AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

net: qrtr: Fix an out of bounds read qrtr_endpoint_post()

Browse Source 
This code assumes that the user passed in enough data for a
qrtr_hdr_v1 or qrtr_hdr_v2 struct, but it's not necessarily true.  If
the buffer is too small then it will read beyond the end.

Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reported-by: syzbot+b8fe393f999a291a9ea6@syzkaller.appspotmail.com
Fixes: 194ccc8829 ("net: qrtr: Support decoding incoming v2 packets")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dan Carpenter 2020-06-30 14:46:15 +03:00 committed by David S. Miller
parent 6a2febec33
commit 8ff41cc217
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/qrtr/qrtr.c
View File

@ -429,7 +429,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
unsigned int ver; unsigned int ver;
size_t hdrlen; size_t hdrlen;
if (len & 3) if (len == 0 || len & 3)
return -EINVAL; return -EINVAL;
skb = netdev_alloc_skb(NULL, len); skb = netdev_alloc_skb(NULL, len);
@ -443,6 +443,8 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
switch (ver) { switch (ver) {
case QRTR_PROTO_VER_1: case QRTR_PROTO_VER_1:
if (len < sizeof(*v1))
goto err;
v1 = data; v1 = data;
hdrlen = sizeof(*v1); hdrlen = sizeof(*v1);
@ -456,6 +458,8 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
size = le32_to_cpu(v1->size); size = le32_to_cpu(v1->size);
break; break;
case QRTR_PROTO_VER_2: case QRTR_PROTO_VER_2:
if (len < sizeof(*v2))
goto err;
v2 = data; v2 = data;
hdrlen = sizeof(*v2) + v2->optlen; hdrlen = sizeof(*v2) + v2->optlen;