Patch "bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()" has been added to the 6.9-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bonding-fix-out-of-bounds-read-in-bond_option_arp_ip.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5cd123634f63f4c819381ed46b7c5eb177c52757
Author: Sam Sun <samsun1006219@xxxxxxxxx>
Date:   Tue Jul 2 14:55:55 2024 +0100

    bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
    
    [ Upstream commit e271ff53807e8f2c628758290f0e499dbe51cb3d ]
    
    In function bond_option_arp_ip_targets_set(), if newval->string is an
    empty string, newval->string+1 will point to the byte after the
    string, causing an out-of-bound read.
    
    BUG: KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418
    Read of size 1 at addr ffff8881119c4781 by task syz-executor665/8107
    CPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]
     dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
     print_address_description mm/kasan/report.c:364 [inline]
     print_report+0xc1/0x5e0 mm/kasan/report.c:475
     kasan_report+0xbe/0xf0 mm/kasan/report.c:588
     strlen+0x7d/0xa0 lib/string.c:418
     __fortify_strlen include/linux/fortify-string.h:210 [inline]
     in4_pton+0xa3/0x3f0 net/core/utils.c:130
     bond_option_arp_ip_targets_set+0xc2/0x910
    drivers/net/bonding/bond_options.c:1201
     __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767
     __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792
     bond_opt_tryset_rtnl+0xda/0x160 drivers/net/bonding/bond_options.c:817
     bonding_sysfs_store_option+0xa1/0x120 drivers/net/bonding/bond_sysfs.c:156
     dev_attr_store+0x54/0x80 drivers/base/core.c:2366
     sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136
     kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334
     call_write_iter include/linux/fs.h:2020 [inline]
     new_sync_write fs/read_write.c:491 [inline]
     vfs_write+0x96a/0xd80 fs/read_write.c:584
     ksys_write+0x122/0x250 fs/read_write.c:637
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x63/0x6b
    ---[ end trace ]---
    
    Fix it by adding a check of string length before using it.
    
    Fixes: f9de11a16594 ("bonding: add ip checks when store ip target")
    Signed-off-by: Yue Sun <samsun1006219@xxxxxxxxx>
    Signed-off-by: Simon Horman <horms@xxxxxxxxxx>
    Acked-by: Jay Vosburgh <jay.vosburgh@xxxxxxxxxxxxx>
    Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxx>
    Link: https://patch.msgid.link/20240702-bond-oob-v6-1-2dfdba195c19@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 4cdbc7e084f4b..fea1d87a97539 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -1214,9 +1214,9 @@ static int bond_option_arp_ip_targets_set(struct bonding *bond,
 	__be32 target;
 
 	if (newval->string) {
-		if (!in4_pton(newval->string+1, -1, (u8 *)&target, -1, NULL)) {
-			netdev_err(bond->dev, "invalid ARP target %pI4 specified\n",
-				   &target);
+		if (strlen(newval->string) < 1 ||
+		    !in4_pton(newval->string + 1, -1, (u8 *)&target, -1, NULL)) {
+			netdev_err(bond->dev, "invalid ARP target specified\n");
 			return ret;
 		}
 		if (newval->string[0] == '+')




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux