Hi,
On Mon, 5 Apr 2021 at 15:58, Pavel Skripkin <paskripkin@xxxxxxxxx> wrote:
>
> syzbot reported shift-out-of-bounds in nl802154_new_interface.
> The problem was in signed representation of enum nl802154_iftype
>
> enum nl802154_iftype {
> /* for backwards compatibility TODO */
> NL802154_IFTYPE_UNSPEC = -1,
> ...
>
> Since, enum has negative value in it, objects of this type
> will be represented as signed integer.
>
> type = nla_get_u32(info->attrs[NL802154_ATTR_IFTYPE]);
>
> u32 will be casted to signed, which can cause negative value type.
>
> Reported-by: syzbot+7bf7b22759195c9a21e9@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Pavel Skripkin <paskripkin@xxxxxxxxx>
Yes, this patch will fix the issue but we discussed that the problem
is deeper than such a fix. The real problem is that we are using a -1
value which doesn't fit into the u32 netlink value and it gets
converted back and forward which we should avoid.
- Alex
