From patchwork Tue Nov 3 21:39:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anant Thazhemadam X-Patchwork-Id: 1393457 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=flTf5cIL; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4CQjr458lDz9sT6 for ; Wed, 4 Nov 2020 08:40:20 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732382AbgKCVkL (ORCPT ); Tue, 3 Nov 2020 16:40:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58244 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731789AbgKCVkD (ORCPT ); Tue, 3 Nov 2020 16:40:03 -0500 Received: from mail-pf1-x442.google.com (mail-pf1-x442.google.com [IPv6:2607:f8b0:4864:20::442]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A430C0617A6; Tue, 3 Nov 2020 13:40:03 -0800 (PST) Received: by mail-pf1-x442.google.com with SMTP id e7so15434296pfn.12; Tue, 03 Nov 2020 13:40:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Kay+/pGgafzcJkffZWNTFPkoHCNna9I8Qp0W22XX95A=; b=flTf5cILyNWgpLfAwfPLQMJlF50oKrmpRGujjbXXW++BK/Y2Ll86m8QXoPl4nXbUXz rh6js5Sb8DmseSVN7IUcJRxpYJMmC23VGJw3NGSjy5gAPbgr7fibi9aUZQNCJRr6NBpf x8/rWxBRBgM6WqT+o1fa3XXXGT/3pvMVIacusX4YmZRMeVkV3OPdJvM0tc2OvulUeoO1 SjR001KOASG5Di/zKqyhQFCTyp1p3rKhBNum0ZlAI1vaMOJfKohSAflhcND2c43u4MtM kDeEpeSjo9kDI6KgdD3ve4opROeIseGizZMHtzVwxllANcb/cp7ZJ4TMKTcYxBctzdi7 ld4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Kay+/pGgafzcJkffZWNTFPkoHCNna9I8Qp0W22XX95A=; b=e/ISnLfqSuzKf9cuSZFW+eYDgXC49AlFY3pmUX0gbCWx4yk1MOTRkjXUM8TRTX77lf 6X+FjQ3mSgc9xUjS/sdqzBytIMTWIQj6ID5OoKXARdxzxzWKnDRYu+h82xs/n2rdg/L9 apQt/oL7SZGXkvWgh3D0Tme0RKAqAj7Ntcc+vcVtTV+YpnK8wIdXC7yAwPGA43pECyuP LMdUozVLFJ4FDpuu88gEhEnt/iVQqs54NM48HVdBe1XNoqYKl0BekmyCEsbV2V7H1wRe WmpxlExr6F9LlYIIq9nsBMC3Y2fhslxIvoXVDuVhvfSuDjQqAg8b172GXrMCEXus1Ni7 7BNA== X-Gm-Message-State: AOAM53303sz8qcm0hsrsU4qyNVOiWd5hHPEhhuPu26dWvl41zlzN+BXP ZevPdbVXGm5pQWmIKBu+ox0= X-Google-Smtp-Source: ABdhPJzD+WlAj76QkDXIfZDHla5nSlgn/pNJPRMS1mH17Ja57/QB1VgLI+Ljx2zXwtzf/p7EWc/vgQ== X-Received: by 2002:a65:6493:: with SMTP id e19mr18352684pgv.276.1604439602619; Tue, 03 Nov 2020 13:40:02 -0800 (PST) Received: from localhost.localdomain ([49.207.221.93]) by smtp.gmail.com with ESMTPSA id 15sm16420108pgs.52.2020.11.03.13.39.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2020 13:40:01 -0800 (PST) From: Anant Thazhemadam To: socketcan@hartkopp.net, mkl@pengutronix.de, davem@davemloft.net, kuba@kernel.org Cc: linux-can@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Anant Thazhemadam , syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com Subject: [PATCH 2/2] can: af_can: prevent potential access of uninitialized member in canfd_rcv() Date: Wed, 4 Nov 2020 03:09:06 +0530 Message-Id: <20201103213906.24219-3-anant.thazhemadam@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20201103213906.24219-1-anant.thazhemadam@gmail.com> References: <20201103213906.24219-1-anant.thazhemadam@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this uninitialized cfd->len is accessed nonetheless by pr_warn_once(). Fix this uninitialized variable access by checking cfd->len's validity condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's condition is checked, and appropriately modify the log messages that are generated as well. In case either of the required conditions fail, the skb is freed and NET_RX_DROP is returned, same as before. Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once") Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com Tested-by: Anant Thazhemadam Signed-off-by: Anant Thazhemadam --- This patch was locally tested using the reproducer and .config file generated by syzbot. net/can/af_can.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/net/can/af_can.c b/net/can/af_can.c index 8ea01524f062..d759334f8843 100644 --- a/net/can/af_can.c +++ b/net/can/af_can.c @@ -703,16 +703,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, { struct canfd_frame *cfd = (struct canfd_frame *)skb->data; - if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU || - cfd->len > CANFD_MAX_DLEN)) { - pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n", + if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) { + pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n", + dev->type, skb->len); + goto free_skb; + } + + /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */ + if (unlikely(cfd->len > CANFD_MAX_DLEN)) { + pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n", dev->type, skb->len, cfd->len); - kfree_skb(skb); - return NET_RX_DROP; + goto free_skb; } can_receive(skb, dev); return NET_RX_SUCCESS; + +free_skb: + kfree_skb(skb); + return NET_RX_DROP; } /* af_can protocol functions */