From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, stable@kernel.org,
Jann Horn <jannh@google.com>
Subject: [PATCH 5.4 54/71] net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
Date: Mon, 14 Feb 2022 10:26:22 +0100 [thread overview]
Message-ID: <20220214092453.860444773@linuxfoundation.org> (raw)
In-Reply-To: <20220214092452.020713240@linuxfoundation.org>
From: Jann Horn <jannh@google.com>
commit 57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581 upstream.
ax88179_rx_fixup() contains several out-of-bounds accesses that can be
triggered by a malicious (or defective) USB device, in particular:
- The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds,
causing OOB reads and (on big-endian systems) OOB endianness flips.
- A packet can overlap the metadata array, causing a later OOB
endianness flip to corrupt data used by a cloned SKB that has already
been handed off into the network stack.
- A packet SKB can be constructed whose tail is far beyond its end,
causing out-of-bounds heap data to be considered part of the SKB's
data.
I have tested that this can be used by a malicious USB device to send a
bogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response
that contains random kernel heap data.
It's probably also possible to get OOB writes from this on a
little-endian system somehow - maybe by triggering skb_cow() via IP
options processing -, but I haven't tested that.
Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ax88179_178a.c | 68 +++++++++++++++++++++++------------------
1 file changed, 39 insertions(+), 29 deletions(-)
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1361,58 +1361,68 @@ static int ax88179_rx_fixup(struct usbne
u16 hdr_off;
u32 *pkt_hdr;
- /* This check is no longer done by usbnet */
- if (skb->len < dev->net->hard_header_len)
+ /* At the end of the SKB, there's a header telling us how many packets
+ * are bundled into this buffer and where we can find an array of
+ * per-packet metadata (which contains elements encoded into u16).
+ */
+ if (skb->len < 4)
return 0;
-
skb_trim(skb, skb->len - 4);
rx_hdr = get_unaligned_le32(skb_tail_pointer(skb));
-
pkt_cnt = (u16)rx_hdr;
hdr_off = (u16)(rx_hdr >> 16);
+
+ if (pkt_cnt == 0)
+ return 0;
+
+ /* Make sure that the bounds of the metadata array are inside the SKB
+ * (and in front of the counter at the end).
+ */
+ if (pkt_cnt * 2 + hdr_off > skb->len)
+ return 0;
pkt_hdr = (u32 *)(skb->data + hdr_off);
- while (pkt_cnt--) {
+ /* Packets must not overlap the metadata array */
+ skb_trim(skb, hdr_off);
+
+ for (; ; pkt_cnt--, pkt_hdr++) {
u16 pkt_len;
le32_to_cpus(pkt_hdr);
pkt_len = (*pkt_hdr >> 16) & 0x1fff;
- /* Check CRC or runt packet */
- if ((*pkt_hdr & AX_RXHDR_CRC_ERR) ||
- (*pkt_hdr & AX_RXHDR_DROP_ERR)) {
- skb_pull(skb, (pkt_len + 7) & 0xFFF8);
- pkt_hdr++;
- continue;
- }
-
- if (pkt_cnt == 0) {
- skb->len = pkt_len;
- /* Skip IP alignment pseudo header */
- skb_pull(skb, 2);
- skb_set_tail_pointer(skb, skb->len);
- skb->truesize = pkt_len + sizeof(struct sk_buff);
- ax88179_rx_checksum(skb, pkt_hdr);
- return 1;
- }
+ if (pkt_len > skb->len)
+ return 0;
- ax_skb = skb_clone(skb, GFP_ATOMIC);
- if (ax_skb) {
+ /* Check CRC or runt packet */
+ if (((*pkt_hdr & (AX_RXHDR_CRC_ERR | AX_RXHDR_DROP_ERR)) == 0) &&
+ pkt_len >= 2 + ETH_HLEN) {
+ bool last = (pkt_cnt == 0);
+
+ if (last) {
+ ax_skb = skb;
+ } else {
+ ax_skb = skb_clone(skb, GFP_ATOMIC);
+ if (!ax_skb)
+ return 0;
+ }
ax_skb->len = pkt_len;
/* Skip IP alignment pseudo header */
skb_pull(ax_skb, 2);
skb_set_tail_pointer(ax_skb, ax_skb->len);
ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
ax88179_rx_checksum(ax_skb, pkt_hdr);
+
+ if (last)
+ return 1;
+
usbnet_skb_return(dev, ax_skb);
- } else {
- return 0;
}
- skb_pull(skb, (pkt_len + 7) & 0xFFF8);
- pkt_hdr++;
+ /* Trim this packet away from the SKB */
+ if (!skb_pull(skb, (pkt_len + 7) & 0xFFF8))
+ return 0;
}
- return 1;
}
static struct sk_buff *
next prev parent reply other threads:[~2022-02-14 9:44 UTC|newest]
Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-14 9:25 [PATCH 5.4 00/71] 5.4.180-rc1 review Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 01/71] integrity: check the return value of audit_log_start() Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 02/71] ima: Remove ima_policy file before directory Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 03/71] ima: Allow template selection with ima_template[_fmt]= after ima_hash= Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 04/71] ima: Do not print policy rule with inactive LSM labels Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 05/71] mmc: sdhci-of-esdhc: Check for error num after setting mask Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 06/71] net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible PHYs Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 07/71] net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 08/71] NFS: Fix initialisation of nfs_client cl_flags field Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 09/71] NFSD: Clamp WRITE offsets Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 10/71] NFSD: Fix offset type in I/O trace points Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 11/71] nvme: Fix parsing of ANA log page Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 12/71] NFSv4 only print the label when its queried Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 13/71] nfs: nfs4clinet: check the return value of kstrdup() Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 14/71] NFSv4.1: Fix uninitialised variable in devicenotify Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 15/71] NFSv4 remove zero number of fs_locations entries error check Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 16/71] NFSv4 expose nfs_parse_server_name function Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 17/71] drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 18/71] net: sched: Clarify error message when qdisc kind is unknown Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 19/71] scsi: target: iscsi: Make sure the np under each tpg is unique Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 20/71] scsi: qedf: Fix refcount issue when LOGO is received during TMF Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 21/71] scsi: myrs: Fix crash in error case Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 22/71] PM: hibernate: Remove register_nosave_region_late() Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 23/71] usb: dwc2: gadget: dont try to disable ep0 in dwc2_hsotg_suspend Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 24/71] net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout() Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 25/71] KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 26/71] bpf: Add kconfig knob for disabling unpriv bpf by default Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 27/71] riscv: fix build with binutils 2.38 Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 28/71] ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 29/71] ARM: socfpga: fix missing RESET_CONTROLLER Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 30/71] nvme-tcp: fix bogus request completion when failing to send AER Greg Kroah-Hartman
2022-02-14 9:25 ` [PATCH 5.4 31/71] ACPI/IORT: Check node revision for PMCG resources Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 32/71] PM: s2idle: ACPI: Fix wakeup interrupts handling Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 33/71] net: bridge: fix stale eth hdr pointer in br_dev_xmit Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 34/71] perf probe: Fix ppc64 perf probe add events failed case Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 35/71] ARM: dts: meson: Fix the UART compatible strings Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 36/71] staging: fbtft: Fix error path in fbtft_driver_module_init() Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 37/71] ARM: dts: imx6qdl-udoo: Properly describe the SD card detect Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 38/71] usb: f_fs: Fix use-after-free for epfile Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 39/71] misc: fastrpc: avoid double fput() on failed usercopy Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 40/71] ixgbevf: Require large buffers for build_skb on 82599VF Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 41/71] bonding: pair enable_port with slave_arr_updates Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 42/71] ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 43/71] nfp: flower: fix ida_idx not being released Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 44/71] net: do not keep the dst cache when uncloning an skb dst and its metadata Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 45/71] net: fix a memleak " Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 46/71] veth: fix races around rq->rx_notify_masked Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 47/71] net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 48/71] tipc: rate limit warning for received illegal binding update Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 49/71] net: amd-xgbe: disable interrupts during pci removal Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 50/71] vt_ioctl: fix array_index_nospec in vt_setactivate Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 51/71] vt_ioctl: add array_index_nospec to VT_ACTIVATE Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 52/71] n_tty: wake up poll(POLLRDNORM) on receiving data Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 53/71] eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX Greg Kroah-Hartman
2022-02-14 9:26 ` Greg Kroah-Hartman [this message]
2022-02-14 9:26 ` [PATCH 5.4 55/71] usb: ulpi: Move of_node_put to ulpi_dev_release Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 56/71] usb: ulpi: Call of_node_put correctly Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 57/71] usb: dwc3: gadget: Prevent core from processing stale TRBs Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 58/71] usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 59/71] USB: gadget: validate interface OS descriptor requests Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 60/71] usb: gadget: rndis: check size of RNDIS_MSG_SET command Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 61/71] usb: gadget: f_uac2: Define specific wTerminalType Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 62/71] USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 63/71] USB: serial: option: add ZTE MF286D modem Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 64/71] USB: serial: ch341: add support for GW Instek USB2.0-Serial devices Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 65/71] USB: serial: cp210x: add NCR Retail IO box id Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 66/71] USB: serial: cp210x: add CPI Bulk Coin Recycler id Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 67/71] seccomp: Invalidate seccomp mode to catch death failures Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 68/71] hwmon: (dell-smm) Speed up setting of fan speed Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 69/71] scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 70/71] perf: Fix list corruption in perf_cgroup_switch() Greg Kroah-Hartman
2022-02-14 9:26 ` [PATCH 5.4 71/71] ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE Greg Kroah-Hartman
2022-02-14 20:12 ` [PATCH 5.4 00/71] 5.4.180-rc1 review Florian Fainelli
2022-02-14 21:29 ` Slade Watkins
2022-02-14 22:26 ` Shuah Khan
2022-02-15 1:51 ` Guenter Roeck
2022-02-15 9:15 ` Naresh Kamboju
2022-02-15 15:40 ` Sudip Mukherjee
2022-02-16 0:51 ` Samuel Zou
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220214092453.860444773@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).