netdev - Re: [PATCH v2] net: ppp: Add bound checking for skb d on ppp_sync

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <05ee21e6-ff5a-4ee2-a918-f4d7d0cf686c@arnaud-lcm.com>
Date: Thu, 10 Apr 2025 14:19:27 +0200
From: Arnaud Lecomte <contact@...aud-lcm.com>
To: Paolo Abeni <pabeni@...hat.com>, Andrew Lunn <andrew+netdev@...n.ch>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>
Cc: linux-ppp@...r.kernel.org, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org, skhan@...uxfoundation.org,
 syzbot+29fc8991b0ecb186cf40@...kaller.appspotmail.com
Subject: Re: [PATCH v2] net: ppp: Add bound checking for skb d on
 ppp_sync_txmung

Thanks Paolo for the feedback, I'll make sure to follow your 
recommendations next time.

Have a lovely day,

Arnaud

On 10/04/2025 11:30, Paolo Abeni wrote:
> On 4/8/25 5:55 PM, Arnaud Lecomte wrote:
>> Ensure we have enough data in linear buffer from skb before accessing
>> initial bytes. This prevents potential out-of-bounds accesses
>> when processing short packets.
>>
>> When ppp_sync_txmung receives an incoming package with an empty
>> payload:
>> (remote) gef➤  p *(struct pppoe_hdr *) (skb->head + skb->network_header)
>> $18 = {
>> 	type = 0x1,
>> 	ver = 0x1,
>> 	code = 0x0,
>> 	sid = 0x2,
>>          length = 0x0,
>> 	tag = 0xffff8880371cdb96
>> }
>>
>> from the skb struct (trimmed)
>>        tail = 0x16,
>>        end = 0x140,
>>        head = 0xffff88803346f400 "4",
>>        data = 0xffff88803346f416 ":\377",
>>        truesize = 0x380,
>>        len = 0x0,
>>        data_len = 0x0,
>>        mac_len = 0xe,
>>        hdr_len = 0x0,
>>
>> it is not safe to access data[2].
>>
>> Reported-by: syzbot+29fc8991b0ecb186cf40@...kaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=29fc8991b0ecb186cf40
>> Tested-by: syzbot+29fc8991b0ecb186cf40@...kaller.appspotmail.com
>> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>> Signed-off-by: Arnaud Lecomte <contact@...aud-lcm.com>
> A couple of notes for future submission: you should have included the
> target tree in the subj prefix (in this case: "[PATCH net v2]..."), and
> there is a small typo in the subjected (skb d -> skb data). The patch
> looks good I'm applying it.
>
> Thanks,
>
> Paolo
>