From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
To: Johannes Berg <johannes@sipsolutions.net>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>
Cc: Anant Thazhemadam <anant.thazhemadam@gmail.com>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org,
syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com
Subject: [PATCH] net: mac80211: cfg: enforce sanity checks for key_index in ieee80211_del_key()
Date: Tue, 1 Dec 2020 15:26:39 +0530 [thread overview]
Message-ID: <20201201095639.63936-1-anant.thazhemadam@gmail.com> (raw)
Currently, it is assumed that key_idx values that are passed to
ieee80211_del_key() are all valid indexes as is, and no sanity checks
are performed for it.
However, syzbot was able to trigger an array-index-out-of-bounds bug
by passing a key_idx value of 5, when the maximum permissible index
value is (NUM_DEFAULT_KEYS - 1).
Enforcing sanity checks helps in preventing this bug, or a similar
instance in the context of ieee80211_del_key() from occurring.
Reported-by: syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com
Tested-by: syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
---
net/mac80211/cfg.c | 24 +++++++++++++++++++++---
1 file changed, 21 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7276e66ae435..d349e33134e6 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -516,12 +516,30 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
if (!sta)
goto out_unlock;
- if (pairwise)
+ if (pairwise) {
+ if (key_idx >= NUM_DEFAULT_KEYS) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
key = key_mtx_dereference(local, sta->ptk[key_idx]);
- else
+ } else {
+ if (key_idx >= (NUM_DEFAULT_KEYS +
+ NUM_DEFAULT_MGMT_KEYS +
+ NUM_DEFAULT_BEACON_KEYS)) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
key = key_mtx_dereference(local, sta->gtk[key_idx]);
- } else
+ }
+ } else {
+ if (key_idx >= (NUM_DEFAULT_KEYS +
+ NUM_DEFAULT_MGMT_KEYS +
+ NUM_DEFAULT_BEACON_KEYS)) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
key = key_mtx_dereference(local, sdata->keys[key_idx]);
+ }
if (!key) {
ret = -ENOENT;
--
2.25.1
next reply other threads:[~2020-12-01 9:58 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-01 9:56 Anant Thazhemadam [this message]
2020-12-01 10:00 ` [PATCH] net: mac80211: cfg: enforce sanity checks for key_index in ieee80211_del_key() Johannes Berg
2020-12-01 11:56 ` Anant Thazhemadam
2020-12-01 12:06 ` Johannes Berg
2020-12-01 12:45 ` Anant Thazhemadam
2020-12-01 12:56 ` Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201201095639.63936-1-anant.thazhemadam@gmail.com \
--to=anant.thazhemadam@gmail.com \
--cc=davem@davemloft.net \
--cc=johannes@sipsolutions.net \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).