From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A60DC433EF for ; Fri, 10 Jun 2022 14:01:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347334AbiFJOBa (ORCPT ); Fri, 10 Jun 2022 10:01:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39068 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344429AbiFJN7q (ORCPT ); Fri, 10 Jun 2022 09:59:46 -0400 Received: from mail-yw1-x1129.google.com (mail-yw1-x1129.google.com [IPv6:2607:f8b0:4864:20::1129]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6F69B25FC68 for ; Fri, 10 Jun 2022 06:59:42 -0700 (PDT) Received: by mail-yw1-x1129.google.com with SMTP id 00721157ae682-30c143c41e5so273114767b3.3 for ; Fri, 10 Jun 2022 06:59:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OWEPC7SAufrCkjFU0SfT1ySX9jvLl/PM1GkMbPRUTlE=; b=EVitkBKz9HTETcRAjD4jGW+cco0VlHX2iLKnRGHPQGm6CKoryiObuhFKTAHjd+LGLi 6zYOTYLEbsUluzdHJgAz9ZvvMk29rs749HjMBKdzGaPX9cgem3LHcsh2HMGSdaxXyRJn 5YuSeynELes+xuZW7GEs4pT8lndKHz81Wjepfu6WP0UvgZm89gNVRHe/9+00BCNqtxJy ETi3leVwScGZNzvk/MJrdTAKM9ui19dbzxWDfS2KaWRhNOArXj3sqyJMln0aBNlmxCwH iQBVpK3e0RfcWIOTE3ebm+YXYmyEWbN0WcotgIMyCtpJbrsoD5JWvelbGJQWnS6mCwe5 EGOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OWEPC7SAufrCkjFU0SfT1ySX9jvLl/PM1GkMbPRUTlE=; b=bGRlHgtBfcQnpLUuvvOLxIkvmikspquB5P6/+Brb5e7k16XAlv324plqBF7u+hLegh 6Nen1B9nZFLj5p6k96k29Y32L+KGfhulEa8xPX3N9v2d3ujp8N4u9DPPTVJQNou34Lou XFCQQ/uhOKqhzpGbHxb/0CFJQiAkHTPAJaEyRwWr6TNWAy1E3GTLmPgcXzZdPL2QZM2w SZmIizvJlrUa+wGqvDgpLIWoDoOEYMoerrGre1mqQ4B0osTsoCJOaUre0m4WOkTdQdSh Fk92zOtM0hK9MVaL3aUTBJX0gMU+bFf1n7pAm/qzVyVHVaJaTLyDy1x22HEPmgx8hHpe A9TQ== X-Gm-Message-State: AOAM530Sl7hf7S4/v9VIk3+ZHVlSptXXtS3OLNPb75WR5OE2PwawZz/o ih8WMsGrs7TFWenxAwmYNoeMrUg75KHY07JJ5AdVSA== X-Google-Smtp-Source: ABdhPJzpokt62wF8w51PGFxOhJ4bvWwLARVlE5z03nqvvSEUQRP60Ws5kIgElWNEyhTSKx+UNMTvrNFzYJ1PAxe6uqw= X-Received: by 2002:a81:7b86:0:b0:310:e75:3abb with SMTP id w128-20020a817b86000000b003100e753abbmr42924798ywc.332.1654869581103; Fri, 10 Jun 2022 06:59:41 -0700 (PDT) MIME-Version: 1.0 References: <20220610110749.110881-1-soenke.huster@eknoes.de> In-Reply-To: <20220610110749.110881-1-soenke.huster@eknoes.de> From: Eric Dumazet Date: Fri, 10 Jun 2022 06:59:29 -0700 Message-ID: Subject: Re: [PATCH v2] Bluetooth: RFCOMM: Use skb_trim to trim checksum To: Soenke Huster Cc: Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , "David S. Miller" , Jakub Kicinski , Paolo Abeni , linux-bluetooth@vger.kernel.org, netdev , LKML Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jun 10, 2022 at 4:08 AM Soenke Huster wrote: > > As skb->tail might be zero, it can underflow. This leads to a page > fault: skb_tail_pointer simply adds skb->tail (which is now MAX_UINT) > to skb->head. > > BUG: unable to handle page fault for address: ffffed1021de29ff > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > RIP: 0010:rfcomm_run+0x831/0x4040 (net/bluetooth/rfcomm/core.c:1751) > > By using skb_trim instead of the direct manipulation, skb->tail > is reset. Thus, the correct pointer to the checksum is used. > > Signed-off-by: Soenke Huster > --- > v2: Clarified how the bug triggers, minimize code change > > net/bluetooth/rfcomm/core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c > index 7324764384b6..443b55edb3ab 100644 > --- a/net/bluetooth/rfcomm/core.c > +++ b/net/bluetooth/rfcomm/core.c > @@ -1747,7 +1747,7 @@ static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s, > type = __get_type(hdr->ctrl); > > /* Trim FCS */ > - skb->len--; skb->tail--; > + skb_trim(skb, skb->len - 1); > fcs = *(u8 *)skb_tail_pointer(skb); > > if (__check_fcs(skb->data, type, fcs)) { > -- > 2.36.1 > Again, I do not see how skb->tail could possibly zero at this point. If it was, skb with illegal layout has been queued in the first place, we need to fix the producer, not the consumer. A driver missed an skb_put() perhaps. Can you please dump the skb here ? diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index 7324764384b6773074032ad671777bf86bd3360e..358ccb4fe7214aea0bb4084188c7658316fe0ff7 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1746,6 +1746,11 @@ static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s, dlci = __get_dlci(hdr->addr); type = __get_type(hdr->ctrl); + if (!skb->tail) { + DO_ONCE_LITE(skb_dump(KERN_ERR, skb, false)); + kfree_skb(skb); + return s; + } /* Trim FCS */ skb->len--; skb->tail--; fcs = *(u8 *)skb_tail_pointer(skb);