iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net
History
YueHaibing 55c3b96074 can: bcm: Fix UAF in bcm_proc_show() 
BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80
Read of size 8 at addr ffff888155846230 by task cat/7862

CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xd5/0x150
 print_report+0xc1/0x5e0
 kasan_report+0xba/0xf0
 bcm_proc_show+0x969/0xa80
 seq_read_iter+0x4f6/0x1260
 seq_read+0x165/0x210
 proc_reg_read+0x227/0x300
 vfs_read+0x1d5/0x8d0
 ksys_read+0x11e/0x240
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Allocated by task 7846:
 kasan_save_stack+0x1e/0x40
 kasan_set_track+0x21/0x30
 __kasan_kmalloc+0x9e/0xa0
 bcm_sendmsg+0x264b/0x44e0
 sock_sendmsg+0xda/0x180
 ____sys_sendmsg+0x735/0x920
 ___sys_sendmsg+0x11d/0x1b0
 __sys_sendmsg+0xfa/0x1d0
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 7846:
 kasan_save_stack+0x1e/0x40
 kasan_set_track+0x21/0x30
 kasan_save_free_info+0x27/0x40
 ____kasan_slab_free+0x161/0x1c0
 slab_free_freelist_hook+0x119/0x220
 __kmem_cache_free+0xb4/0x2e0
 rcu_core+0x809/0x1bd0

bcm_op is freed before procfs entry be removed in bcm_release(),
this lead to bcm_proc_show() may read the freed bcm_op.

Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/all/20230715092543.15548-1-yuehaibing@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2023-07-17 09:46:26 +02:00
..
6lowpan
6lowpan: Remove redundant initialisation.
2023-03-29 08:22:52 +01:00
9p
Including fixes from netfilter.
2023-05-05 19:12:01 -07:00
802
…
8021q
vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
2023-05-17 12:55:39 +01:00
appletalk
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
atm
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
ax25
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
batman-adv
batman-adv: Broken sync while rescheduling delayed work
2023-05-26 23:14:49 +02:00
bluetooth
Bluetooth: hci_event: Fix parsing of CIS Established Event
2023-06-29 10:52:18 -07:00
bpf
bpf: Move kernel test kfuncs to bpf_testmod
2023-05-16 22:09:24 -07:00
bpfilter
net: Use umd_cleanup_helper()
2023-05-31 13:06:57 +02:00
bridge
bridge: Add extack warning when enabling STP in netns.
2023-07-14 08:38:07 +01:00
caif
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
can
can: bcm: Fix UAF in bcm_proc_show()
2023-07-17 09:46:26 +02:00
ceph
libceph: Partially revert changes to support MSG_SPLICE_PAGES
2023-06-27 09:32:40 -07:00
core
for-netdev
2023-07-12 18:13:57 -07:00
dcb
…
dccp
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
devlink
devlink: report devlink_port_type_warn source device
2023-06-17 00:31:14 -07:00
dns_resolver
…
dsa
net: dsa: sja1105: always enable the send_meta options
2023-07-04 19:42:27 +01:00
ethernet
…
ethtool
net: create device lookup API with reference tracking
2023-06-15 08:21:11 +01:00
handshake
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2023-06-15 22:19:41 -07:00
hsr
net: hsr: Disable promiscuous mode in offload mode
2023-06-21 16:47:05 -07:00
ieee802154
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
ife
…
ipv4
gso: fix dodgy bit handling for GSO_UDP_L4
2023-07-14 10:29:20 +01:00
ipv6
gso: fix dodgy bit handling for GSO_UDP_L4
2023-07-14 10:29:20 +01:00
iucv
net/iucv: Fix size of interrupt data
2023-03-16 17:34:40 -07:00
kcm
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
key
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
l2tp
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
l3mdev
…
lapb
…
llc
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
mac80211
- New Drivers
2023-07-03 11:26:05 -07:00
mac802154
Core WPAN changes:
2023-06-24 15:41:46 -07:00
mctp
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
mpls
net: move gso declarations and functions to their own files
2023-06-10 00:11:41 -07:00
mptcp
mptcp: do not rely on implicit state check in mptcp_listen()
2023-07-05 10:51:14 +01:00
ncsi
net/ncsi: change from ndo_set_mac_address to dev_set_mac_address
2023-06-09 10:32:51 +01:00
netfilter
netfilter pull request 23-07-06
2023-07-06 11:02:58 +02:00
netlabel
netlabel: Reorder fields in 'struct netlbl_domaddr6_map'
2023-06-20 20:06:56 -07:00
netlink
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2023-06-27 09:45:22 -07:00
netrom
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
nfc
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2023-06-27 09:45:22 -07:00
nsh
net: move gso declarations and functions to their own files
2023-06-10 00:11:41 -07:00
openvswitch
net: openvswitch: add support for l4 symmetric hashing
2023-06-12 09:46:30 +01:00
packet
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
phonet
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
psample
…
qrtr
Networking changes for 6.5.
2023-06-28 16:43:10 -07:00
rds
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
rfkill
net: rfkill-gpio: Add explicit include for of.h
2023-04-06 20:36:27 +02:00
rose
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
rxrpc
Networking changes for 6.5.
2023-06-28 16:43:10 -07:00
sched
net/sched: sch_qfq: account for stab overhead in qfq_enqueue
2023-07-13 11:11:59 +02:00
sctp
sctp: fix potential deadlock on &net->sctp.addr_wq_lock
2023-06-29 11:49:42 +02:00
smc
smc: Drop smc_sendpage() in favour of smc_sendmsg() + MSG_SPLICE_PAGES
2023-06-24 15:50:12 -07:00
strparser
…
sunrpc
NFS client updates for Linux 6.5
2023-07-01 14:38:25 -07:00
switchdev
…
tipc
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
tls
net: Kill MSG_SENDPAGE_NOTLAST
2023-06-24 15:50:13 -07:00
unix
net: scm: introduce and use scm_recv_unix helper
2023-06-27 10:50:22 -07:00
vmw_vsock
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
wireless
wifi: cfg80211: fix receiving mesh packets without RFC1042 header
2023-07-12 18:03:40 -07:00
x25
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
xdp
xsk: Honor SO_BINDTODEVICE on bind
2023-07-04 10:19:48 +02:00
xfrm
tcp_bpf, smc, tls, espintcp, siw: Reduce MSG_SENDPAGE_NOTLAST usage
2023-06-24 15:50:12 -07:00
compat.c
net/compat: Update msg_control_is_user when setting a kernel pointer
2023-04-14 11:09:27 +01:00
devres.c
…
Kconfig
net/core: Enable socket busy polling on -RT
2023-05-26 08:51:26 +01:00
Kconfig.debug
…
Makefile
net/handshake: Create a NETLINK service for handling handshake requests
2023-04-19 18:48:48 -07:00
socket.c
Networking changes for 6.5.
2023-06-28 16:43:10 -07:00
sysctl_net.c
…