Patch "can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write" has been added to the 6.2-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a2a64003342c62227a87dd76453152d7d42022cd
Author: Ivan Orlov <ivan.orlov0322@xxxxxxxxx>
Date:   Tue Mar 14 16:04:45 2023 +0400

    can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
    
    [ Upstream commit 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f ]
    
    Syzkaller reported the following issue:
    
    =====================================================
    BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline]
    BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600
     aio_rw_done fs/aio.c:1520 [inline]
     aio_write+0x899/0x950 fs/aio.c:1600
     io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
     __do_sys_io_submit fs/aio.c:2078 [inline]
     __se_sys_io_submit+0x293/0x770 fs/aio.c:2048
     __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    Uninit was created at:
     slab_post_alloc_hook mm/slab.h:766 [inline]
     slab_alloc_node mm/slub.c:3452 [inline]
     __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491
     __do_kmalloc_node mm/slab_common.c:967 [inline]
     __kmalloc+0x11d/0x3b0 mm/slab_common.c:981
     kmalloc_array include/linux/slab.h:636 [inline]
     bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930
     bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351
     sock_sendmsg_nosec net/socket.c:714 [inline]
     sock_sendmsg net/socket.c:734 [inline]
     sock_write_iter+0x495/0x5e0 net/socket.c:1108
     call_write_iter include/linux/fs.h:2189 [inline]
     aio_write+0x63a/0x950 fs/aio.c:1600
     io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
     __do_sys_io_submit fs/aio.c:2078 [inline]
     __se_sys_io_submit+0x293/0x770 fs/aio.c:2048
     __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
    =====================================================
    
    We can follow the call chain and find that 'bcm_tx_setup' function
    calls 'memcpy_from_msg' to copy some content to the newly allocated
    frame of 'op->frames'. After that the 'len' field of copied structure
    being compared with some constant value (64 or 8). However, if
    'memcpy_from_msg' returns an error, we will compare some uninitialized
    memory. This triggers 'uninit-value' issue.
    
    This patch will add 'memcpy_from_msg' possible errors processing to
    avoid uninit-value issue.
    
    Tested via syzkaller
    
    Reported-by: syzbot+c9bfd85eca611ebf5db1@xxxxxxxxxxxxxxxxxxxxxxxxx
    Link: https://syzkaller.appspot.com/bug?id=47f897f8ad958bbde5790ebf389b5e7e0a345089
    Signed-off-by: Ivan Orlov <ivan.orlov0322@xxxxxxxxx>
    Fixes: 6f3b911d5f29b ("can: bcm: add support for CAN FD frames")
    Acked-by: Oliver Hartkopp <socketcan@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/all/20230314120445.12407-1-ivan.orlov0322@xxxxxxxxx
    Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/can/bcm.c b/net/can/bcm.c
index 27706f6ace34a..a962ec2b8ba5b 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -941,6 +941,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 
 			cf = op->frames + op->cfsiz * i;
 			err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
+			if (err < 0)
+				goto free_op;
 
 			if (op->flags & CAN_FD_FRAME) {
 				if (cf->len > 64)
@@ -950,12 +952,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 					err = -EINVAL;
 			}
 
-			if (err < 0) {
-				if (op->frames != &op->sframe)
-					kfree(op->frames);
-				kfree(op);
-				return err;
-			}
+			if (err < 0)
+				goto free_op;
 
 			if (msg_head->flags & TX_CP_CAN_ID) {
 				/* copy can_id into frame */
@@ -1026,6 +1024,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 		bcm_tx_start_timer(op);
 
 	return msg_head->nframes * op->cfsiz + MHSIZ;
+
+free_op:
+	if (op->frames != &op->sframe)
+		kfree(op->frames);
+	kfree(op);
+	return err;
 }
 
 /*



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux