From: Marc Kleine-Budde <mkl@pengutronix.de>
To: netdev@vger.kernel.org
Cc: davem@davemloft.net, kuba@kernel.org, linux-can@vger.kernel.org,
kernel@pengutronix.de,
Anant Thazhemadam <anant.thazhemadam@gmail.com>,
syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com,
Marc Kleine-Budde <mkl@pengutronix.de>
Subject: [net 02/15] can: af_can: prevent potential access of uninitialized member in canfd_rcv()
Date: Sat, 14 Nov 2020 18:33:46 +0100 [thread overview]
Message-ID: <20201114173358.2058600-3-mkl@pengutronix.de> (raw)
In-Reply-To: <20201114173358.2058600-1-mkl@pengutronix.de>
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this
uninitialized cfd->len is accessed nonetheless by pr_warn_once().
Fix this uninitialized variable access by checking cfd->len's validity
condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's
condition is checked, and appropriately modify the log messages that
are generated as well.
In case either of the required conditions fail, the skb is freed and
NET_RX_DROP is returned, same as before.
Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once")
Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
net/can/af_can.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/net/can/af_can.c b/net/can/af_can.c
index e8d4e3ef5322..5d124c155904 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -703,16 +703,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
{
struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU ||
- cfd->len > CANFD_MAX_DLEN)) {
- pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n",
+ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) {
+ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n",
+ dev->type, skb->len);
+ goto free_skb;
+ }
+
+ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
+ if (unlikely(cfd->len > CANFD_MAX_DLEN)) {
+ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n",
dev->type, skb->len, cfd->len);
- kfree_skb(skb);
- return NET_RX_DROP;
+ goto free_skb;
}
can_receive(skb, dev);
return NET_RX_SUCCESS;
+
+free_skb:
+ kfree_skb(skb);
+ return NET_RX_DROP;
}
/* af_can protocol functions */
--
2.29.2
next prev parent reply other threads:[~2020-11-14 17:34 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-14 17:33 pull-request: can 2020-11-14 Marc Kleine-Budde
2020-11-14 17:33 ` [net 01/15] can: af_can: prevent potential access of uninitialized member in can_rcv() Marc Kleine-Budde
2020-11-14 17:33 ` Marc Kleine-Budde [this message]
2020-11-14 17:33 ` [net 03/15] can: dev: can_restart(): post buffer from the right context Marc Kleine-Budde
2020-11-14 17:33 ` [net 04/15] can: ti_hecc: Fix memleak in ti_hecc_probe Marc Kleine-Budde
2020-11-14 17:33 ` [net 05/15] can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Marc Kleine-Budde
2020-11-14 17:33 ` [net 06/15] can: peak_usb: fix potential integer overflow on shift of a int Marc Kleine-Budde
2020-11-14 17:33 ` [net 07/15] can: flexcan: flexcan_setup_stop_mode(): add missing "req_bit" to stop mode property comment Marc Kleine-Budde
2020-11-14 17:33 ` [net 08/15] can: flexcan: fix failure handling of pm_runtime_get_sync() Marc Kleine-Budde
2020-11-14 17:33 ` [net 09/15] can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI Marc Kleine-Budde
2020-11-14 17:33 ` [net 10/15] can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for devm_regmap_init() Marc Kleine-Budde
2020-11-14 17:33 ` [net 11/15] can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration Marc Kleine-Budde
2020-11-14 17:33 ` [net 12/15] can: m_can: m_can_handle_state_change(): fix state change Marc Kleine-Budde
2020-11-14 17:33 ` [net 13/15] can: m_can: m_can_class_free_dev(): introduce new function Marc Kleine-Budde
2020-11-14 17:33 ` [net 14/15] can: m_can: Fix freeing of can device from peripherials Marc Kleine-Budde
2020-11-14 17:33 ` [net 15/15] can: m_can: m_can_stop(): set device to software init mode before closing Marc Kleine-Budde
2020-11-15 1:35 ` pull-request: can 2020-11-14 Jakub Kicinski
2020-11-15 1:39 ` Jakub Kicinski
2020-11-15 16:58 ` Marc Kleine-Budde
2020-11-15 18:00 ` Marc Kleine-Budde
2020-11-16 15:33 ` Jakub Kicinski
2020-11-15 17:41 pull-request: can 2020-11-15 Marc Kleine-Budde
2020-11-15 17:41 ` [net 02/15] can: af_can: prevent potential access of uninitialized member in canfd_rcv() Marc Kleine-Budde
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201114173358.2058600-3-mkl@pengutronix.de \
--to=mkl@pengutronix.de \
--cc=anant.thazhemadam@gmail.com \
--cc=davem@davemloft.net \
--cc=kernel@pengutronix.de \
--cc=kuba@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).