Patch "wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-brcmfmac-ensure-clm-version-is-null-terminated-.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7fbdd5d0f491635102dccdad7f57b00fa621d9df
Author: Jisoo Jang <jisoo.jang@xxxxxxxxxxxx>
Date:   Fri Dec 30 16:51:39 2022 +0900

    wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
    
    [ Upstream commit 660145d708be52f946a82e5b633c020f58f996de ]
    
    Fix a stack-out-of-bounds read in brcmfmac that occurs
    when 'buf' that is not null-terminated is passed as an argument of
    strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with
    a CLM version string by memcpy() in brcmf_fil_iovar_data_get().
    Ensure buf is null-terminated.
    
    Found by a modified version of syzkaller.
    
    [   33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
    [   33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22
    [   33.021554][ T1896] ==================================================================
    [   33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110
    [   33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896
    [   33.023852][ T1896]
    [   33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132
    [   33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
    [   33.026065][ T1896] Workqueue: usb_hub_wq hub_event
    [   33.026581][ T1896] Call Trace:
    [   33.026896][ T1896]  dump_stack_lvl+0x57/0x7d
    [   33.027372][ T1896]  print_address_description.constprop.0.cold+0xf/0x334
    [   33.028037][ T1896]  ? strreplace+0xf2/0x110
    [   33.028403][ T1896]  ? strreplace+0xf2/0x110
    [   33.028807][ T1896]  kasan_report.cold+0x83/0xdf
    [   33.029283][ T1896]  ? strreplace+0xf2/0x110
    [   33.029666][ T1896]  strreplace+0xf2/0x110
    [   33.029966][ T1896]  brcmf_c_preinit_dcmds+0xab1/0xc40
    [   33.030351][ T1896]  ? brcmf_c_set_joinpref_default+0x100/0x100
    [   33.030787][ T1896]  ? rcu_read_lock_sched_held+0xa1/0xd0
    [   33.031223][ T1896]  ? rcu_read_lock_bh_held+0xb0/0xb0
    [   33.031661][ T1896]  ? lock_acquire+0x19d/0x4e0
    [   33.032091][ T1896]  ? find_held_lock+0x2d/0x110
    [   33.032605][ T1896]  ? brcmf_usb_deq+0x1a7/0x260
    [   33.033087][ T1896]  ? brcmf_usb_rx_fill_all+0x5a/0xf0
    [   33.033582][ T1896]  brcmf_attach+0x246/0xd40
    [   33.034022][ T1896]  ? wiphy_new_nm+0x1476/0x1d50
    [   33.034383][ T1896]  ? kmemdup+0x30/0x40
    [   33.034722][ T1896]  brcmf_usb_probe+0x12de/0x1690
    [   33.035223][ T1896]  ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
    [   33.035833][ T1896]  usb_probe_interface+0x25f/0x710
    [   33.036315][ T1896]  really_probe+0x1be/0xa90
    [   33.036656][ T1896]  __driver_probe_device+0x2ab/0x460
    [   33.037026][ T1896]  ? usb_match_id.part.0+0x88/0xc0
    [   33.037383][ T1896]  driver_probe_device+0x49/0x120
    [   33.037790][ T1896]  __device_attach_driver+0x18a/0x250
    [   33.038300][ T1896]  ? driver_allows_async_probing+0x120/0x120
    [   33.038986][ T1896]  bus_for_each_drv+0x123/0x1a0
    [   33.039906][ T1896]  ? bus_rescan_devices+0x20/0x20
    [   33.041412][ T1896]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0
    [   33.041861][ T1896]  ? trace_hardirqs_on+0x1c/0x120
    [   33.042330][ T1896]  __device_attach+0x207/0x330
    [   33.042664][ T1896]  ? device_bind_driver+0xb0/0xb0
    [   33.043026][ T1896]  ? kobject_uevent_env+0x230/0x12c0
    [   33.043515][ T1896]  bus_probe_device+0x1a2/0x260
    [   33.043914][ T1896]  device_add+0xa61/0x1ce0
    [   33.044227][ T1896]  ? __mutex_unlock_slowpath+0xe7/0x660
    [   33.044891][ T1896]  ? __fw_devlink_link_to_suppliers+0x550/0x550
    [   33.045531][ T1896]  usb_set_configuration+0x984/0x1770
    [   33.046051][ T1896]  ? kernfs_create_link+0x175/0x230
    [   33.046548][ T1896]  usb_generic_driver_probe+0x69/0x90
    [   33.046931][ T1896]  usb_probe_device+0x9c/0x220
    [   33.047434][ T1896]  really_probe+0x1be/0xa90
    [   33.047760][ T1896]  __driver_probe_device+0x2ab/0x460
    [   33.048134][ T1896]  driver_probe_device+0x49/0x120
    [   33.048516][ T1896]  __device_attach_driver+0x18a/0x250
    [   33.048910][ T1896]  ? driver_allows_async_probing+0x120/0x120
    [   33.049437][ T1896]  bus_for_each_drv+0x123/0x1a0
    [   33.049814][ T1896]  ? bus_rescan_devices+0x20/0x20
    [   33.050164][ T1896]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0
    [   33.050579][ T1896]  ? trace_hardirqs_on+0x1c/0x120
    [   33.050936][ T1896]  __device_attach+0x207/0x330
    [   33.051399][ T1896]  ? device_bind_driver+0xb0/0xb0
    [   33.051888][ T1896]  ? kobject_uevent_env+0x230/0x12c0
    [   33.052314][ T1896]  bus_probe_device+0x1a2/0x260
    [   33.052688][ T1896]  device_add+0xa61/0x1ce0
    [   33.053121][ T1896]  ? __fw_devlink_link_to_suppliers+0x550/0x550
    [   33.053568][ T1896]  usb_new_device.cold+0x463/0xf66
    [   33.053953][ T1896]  ? hub_disconnect+0x400/0x400
    [   33.054313][ T1896]  ? rwlock_bug.part.0+0x90/0x90
    [   33.054661][ T1896]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0
    [   33.055094][ T1896]  hub_event+0x10d5/0x3330
    [   33.055530][ T1896]  ? hub_port_debounce+0x280/0x280
    [   33.055934][ T1896]  ? __lock_acquire+0x1671/0x5790
    [   33.056387][ T1896]  ? wq_calc_node_cpumask+0x170/0x2a0
    [   33.056924][ T1896]  ? lock_release+0x640/0x640
    [   33.057383][ T1896]  ? rcu_read_lock_sched_held+0xa1/0xd0
    [   33.057916][ T1896]  ? rcu_read_lock_bh_held+0xb0/0xb0
    [   33.058402][ T1896]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0
    [   33.059019][ T1896]  process_one_work+0x873/0x13e0
    [   33.059488][ T1896]  ? lock_release+0x640/0x640
    [   33.059932][ T1896]  ? pwq_dec_nr_in_flight+0x320/0x320
    [   33.060446][ T1896]  ? rwlock_bug.part.0+0x90/0x90
    [   33.060898][ T1896]  worker_thread+0x8b/0xd10
    [   33.061348][ T1896]  ? __kthread_parkme+0xd9/0x1d0
    [   33.061810][ T1896]  ? process_one_work+0x13e0/0x13e0
    [   33.062288][ T1896]  kthread+0x379/0x450
    [   33.062660][ T1896]  ? _raw_spin_unlock_irq+0x24/0x30
    [   33.063148][ T1896]  ? set_kthread_struct+0x100/0x100
    [   33.063606][ T1896]  ret_from_fork+0x1f/0x30
    [   33.064070][ T1896]
    [   33.064313][ T1896]
    [   33.064545][ T1896] addr ffffc90001d6efc8 is located in stack of task kworker/0:2/1896 at offset 512 in frame:
    [   33.065478][ T1896]  brcmf_c_preinit_dcmds+0x0/0xc40
    [   33.065973][ T1896]
    [   33.066191][ T1896] this frame has 4 objects:
    [   33.066614][ T1896]  [48, 56) 'ptr'
    [   33.066618][ T1896]  [80, 148) 'revinfo'
    [   33.066957][ T1896]  [192, 210) 'eventmask'
    [   33.067338][ T1896]  [256, 512) 'buf'
    [   33.067742][ T1896]
    [   33.068304][ T1896] Memory state around the buggy address:
    [   33.068838][ T1896]  ffffc90001d6ee80: f2 00 00 02 f2 f2 f2 f2 f2 00 00 00 00 00 00 00
    [   33.069545][ T1896]  ffffc90001d6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [   33.070626][ T1896] >ffffc90001d6ef80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3
    [   33.072052][ T1896]                                               ^
    [   33.073043][ T1896]  ffffc90001d6f000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [   33.074230][ T1896]  ffffc90001d6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [   33.074914][ T1896] ==================================================================
    [   33.075713][ T1896] Disabling lock debugging due to kernel taint
    
    Reviewed-by: Arend van Spriel<arend.vanspriel@xxxxxxxxxxxx>
    Signed-off-by: Jisoo Jang <jisoo.jang@xxxxxxxxxxxx>
    Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20221230075139.56591-1-jisoo.jang@xxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
index b4e8957840020..3626ea9be92af 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
@@ -290,15 +290,17 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
 	if (err) {
 		brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err);
 	} else {
+		buf[sizeof(buf) - 1] = '\0';
 		clmver = (char *)buf;
-		/* store CLM version for adding it to revinfo debugfs file */
-		memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
 
 		/* Replace all newline/linefeed characters with space
 		 * character
 		 */
 		strreplace(clmver, '\n', ' ');
 
+		/* store CLM version for adding it to revinfo debugfs file */
+		memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
+
 		brcmf_dbg(INFO, "CLM version = %s\n", clmver);
 	}
 



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux