lkml.org 
[lkml]   [2022]   [Jan]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: [PATCH net] can: isotp: isotp_rcv_cf(): fix so->rx race problem
From
Hi,

the referenced syzbot issue has already been fixed in upstream here:

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=5f33a09e769a9da0482f20a6770a342842443776

("can: isotp: convert struct tpcon::{idx,len} to unsigned int")

Additionally this fix changes some behaviour that is required by the ISO
16765-2 specification (see below).

On 17.01.22 13:01, Ziyang Xuan wrote:
> When receive a FF, the current code logic does not consider the real
> so->rx.state but set so->rx.state to ISOTP_IDLE directly. That will
> make so->rx accessed by multiple receiving processes concurrently.

This is intentionally. "multiple receiving processes" are not allowed
resp. specified by ISO 15765-2.

> The following syz problem is one of the scenarios. so->rx.len is
> changed by isotp_rcv_ff() during isotp_rcv_cf(), so->rx.len equals
> 0 before alloc_skb() and equals 4096 after alloc_skb(). That will
> trigger skb_over_panic() in skb_put().
>
> =======================================================
> CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0
> RIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113
> Call Trace:
> <TASK>
> skb_over_panic net/core/skbuff.c:118 [inline]
> skb_put.cold+0x24/0x24 net/core/skbuff.c:1990
> isotp_rcv_cf net/can/isotp.c:570 [inline]
> isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668
> deliver net/can/af_can.c:574 [inline]
> can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635
> can_receive+0x31d/0x580 net/can/af_can.c:665
> can_rcv+0x120/0x1c0 net/can/af_can.c:696
> __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465
> __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579
>
> Check so->rx.state equals ISOTP_IDLE firstly in isotp_rcv_ff().
> Make sure so->rx idle when receive another new packet. And set
> so->rx.state to ISOTP_IDLE after whole packet being received.
>
> Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
> Reported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com
> Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
> ---
> net/can/isotp.c | 28 +++++++++++++++++-----------
> 1 file changed, 17 insertions(+), 11 deletions(-)
>
> diff --git a/net/can/isotp.c b/net/can/isotp.c
> index df6968b28bf4..a4b174f860f3 100644
> --- a/net/can/isotp.c
> +++ b/net/can/isotp.c
> @@ -443,8 +443,10 @@ static int isotp_rcv_ff(struct sock *sk, struct canfd_frame *cf, int ae)
> int off;
> int ff_pci_sz;
>
> + if (so->rx.state != ISOTP_IDLE)
> + return 0;
> +
> hrtimer_cancel(&so->rxtimer);
> - so->rx.state = ISOTP_IDLE;

No matter in which receiving state we receive a first frame (FF) we are
required to start a fresh reception process and/or terminate the current
attempt.

Best regards,
Oliver

>
> /* get the used sender LL_DL from the (first) CAN frame data length */
> so->rx.ll_dl = padlen(cf->len);
> @@ -518,8 +520,6 @@ static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae,
> so->lastrxcf_tstamp = skb->tstamp;
> }
>
> - hrtimer_cancel(&so->rxtimer);
> -
> /* CFs are never longer than the FF */
> if (cf->len > so->rx.ll_dl)
> return 1;
> @@ -531,15 +531,15 @@ static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae,
> return 1;
> }
>
> + hrtimer_cancel(&so->rxtimer);
> +
> if ((cf->data[ae] & 0x0F) != so->rx.sn) {
> /* wrong sn detected - report 'illegal byte sequence' */
> sk->sk_err = EILSEQ;
> if (!sock_flag(sk, SOCK_DEAD))
> sk_error_report(sk);
>
> - /* reset rx state */
> - so->rx.state = ISOTP_IDLE;
> - return 1;
> + goto err_out;
> }
> so->rx.sn++;
> so->rx.sn %= 16;
> @@ -551,21 +551,18 @@ static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae,
> }
>
> if (so->rx.idx >= so->rx.len) {
> - /* we are done */
> - so->rx.state = ISOTP_IDLE;
> -
> if ((so->opt.flags & ISOTP_CHECK_PADDING) &&
> check_pad(so, cf, i + 1, so->opt.rxpad_content)) {
> /* malformed PDU - report 'not a data message' */
> sk->sk_err = EBADMSG;
> if (!sock_flag(sk, SOCK_DEAD))
> sk_error_report(sk);
> - return 1;
> + goto err_out;
> }
>
> nskb = alloc_skb(so->rx.len, gfp_any());
> if (!nskb)
> - return 1;
> + goto err_out;
>
> memcpy(skb_put(nskb, so->rx.len), so->rx.buf,
> so->rx.len);
> @@ -573,6 +570,10 @@ static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae,
> nskb->tstamp = skb->tstamp;
> nskb->dev = skb->dev;
> isotp_rcv_skb(nskb, sk);
> +
> + /* we are done */
> + so->rx.state = ISOTP_IDLE;
> +
> return 0;
> }
>
> @@ -591,6 +592,11 @@ static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae,
> /* we reached the specified blocksize so->rxfc.bs */
> isotp_send_fc(sk, ae, ISOTP_FC_CTS);
> return 0;
> +
> +err_out:
> + /* reset rx state */
> + so->rx.state = ISOTP_IDLE;
> + return 1;
> }
>
> static void isotp_rcv(struct sk_buff *skb, void *data)

\
 
 \ /
  Last update: 2022-01-18 09:05    [W:0.094 / U:0.792 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site