site