netdev - Re: [PATCH net 1/2] net/af_iucv: fix null pointer dereference on shutdown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 6 Nov 2020 08:59:28 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Julian Wiedmann <jwi@...ux.ibm.com>
Cc:     David Miller <davem@...emloft.net>,
        linux-netdev <netdev@...r.kernel.org>,
        linux-s390 <linux-s390@...r.kernel.org>,
        Heiko Carstens <hca@...ux.ibm.com>,
        Karsten Graul <kgraul@...ux.ibm.com>,
        Ursula Braun <ubraun@...ux.ibm.com>
Subject: Re: [PATCH net 1/2] net/af_iucv: fix null pointer dereference on
 shutdown

On Fri,  6 Nov 2020 13:50:07 +0100 Julian Wiedmann wrote:
> From: Ursula Braun <ubraun@...ux.ibm.com>
> 
> syzbot reported the following KASAN finding:
> 
> BUG: KASAN: nullptr-dereference in iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
> Read of size 2 at addr 000000000000021e by task syz-executor907/519
> 
> CPU: 0 PID: 519 Comm: syz-executor907 Not tainted 5.9.0-syzkaller-07043-gbcf9877ad213 #0
> Hardware name: IBM 3906 M04 701 (KVM/Linux)
> Call Trace:
>  [<00000000c576af60>] unwind_start arch/s390/include/asm/unwind.h:65 [inline]
>  [<00000000c576af60>] show_stack+0x180/0x228 arch/s390/kernel/dumpstack.c:135
>  [<00000000c9dcd1f8>] __dump_stack lib/dump_stack.c:77 [inline]
>  [<00000000c9dcd1f8>] dump_stack+0x268/0x2f0 lib/dump_stack.c:118
>  [<00000000c5fed016>] print_address_description.constprop.0+0x5e/0x218 mm/kasan/report.c:383
>  [<00000000c5fec82a>] __kasan_report mm/kasan/report.c:517 [inline]
>  [<00000000c5fec82a>] kasan_report+0x11a/0x168 mm/kasan/report.c:534
>  [<00000000c98b5b60>] iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
>  [<00000000c98b6262>] iucv_sock_shutdown+0x44a/0x4c0 net/iucv/af_iucv.c:1457
>  [<00000000c89d3a54>] __sys_shutdown+0x12c/0x1c8 net/socket.c:2204
>  [<00000000c89d3b70>] __do_sys_shutdown net/socket.c:2212 [inline]
>  [<00000000c89d3b70>] __s390x_sys_shutdown+0x38/0x48 net/socket.c:2210
>  [<00000000c9e36eac>] system_call+0xe0/0x28c arch/s390/kernel/entry.S:415
> 
> There is nothing to shutdown if a connection has never been established.
> Besides that iucv->hs_dev is not yet initialized if a socket is in
> IUCV_OPEN state and iucv->path is not yet initialized if socket is in
> IUCV_BOUND state.
> So, just skip the shutdown calls for a socket in these states.
> 
> Fixes: eac3731bd04c ("s390: Add AF_IUCV socket support")
> Fixes: 82492a355fac ("af_iucv: add shutdown for HS transport")
> Reviewed-by: Vasily Gorbik <gor@...ux.ibm.com>
> Signed-off-by: Ursula Braun <ubraun@...ux.ibm.com>
> Signed-off-by: Julian Wiedmann <jwi@...ux.ibm.com>

Fixes tag: Fixes: eac3731bd04c ("s390: Add AF_IUCV socket support")
Has these problem(s):
	- Subject does not match target commit subject
	  Just use
		git log -1 --format='Fixes: %h ("%s")'