iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2f2a7ffad5
linux/net
History
Peilin Ye 2f2a7ffad5 AX.25: Fix out-of-bounds read in ax25_connect() 
Checks on `addr_len` and `fsa->fsa_ax25.sax25_ndigis` are insufficient.
ax25_connect() can go out of bounds when `fsa->fsa_ax25.sax25_ndigis`
equals to 7 or 8. Fix it.

This issue has been reported as a KMSAN uninit-value bug, because in such
a case, ax25_connect() reaches into the uninitialized portion of the
`struct sockaddr_storage` statically allocated in __sys_connect().

It is safe to remove `fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS` because
`addr_len` is guaranteed to be less than or equal to
`sizeof(struct full_sockaddr_ax25)`.

Reported-by: syzbot+c82752228ed975b0a623@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=55ef9d629f3b3d7d70b69558015b63b48d01af66
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-22 17:56:40 -07:00
..
6lowpan treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
9p net: Add MODULE_DESCRIPTION entries to network modules 2020-06-20 21:33:57 -07:00
802
8021q net: get rid of lockdep_set_class_and_subclass() 2020-06-28 21:37:23 -07:00
appletalk ipv4,appletalk: move SIOCADDRT and SIOCDELRT handling into ->compat_ioctl 2020-05-18 17:35:02 -07:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-06-13 16:27:13 -07:00
ax25 AX.25: Fix out-of-bounds read in ax25_connect() 2020-07-22 17:56:40 -07:00
batman-adv net: change addr_list_lock back to static key 2020-06-09 12:59:45 -07:00
bluetooth Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next 2020-06-03 16:27:18 -07:00
bpf bpf: Add tests for PTR_TO_BTF_ID vs. null comparison 2020-06-30 22:21:29 +02:00
bpfilter bpfilter: switch to kernel_write 2020-07-08 08:27:56 +02:00
bridge bridge: mcast: Fix MLD2 Report IPv6 payload length check 2020-07-07 15:37:57 -07:00
caif treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
can treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ceph libceph: don't omit used_replica in target_copy() 2020-06-16 16:02:08 +02:00
core net-sysfs: add a newline when printing 'tx_timeout' by sysfs 2020-07-21 15:35:58 -07:00
dcb treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
dccp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-06-13 16:27:13 -07:00
decnet treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
dns_resolver
dsa dsa: Allow forwarding of redirected IGMP traffic 2020-06-24 14:39:43 -07:00
ethernet net: move devres helpers into a separate source file 2020-05-23 16:56:17 -07:00
ethtool ethtool: fix genlmsg_put() failure handling in ethnl_default_dumpit() 2020-07-09 12:35:33 -07:00
hsr net: hsr: check for return value of skb_put_padto() 2020-07-20 18:02:28 -07:00
ieee802154 treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ife
ipv4 net: udp: Fix wrong clean up for IS_UDPLITE macro 2020-07-21 15:41:49 -07:00
ipv6 net: udp: Fix wrong clean up for IS_UDPLITE macro 2020-07-21 15:41:49 -07:00
iucv net/af_iucv: clean up function prototypes 2020-05-19 12:50:14 -07:00
kcm treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
key
l2tp l2tp: remove skb_dst_set() from l2tp_xmit_skb() 2020-07-08 15:24:33 -07:00
l3mdev treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
lapb treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
llc llc: make sure applications use ARPHRD_ETHER 2020-06-28 21:41:23 -07:00
mac80211 mac80211: allow rx of mesh eapol frames with default rx key 2020-06-25 12:55:45 +02:00
mac802154 treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
mpls treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
mptcp mptcp: fix DSS map generation on fin retransmission 2020-07-07 15:27:37 -07:00
ncsi treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
netfilter netfilter: conntrack: refetch conntrack after nf_conntrack_update() 2020-07-03 14:47:03 +02:00
netlabel treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
netlink genetlink: remove genl_bind 2020-07-01 15:49:11 -07:00
netrom net: change addr_list_lock back to static key 2020-06-09 12:59:45 -07:00
nfc nfc: nci: add missed destroy_workqueue in nci_register_device 2020-07-17 13:08:08 -07:00
nsh treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
openvswitch openvswitch: take into account de-fragmentation/gso_size in execute_check_pkt_len 2020-06-24 14:34:58 -07:00
packet treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
phonet
psample net: psample: fix build error when CONFIG_INET is not enabled 2020-05-23 16:36:05 -07:00
qrtr net: qrtr: Fix an out of bounds read qrtr_endpoint_post() 2020-06-30 18:36:13 -07:00
rds rds: If one path needs re-connection, check all and re-connect 2020-07-01 17:35:17 -07:00
rfkill
rose net: change addr_list_lock back to static key 2020-06-09 12:59:45 -07:00
rxrpc rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA 2020-07-20 17:47:10 -07:00
sched net/sched: act_ct: fix restore the qdisc_skb_cb after defrag 2020-07-20 18:36:37 -07:00
sctp sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket 2020-06-25 16:11:33 -07:00
smc net/smc: fix dmb buffer shortage 2020-07-20 17:52:25 -07:00
strparser
sunrpc Fixes for a umask bug on exported filesystems lacking ACL support, a 2020-07-02 20:35:33 -07:00
switchdev treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
tipc tipc: allow to build NACK message in link timeout function 2020-07-20 20:11:22 -07:00
tls treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
unix treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
vmw_vsock vsock/virtio: annotate 'the_virtio_vsock' RCU pointer 2020-07-15 17:47:15 -07:00
wimax
wireless nl80211: fix memory leak when parsing NL80211_ATTR_HE_BSS_COLOR 2020-06-26 11:52:57 +02:00
x25 treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
xdp xsk: Use dma_need_sync instead of reimplenting it 2020-06-30 15:44:03 +02:00
xfrm net: xfrmi: implement header_ops->parse_protocol for AF_PACKET 2020-06-30 12:29:39 -07:00
compat.c switch cmsghdr_from_user_compat_to_kern() to copy_from_user() 2020-06-01 12:05:45 -07:00
devres.c net: devres: provide devm_register_netdev() 2020-05-23 16:56:17 -07:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile net: move devres helpers into a separate source file 2020-05-23 16:56:17 -07:00
socket.c net: remove kernel_setsockopt 2020-05-29 13:10:39 -07:00
sysctl_net.c