netdev - Re: [PATCH net-next] net/ethtool: fix general protection fault in ethnl_set_plca

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 16 Jan 2023 15:10:01 +0800
From:   shaozhengchao <shaozhengchao@...wei.com>
To:     <netdev@...r.kernel.org>, <piergiorgio.beruto@...il.com>,
        <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
        <pabeni@...hat.com>
CC:     <andrew@...n.ch>, <syzkaller-bugs@...glegroups.com>,
        <weiyongjun1@...wei.com>, <yuehaibing@...wei.com>
Subject: Re: [PATCH net-next] net/ethtool: fix general protection fault in
 ethnl_set_plca_cfg()

Please igonre this patch. Issue has been solved in
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=28dbf774bc879c1841d58cb711aaea6198955b95.

On 2023/1/16 14:52, Zhengchao Shao wrote:
> As indicated by the ethnl_parse_header_dev_get() comment, return: 0 on
> success or negative error code. ethnl_parse_header_dev_get() is
> incorrectly used in ethnl_set_plca_cfg(). As a result, members in dev
> are still accessed when dev is not obtained, resulting in a general
> protection fault issue.
> 
> The stack information is as follows:
> general protection fault, probably for non-canonical address
> 0xdffffc0000000173: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000b98-0x0000000000000b9f]
> RIP: 0010:ethnl_set_plca_cfg+0x1be/0x7d0
> Call Trace:
> <TASK>
> genl_family_rcv_msg_doit.isra.0+0x1d3/0x2c0
> genl_rcv_msg+0x440/0x6e0
> netlink_rcv_skb+0x140/0x3c0
> genl_rcv+0x29/0x40
> netlink_unicast+0x4a7/0x740
> netlink_sendmsg+0x844/0xcf0
> sock_sendmsg+0xca/0x110
> ____sys_sendmsg+0x588/0x6a0
> ___sys_sendmsg+0xed/0x170
> __sys_sendmsg+0xc4/0x170
> do_syscall_64+0x35/0x80
> entry_SYSCALL_64_after_hwframe+0x46/0xb0
> </TASK>
> 
> Reported-by: syzbot+8cf35743af243e5f417e@...kaller.appspotmail.com
> Fixes: 8580e16c28f3 ("net/ethtool: add netlink interface for the PLCA RS")
> Signed-off-by: Zhengchao Shao <shaozhengchao@...wei.com>
> ---
>   net/ethtool/plca.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ethtool/plca.c b/net/ethtool/plca.c
> index d9bb13ffc654..d030cfc64b1f 100644
> --- a/net/ethtool/plca.c
> +++ b/net/ethtool/plca.c
> @@ -151,7 +151,7 @@ int ethnl_set_plca_cfg(struct sk_buff *skb, struct genl_info *info)
>   					 tb[ETHTOOL_A_PLCA_HEADER],
>   					 genl_info_net(info), info->extack,
>   					 true);
> -	if (!ret)
> +	if (ret)
>   		return ret;
>   
>   	dev = req_info.dev;