Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/drivers
History
Lin Ma 775d2e4535 net: qualcomm: rmnet: fix global oob in rmnet_policy 
[ Upstream commit b33fb5b801c6db408b774a68e7c8722796b59ecc ]

The variable rmnet_link_ops assign a *bigger* maxtype which leads to a
global out-of-bounds read when parsing the netlink attributes. See bug
trace below:

==================================================================
BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline]
BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600
Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207

CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G                 N 6.1.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x172/0x475 mm/kasan/report.c:395
 kasan_report+0xbb/0x1c0 mm/kasan/report.c:495
 validate_nla lib/nlattr.c:386 [inline]
 __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600
 __nla_parse+0x3e/0x50 lib/nlattr.c:697
 nla_parse_nested_deprecated include/net/netlink.h:1248 [inline]
 __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594
 rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091
 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0x154/0x190 net/socket.c:734
 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482
 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536
 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fdcf2072359
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359
RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000
 </TASK>

The buggy address belongs to the variable:
 rmnet_policy+0x30/0xe0

The buggy address belongs to the physical page:
page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243
flags: 0x200000000001000(reserved|node=0|zone=2)
raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07
 ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9
>ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
                                                 ^
 ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9
 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9

According to the comment of `nla_parse_nested_deprecated`, the maxtype
should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here.

Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Subash Abhinov Kasiviswanathan <quic_subashab@quicinc.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20240110061400.3356108-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 12:12:51 +01:00
..
accessibility Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
acpi acpi: property: Let args be NULL in __acpi_node_get_property_reference 2024-11-18 12:12:49 +01:00
amba Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
android binder: fix race between mmput() and do_exit() 2024-11-18 12:12:45 +01:00
ata ata: pata_isapnp: Add missing error check for devm_ioport_map() 2024-11-18 12:10:54 +01:00
atm atm: solos-pci: Fix potential deadlock on &tx_queue_lock 2024-11-18 12:11:48 +01:00
auxdisplay Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
base software node: Let args be NULL in software_node_get_reference_args 2024-11-18 12:12:49 +01:00
battery drivers: battery_v2: sec_battery: export {CURRENT/VOLTAGE}_MAX to sysfs 2024-11-17 17:43:14 +01:00
bcma Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
block zram: use copy_page for full page copy 2024-11-17 17:41:38 +01:00
bluetooth Bluetooth: btmtkuart: fix recv_buf() return value 2024-11-18 12:12:38 +01:00
bts Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bus bus: ti-sysc: Flush posted write only after srst_udelay 2024-11-18 12:12:01 +01:00
cdrom Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
char hwrng: geode - fix accessing registers 2024-11-18 11:43:02 +01:00
clk clk: fixed-rate: add devm_clk_hw_register_fixed_rate 2024-11-18 12:12:43 +01:00
clocksource clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware 2024-11-18 11:43:12 +01:00
connector Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
counter counter: microchip-tcb-capture: Fix the use of internal GCLK logic 2024-11-08 11:25:51 +01:00
cpufreq cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() 2024-11-18 12:12:24 +01:00
cpuidle Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crypto virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() 2024-11-18 12:12:45 +01:00
dax Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dca Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
devfreq PM / devfreq: rockchip-dfi: Make pmu regmap mandatory 2024-11-18 11:42:49 +01:00
dio Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dma dmaengine: stm32-mdma: correct desc prep when channel running 2024-11-18 11:43:25 +01:00
dma-buf Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
edac EDAC/thunderx: Fix possible out-of-bounds string access 2024-11-18 12:12:19 +01:00
eisa Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
extcon Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fingerprint Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
firewire firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards 2024-11-18 12:12:08 +01:00
firmware firmware: meson_sm: populate platform devices from sm device tree data 2024-11-18 12:12:28 +01:00
fpga Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fsi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gnss Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gpio gpiolib: sysfs: Fix error handling on failed export 2024-11-18 12:11:45 +01:00
gpu gpu/drm/radeon: fix two memleaks in radeon_vm_init 2024-11-18 12:12:41 +01:00
greybus Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gud Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hid HID: wacom: Correct behavior when processing some confidence == false touches 2024-11-18 12:12:48 +01:00
hsi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hv Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hwmon hwmon: (acpi_power_meter) Fix 4.29 MW bug 2024-11-18 12:11:41 +01:00
hwspinlock Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hwtracing coresight: etm4x: Fix width of CCITMIN field 2024-11-18 12:12:19 +01:00
i2c i2c: rk3x: fix potential spinlock recursion on poll 2024-11-18 12:12:17 +01:00
i3c i3c: master: cdns: Fix reading status register 2024-11-18 11:43:26 +01:00
ide Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
idle Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ifconn Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iio iio: adc: ad9467: fix scale setting 2024-11-18 12:12:49 +01:00
infiniband IB/iser: Prevent invalidating wrong MR 2024-11-18 12:12:43 +01:00
input Input: atkbd - use ab83 as id when skipping the getid command 2024-11-18 12:12:44 +01:00
interconnect interconnect: Treat xlate() returning NULL node as an error 2024-11-18 12:12:00 +01:00
iommu iommu/arm-smmu-qcom: Add missing GMU entry to match table 2024-11-18 12:12:47 +01:00
ipack Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
irqchip irqchip/stm32-exti: add missing DT IRQ flag translation 2024-11-18 10:58:46 +01:00
isdn Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kperfmon Kperfmon: add xyunbound version 2024-06-15 16:28:49 -03:00
kq/mesh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
leds leds: aw2013: Select missing dependency REGMAP_I2C 2024-11-18 12:12:48 +01:00
lightnvm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
macintosh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mailbox Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mcb mcb: fix error handling for different scenarios when parsing 2024-11-18 11:43:25 +01:00
md dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() 2024-11-18 12:12:03 +01:00
media media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() 2024-11-18 12:12:41 +01:00
memory Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
memstick Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
message Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mfd mfd: syscon: Fix null pointer dereference in of_syscon_register() 2024-11-18 12:12:48 +01:00
misc misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write 2024-11-18 12:11:45 +01:00
mmc mmc: sdhci_omap: Fix TI SoC dependencies 2024-11-18 12:12:43 +01:00
most Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mtd mtd: Fix gluebi NULL pointer dereference caused by ftl notifier 2024-11-18 12:12:25 +01:00
muic Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mux Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
net net: qualcomm: rmnet: fix global oob in rmnet_policy 2024-11-18 12:12:51 +01:00
nfc drivers/nfc_logger: Fix implicit int 2024-06-15 16:28:48 -03:00
ntb Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nubus Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nvdimm nd_btt: Make BTT lanes preemptible 2024-11-18 11:43:03 +01:00
nvme nvmet-tcp: Fix the H2C expected PDU len calculation 2024-11-18 12:12:50 +01:00
nvmem nvmem: imx: correct nregs for i.MX6UL 2024-11-18 10:58:31 +01:00
of of: unittest: Fix of_count_phandle_with_args() expected value message 2024-11-18 12:12:43 +01:00
opp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
oprofile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
parisc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
parport parport: parport_serial: Add Brainboxes device IDs and geometry 2024-11-18 12:12:19 +01:00
pci PCI: keystone: Fix race condition when initializing PHYs 2024-11-18 12:12:50 +01:00
pcmcia pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() 2024-11-18 11:43:06 +01:00
perf perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 2024-11-08 11:24:52 +01:00
phy phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins 2024-11-08 11:26:20 +01:00
pinctrl pinctrl: lochnagar: Don't build on MIPS 2024-11-18 12:12:11 +01:00
platform platform/x86: intel_telemetry: Fix kernel doc descriptions 2024-11-18 12:11:56 +01:00
pnp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
power power: supply: cw2015: correct time_to_empty units in sysfs 2024-11-18 12:12:49 +01:00
powercap Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pps Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ps3 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ptp ptp: annotate data-race around q->head and q->tail 2024-11-18 11:43:19 +01:00
pwm pwm: jz4740: Don't use dev_err_probe() in .request() 2024-11-18 12:12:47 +01:00
rapidio Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ras Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
regulator regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" 2024-11-08 11:26:17 +01:00
remoteproc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reset reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning 2024-11-18 12:12:16 +01:00
rpmsg rpmsg: Fix possible refcount leak in rpmsg_register_device_override() 2024-11-18 10:58:46 +01:00
rtc rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call 2024-11-18 11:43:06 +01:00
s390 s390/scm: fix virtual vs physical address confusion 2024-11-18 12:12:16 +01:00
samsung Fix clang 16 errors treewide 2024-06-15 16:28:48 -03:00
sbus Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scsi scsi: hisi_sas: Replace with standard error code return value 2024-11-18 12:12:36 +01:00
sensorhub treewide: fix build errors 2024-06-15 16:21:17 -03:00
sensors Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sfi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
siox Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
slimbus Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
soc soc: qcom: llcc: Handle a second device without data corruption 2024-11-18 11:43:02 +01:00
soundwire soundwire: stream: fix NULL pointer dereference for multi_link 2024-11-18 12:11:57 +01:00
spi spi: sh-msiof: Enforce fixed DTDL for R-Car H3 2024-11-18 12:12:25 +01:00
spmi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
spu_verify Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ssb Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
staging media: rkisp1: Disable runtime PM in probe error path 2024-11-18 12:12:40 +01:00
sti Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
target Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tee tee: optee: Fix supplicant based device enumeration 2024-11-18 12:11:39 +01:00
thermal thermal: core: prevent potential string overflow 2024-11-18 11:42:50 +01:00
thunderbolt thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge 2024-11-08 11:26:11 +01:00
tty serial: imx: Correct clock error message in function probe() 2024-11-18 12:12:50 +01:00
uh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uio uio: Fix use-after-free in uio_open 2024-11-18 12:12:19 +01:00
usb usb: cdc-acm: return correct error code on unsupported break 2024-11-18 12:12:50 +01:00
vdpa Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vfio Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vhost Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vibrator Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
video fbdev: flush deferred work in fb_deferred_io_fsync() 2024-11-18 12:12:47 +01:00
virt Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
virtio virtio-mmio: fix memory leak of vm_dev 2024-11-18 10:58:28 +01:00
vision Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vision3 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
visorbus Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vlynq Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vme Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
w1 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
watchdog watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused 2024-11-18 12:12:42 +01:00
xen swiotlb-xen: provide the "max_mapping_size" method 2024-11-18 12:10:57 +01:00
zorro Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig drivers: add stub kperfmon 2024-06-15 16:28:49 -03:00
Kconfig.variant1 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile drivers: add stub kperfmon 2024-06-15 16:28:49 -03:00
Makefile.variant1 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00