| Message ID | 20200630114615.GA21891@mwanda |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] net: qrtr: Fix an out of bounds read qrtr_endpoint_post() | expand |
From: Dan Carpenter <dan.carpenter@oracle.com> Date: Tue, 30 Jun 2020 14:46:15 +0300 > This code assumes that the user passed in enough data for a > qrtr_hdr_v1 or qrtr_hdr_v2 struct, but it's not necessarily true. If > the buffer is too small then it will read beyond the end. > > Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> > Reported-by: syzbot+b8fe393f999a291a9ea6@syzkaller.appspotmail.com > Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Applied and queued up for -stable, thanks Dan.
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c index 2d8d6131bc5f..7eccbbf6f8ad 100644 --- a/net/qrtr/qrtr.c +++ b/net/qrtr/qrtr.c @@ -427,7 +427,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) unsigned int ver; size_t hdrlen; - if (len & 3) + if (len == 0 || len & 3) return -EINVAL; skb = netdev_alloc_skb(NULL, len); @@ -441,6 +441,8 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) switch (ver) { case QRTR_PROTO_VER_1: + if (len < sizeof(*v1)) + goto err; v1 = data; hdrlen = sizeof(*v1); @@ -454,6 +456,8 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) size = le32_to_cpu(v1->size); break; case QRTR_PROTO_VER_2: + if (len < sizeof(*v2)) + goto err; v2 = data; hdrlen = sizeof(*v2) + v2->optlen;
This code assumes that the user passed in enough data for a qrtr_hdr_v1 or qrtr_hdr_v2 struct, but it's not necessarily true. If the buffer is too small then it will read beyond the end. Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reported-by: syzbot+b8fe393f999a291a9ea6@syzkaller.appspotmail.com Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- net/qrtr/qrtr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)