netdev - RE: [PATCH net-next v5] net/ncsi: Extend NC-SI Netlink interface to allow user space to send NC-SI command

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <62f859a161f64f7a8f11ba1a99369169@AUSX13MPS302.AMER.DELL.COM>
Date:   Thu, 11 Oct 2018 05:37:46 +0000
From:   <Justin.Lee1@...l.com>
To:     <sam@...dozajonas.com>, <joel@....id.au>
CC:     <linux-aspeed@...ts.ozlabs.org>, <netdev@...r.kernel.org>,
        <openbmc@...ts.ozlabs.org>, <amithash@...com>, <christian@....nu>,
        <vijaykhemka@...com>
Subject: RE: [PATCH net-next v5] net/ncsi: Extend NC-SI Netlink interface to
 allow user space to send NC-SI command


> On Wed, 2018-10-10 at 18:11 +0000, Justin.Lee1@...l.com wrote:
> <snip>
> > +
> > +	len = nla_len(info->attrs[NCSI_ATTR_DATA]);
> > +	if (len < sizeof(struct ncsi_pkt_hdr)) {
> > +		netdev_info(ndp->ndev.dev, "NCSI: no command to send %u\n",
> > +			    package_id);
> > +		ret = -EINVAL;
> > +		goto out_netlink;
> > +	} else {
> > +		data = (unsigned char *)nla_data(info->attrs[NCSI_ATTR_DATA]);
> > +	}
> 
> I only just noticed this, the call to nla_len() can cause a null-dereference if
> the NCSI_ATTR_DATA attribute isn't present; we need to make sure it exists
> before accessing it in info->attrs.
> 
> eg:
> 
> root@...om2-bmc:~# ./ncsi-netlink -l 2 -p 0 -c 0 --cmd
> [   81.399837] Unable to handle kernel NULL pointer dereference at virtual address 00000000
> [   81.409092] pgd = ddaa9fa6
> [   81.413084] [00000000] *pgd=9702c831, *pte=00000000, *ppte=00000000
> [   81.420729] Internal error: Oops: 17 [#1] ARM
> [   81.426447] CPU: 0 PID: 1028 Comm: ncsi-netlink Not tainted 4.18.8-sammj-00144-gbc129f31bfa5 #12
> ...
> [   81.874434] Kernel panic - not syncing: Fatal exception
> 
> Cheers,
> Sam

Good catch! I will address this and generate the new patch.

Thanks,
Justin