netdev - Re: drivers/net/hamradio: divide error in hdlcdrv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170517210740.20cbbb82@alans-desktop>
Date:   Wed, 17 May 2017 21:07:40 +0100
From:   Alan Cox <gnomes@...rguk.ukuu.org.uk>
To:     Andrey Konovalov <andreyknvl@...gle.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Alan Cox <alan@...ux.intel.com>,
        Thomas Osterried <thomas@...erried.de>,
        Javier Martinez Canillas <javier@....samsung.com>,
        David Howells <dhowells@...hat.com>,
        Geliang Tang <geliangtang@...il.com>,
        netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: drivers/net/hamradio: divide error in hdlcdrv_ioctl

On Tue, 16 May 2017 17:05:32 +0200
Andrey Konovalov <andreyknvl@...gle.com> wrote:

> Hi,
> 
> I've got the following error report while fuzzing the kernel with syzkaller.
> 
> On commit 2ea659a9ef488125eb46da6eb571de5eae5c43f6 (4.12-rc1).
> 
> A reproducer and .config are attached.

This should fix it.

commit 37b3fa4b617681f00cfa1f76d6d7716cc6d9f79a
Author: Alan Cox <alan@...yncelyn.cymru>
Date:   Wed May 17 21:04:27 2017 +0100

    hdlcdrv: Fix division by zero when bitrate is unset
    
    The code attempts to check for out of range calibration. What it forgets to do
    is check for the 0 bitrate case. As a result the range check itself oopses the
    kernel.
    
    Found by Andrey Konovalov using Syzkaller.
    
    Signed-off-by: Alan Cox <alan@...ux.intel.com>

diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 8c3633c..9f34a48 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -576,7 +576,7 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 	case HDLCDRVCTL_CALIBRATE:
 		if(!capable(CAP_SYS_RAWIO))
 			return -EPERM;
-		if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+		if (!s->par.bitrate || bi.data.calibrate > INT_MAX / s->par.bitrate)
 			return -EINVAL;
 		s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
 		return 0;