* [Linux-kernel-mentees] [PATCH net] ethtool: strset: Fix out of bound read in strset_parse_request()
@ 2020-10-10 21:09 Anmol Karn
2020-10-11 16:54 ` Jakub Kicinski
0 siblings, 1 reply; 3+ messages in thread
From: Anmol Karn @ 2020-10-10 21:09 UTC (permalink / raw)
To: davem, kuba
Cc: mkubecek, andrew, f.fainelli, syzbot+9d1389df89299fa368dc,
netdev, syzkaller-bugs, linux-kernel, linux-kernel-mentees,
dan.carpenter
Flag ``ETHTOOL_A_STRSET_COUNTS_ONLY`` tells the kernel to only return the string
counts of the sets, but, when req_info->counts_only tries to read the
tb[ETHTOOL_A_STRSET_COUNTS_ONLY] it gets out of bound.
- net/ethtool/strset.c
The bug seems to trigger in this line:
req_info->counts_only = tb[ETHTOOL_A_STRSET_COUNTS_ONLY];
Fix it by NULL checking for req_info->counts_only while
reading from tb[ETHTOOL_A_STRSET_COUNTS_ONLY].
Reported-by: syzbot+9d1389df89299fa368dc@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=730deff8fe9954a5e317924d9acff98d9c64a770
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
---
When I tried to reduce the index of tb[] by 1, the crash reproducer was not working anymore,
hence it's probably reading from tb[ETHTOOL_A_STRSET_STRINGSETS], but this won't give the
strset 'count' and hence is not a plausible fix. But checking for the req_info->counts_only
seems legit.
If I have missed something please let me know, and I will work towards fixing it in next version.
net/ethtool/strset.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ethtool/strset.c b/net/ethtool/strset.c
index 82707b662fe4..20a7b36698f3 100644
--- a/net/ethtool/strset.c
+++ b/net/ethtool/strset.c
@@ -174,7 +174,8 @@ static int strset_parse_request(struct ethnl_req_info *req_base,
if (ret < 0)
return ret;
- req_info->counts_only = tb[ETHTOOL_A_STRSET_COUNTS_ONLY];
+ if (req_info->counts_only)
+ req_info->counts_only = tb[ETHTOOL_A_STRSET_COUNTS_ONLY];
nla_for_each_nested(attr, nest, rem) {
u32 id;
--
2.28.0
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Linux-kernel-mentees] [PATCH net] ethtool: strset: Fix out of bound read in strset_parse_request()
2020-10-10 21:09 [Linux-kernel-mentees] [PATCH net] ethtool: strset: Fix out of bound read in strset_parse_request() Anmol Karn
@ 2020-10-11 16:54 ` Jakub Kicinski
2020-10-11 19:07 ` Anmol karn
0 siblings, 1 reply; 3+ messages in thread
From: Jakub Kicinski @ 2020-10-11 16:54 UTC (permalink / raw)
To: Anmol Karn
Cc: mkubecek, andrew, f.fainelli, syzbot+9d1389df89299fa368dc,
netdev, syzkaller-bugs, linux-kernel, linux-kernel-mentees,
davem, dan.carpenter
On Sun, 11 Oct 2020 02:39:29 +0530 Anmol Karn wrote:
> Flag ``ETHTOOL_A_STRSET_COUNTS_ONLY`` tells the kernel to only return the string
> counts of the sets, but, when req_info->counts_only tries to read the
> tb[ETHTOOL_A_STRSET_COUNTS_ONLY] it gets out of bound.
>
> - net/ethtool/strset.c
> The bug seems to trigger in this line:
>
> req_info->counts_only = tb[ETHTOOL_A_STRSET_COUNTS_ONLY];
>
> Fix it by NULL checking for req_info->counts_only while
> reading from tb[ETHTOOL_A_STRSET_COUNTS_ONLY].
>
> Reported-by: syzbot+9d1389df89299fa368dc@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?id=730deff8fe9954a5e317924d9acff98d9c64a770
> Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
I think the correct fix for this was already applied to net-next as:
commit db972e532518 ("ethtool: strset: allow ETHTOOL_A_STRSET_COUNTS_ONLY attr")
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Linux-kernel-mentees] [PATCH net] ethtool: strset: Fix out of bound read in strset_parse_request()
2020-10-11 16:54 ` Jakub Kicinski
@ 2020-10-11 19:07 ` Anmol karn
0 siblings, 0 replies; 3+ messages in thread
From: Anmol karn @ 2020-10-11 19:07 UTC (permalink / raw)
To: Jakub Kicinski
Cc: mkubecek, andrew, f.fainelli, syzbot+9d1389df89299fa368dc,
netdev, syzkaller-bugs, open list, linux-kernel-mentees,
David S. Miller, Dan Carpenter
Hello sir,
On Sun, Oct 11, 2020 at 10:24 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Sun, 11 Oct 2020 02:39:29 +0530 Anmol Karn wrote:
> > Flag ``ETHTOOL_A_STRSET_COUNTS_ONLY`` tells the kernel to only return the string
> > counts of the sets, but, when req_info->counts_only tries to read the
> > tb[ETHTOOL_A_STRSET_COUNTS_ONLY] it gets out of bound.
> >
> > - net/ethtool/strset.c
> > The bug seems to trigger in this line:
> >
> > req_info->counts_only = tb[ETHTOOL_A_STRSET_COUNTS_ONLY];
> >
> > Fix it by NULL checking for req_info->counts_only while
> > reading from tb[ETHTOOL_A_STRSET_COUNTS_ONLY].
> >
> > Reported-by: syzbot+9d1389df89299fa368dc@syzkaller.appspotmail.com
> > Link: https://syzkaller.appspot.com/bug?id=730deff8fe9954a5e317924d9acff98d9c64a770
> > Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
>
> I think the correct fix for this was already applied to net-next as:
>
> commit db972e532518 ("ethtool: strset: allow ETHTOOL_A_STRSET_COUNTS_ONLY attr")
I am glad that it's fixed now.
Thanks,
Anmol
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-10-11 19:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-10 21:09 [Linux-kernel-mentees] [PATCH net] ethtool: strset: Fix out of bound read in strset_parse_request() Anmol Karn
2020-10-11 16:54 ` Jakub Kicinski
2020-10-11 19:07 ` Anmol karn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).