2019-05-27 14:55:01 +08:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
2005-04-17 06:20:36 +08:00
|
|
|
/*
|
|
|
|
*
|
|
|
|
* Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
|
|
|
|
*/
|
|
|
|
#include <linux/errno.h>
|
|
|
|
#include <linux/types.h>
|
|
|
|
#include <linux/socket.h>
|
|
|
|
#include <linux/in.h>
|
|
|
|
#include <linux/kernel.h>
|
2006-05-04 14:25:17 +08:00
|
|
|
#include <linux/module.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <linux/timer.h>
|
|
|
|
#include <linux/string.h>
|
|
|
|
#include <linux/sockios.h>
|
|
|
|
#include <linux/net.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 16:04:11 +08:00
|
|
|
#include <linux/slab.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <net/ax25.h>
|
|
|
|
#include <linux/inet.h>
|
|
|
|
#include <linux/netdevice.h>
|
|
|
|
#include <linux/if_arp.h>
|
|
|
|
#include <linux/skbuff.h>
|
|
|
|
#include <net/sock.h>
|
2016-12-25 03:46:01 +08:00
|
|
|
#include <linux/uaccess.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <linux/fcntl.h>
|
|
|
|
#include <linux/termios.h> /* For TIOCINQ/OUTQ */
|
|
|
|
#include <linux/mm.h>
|
|
|
|
#include <linux/interrupt.h>
|
|
|
|
#include <linux/notifier.h>
|
|
|
|
#include <linux/proc_fs.h>
|
|
|
|
#include <linux/stat.h>
|
|
|
|
#include <linux/sysctl.h>
|
|
|
|
#include <net/ip.h>
|
|
|
|
#include <net/arp.h>
|
|
|
|
|
|
|
|
/*
|
|
|
|
* IP over AX.25 encapsulation.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Shove an AX.25 UI header on an IP packet and handle ARP
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef CONFIG_INET
|
|
|
|
|
2015-03-02 14:04:31 +08:00
|
|
|
static int ax25_hard_header(struct sk_buff *skb, struct net_device *dev,
|
|
|
|
unsigned short type, const void *daddr,
|
|
|
|
const void *saddr, unsigned int len)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
unsigned char *buff;
|
|
|
|
|
|
|
|
/* they sometimes come back to us... */
|
|
|
|
if (type == ETH_P_AX25)
|
|
|
|
return 0;
|
|
|
|
|
2007-02-09 22:24:31 +08:00
|
|
|
/* header is an AX.25 UI frame from us to them */
|
|
|
|
buff = skb_push(skb, AX25_HEADER_LEN);
|
|
|
|
*buff++ = 0x00; /* KISS DATA */
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
if (daddr != NULL)
|
|
|
|
memcpy(buff, daddr, dev->addr_len); /* Address specified */
|
|
|
|
|
2007-02-09 22:24:31 +08:00
|
|
|
buff[6] &= ~AX25_CBIT;
|
|
|
|
buff[6] &= ~AX25_EBIT;
|
|
|
|
buff[6] |= AX25_SSSID_SPARE;
|
|
|
|
buff += AX25_ADDR_LEN;
|
|
|
|
|
|
|
|
if (saddr != NULL)
|
|
|
|
memcpy(buff, saddr, dev->addr_len);
|
|
|
|
else
|
|
|
|
memcpy(buff, dev->dev_addr, dev->addr_len);
|
|
|
|
|
|
|
|
buff[6] &= ~AX25_CBIT;
|
|
|
|
buff[6] |= AX25_EBIT;
|
|
|
|
buff[6] |= AX25_SSSID_SPARE;
|
|
|
|
buff += AX25_ADDR_LEN;
|
|
|
|
|
|
|
|
*buff++ = AX25_UI; /* UI */
|
|
|
|
|
|
|
|
/* Append a suitable AX.25 PID */
|
|
|
|
switch (type) {
|
|
|
|
case ETH_P_IP:
|
|
|
|
*buff++ = AX25_P_IP;
|
|
|
|
break;
|
|
|
|
case ETH_P_ARP:
|
|
|
|
*buff++ = AX25_P_ARP;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
printk(KERN_ERR "AX.25: ax25_hard_header - wrong protocol type 0x%2.2x\n", type);
|
|
|
|
*buff++ = 0;
|
|
|
|
break;
|
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
if (daddr != NULL)
|
2007-02-09 22:24:31 +08:00
|
|
|
return AX25_HEADER_LEN;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
return -AX25_HEADER_LEN; /* Unfinished header */
|
|
|
|
}
|
|
|
|
|
2015-03-03 23:41:47 +08:00
|
|
|
netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
struct sk_buff *ourskb;
|
|
|
|
unsigned char *bp = skb->data;
|
2006-07-04 10:30:18 +08:00
|
|
|
ax25_route *route;
|
|
|
|
struct net_device *dev = NULL;
|
2005-04-17 06:20:36 +08:00
|
|
|
ax25_address *src, *dst;
|
2006-07-04 10:30:18 +08:00
|
|
|
ax25_digi *digipeat = NULL;
|
2005-04-17 06:20:36 +08:00
|
|
|
ax25_dev *ax25_dev;
|
|
|
|
ax25_cb *ax25;
|
2006-07-04 10:30:18 +08:00
|
|
|
char ip_mode = ' ';
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
dst = (ax25_address *)(bp + 1);
|
|
|
|
src = (ax25_address *)(bp + 8);
|
|
|
|
|
ax25: fix possible use-after-free
syzbot found that ax25 routes where not properly protected
against concurrent use [1].
In this particular report the bug happened while
copying ax25->digipeat.
Fix this problem by making sure we call ax25_get_route()
while ax25_route_lock is held, so that no modification
could happen while using the route.
The current two ax25_get_route() callers do not sleep,
so this change should be fine.
Once we do that, ax25_get_route() no longer needs to
grab a reference on the found route.
[1]
ax25_connect(): syz-executor0 uses autobind, please contact jreuter@yaina.de
BUG: KASAN: use-after-free in memcpy include/linux/string.h:352 [inline]
BUG: KASAN: use-after-free in kmemdup+0x42/0x60 mm/util.c:113
Read of size 66 at addr ffff888066641a80 by task syz-executor2/531
ax25_connect(): syz-executor0 uses autobind, please contact jreuter@yaina.de
CPU: 1 PID: 531 Comm: syz-executor2 Not tainted 5.0.0-rc2+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x123/0x190 mm/kasan/generic.c:191
memcpy+0x24/0x50 mm/kasan/common.c:130
memcpy include/linux/string.h:352 [inline]
kmemdup+0x42/0x60 mm/util.c:113
kmemdup include/linux/string.h:425 [inline]
ax25_rt_autobind+0x25d/0x750 net/ax25/ax25_route.c:424
ax25_connect.cold+0x30/0xa4 net/ax25/af_ax25.c:1224
__sys_connect+0x357/0x490 net/socket.c:1664
__do_sys_connect net/socket.c:1675 [inline]
__se_sys_connect net/socket.c:1672 [inline]
__x64_sys_connect+0x73/0xb0 net/socket.c:1672
do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458099
Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f870ee22c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458099
RDX: 0000000000000048 RSI: 0000000020000080 RDI: 0000000000000005
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
ax25_connect(): syz-executor4 uses autobind, please contact jreuter@yaina.de
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f870ee236d4
R13: 00000000004be48e R14: 00000000004ce9a8 R15: 00000000ffffffff
Allocated by task 526:
save_stack+0x45/0xd0 mm/kasan/common.c:73
set_track mm/kasan/common.c:85 [inline]
__kasan_kmalloc mm/kasan/common.c:496 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:469
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:504
ax25_connect(): syz-executor5 uses autobind, please contact jreuter@yaina.de
kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3609
kmalloc include/linux/slab.h:545 [inline]
ax25_rt_add net/ax25/ax25_route.c:95 [inline]
ax25_rt_ioctl+0x3b9/0x1270 net/ax25/ax25_route.c:233
ax25_ioctl+0x322/0x10b0 net/ax25/af_ax25.c:1763
sock_do_ioctl+0xe2/0x400 net/socket.c:950
sock_ioctl+0x32f/0x6c0 net/socket.c:1074
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
ax25_connect(): syz-executor5 uses autobind, please contact jreuter@yaina.de
Freed by task 550:
save_stack+0x45/0xd0 mm/kasan/common.c:73
set_track mm/kasan/common.c:85 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:458
kasan_slab_free+0xe/0x10 mm/kasan/common.c:466
__cache_free mm/slab.c:3487 [inline]
kfree+0xcf/0x230 mm/slab.c:3806
ax25_rt_add net/ax25/ax25_route.c:92 [inline]
ax25_rt_ioctl+0x304/0x1270 net/ax25/ax25_route.c:233
ax25_ioctl+0x322/0x10b0 net/ax25/af_ax25.c:1763
sock_do_ioctl+0xe2/0x400 net/socket.c:950
sock_ioctl+0x32f/0x6c0 net/socket.c:1074
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff888066641a80
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 0 bytes inside of
96-byte region [ffff888066641a80, ffff888066641ae0)
The buggy address belongs to the page:
page:ffffea0001999040 count:1 mapcount:0 mapping:ffff88812c3f04c0 index:0x0
flags: 0x1fffc0000000200(slab)
ax25_connect(): syz-executor4 uses autobind, please contact jreuter@yaina.de
raw: 01fffc0000000200 ffffea0001817948 ffffea0002341dc8 ffff88812c3f04c0
raw: 0000000000000000 ffff888066641000 0000000100000020 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888066641980: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888066641a00: 00 00 00 00 00 00 00 00 02 fc fc fc fc fc fc fc
>ffff888066641a80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888066641b00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888066641b80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-01-23 02:40:59 +08:00
|
|
|
ax25_route_lock_use();
|
2006-07-04 10:30:18 +08:00
|
|
|
route = ax25_get_route(dst, NULL);
|
|
|
|
if (route) {
|
|
|
|
digipeat = route->digipeat;
|
|
|
|
dev = route->dev;
|
|
|
|
ip_mode = route->ip_mode;
|
2007-04-21 08:09:22 +08:00
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
if (dev == NULL)
|
|
|
|
dev = skb->dev;
|
|
|
|
|
2007-02-09 22:24:31 +08:00
|
|
|
if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) {
|
2015-03-02 13:59:57 +08:00
|
|
|
kfree_skb(skb);
|
2007-02-09 22:24:31 +08:00
|
|
|
goto put;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
if (bp[16] == AX25_P_IP) {
|
2006-07-04 10:30:18 +08:00
|
|
|
if (ip_mode == 'V' || (ip_mode == ' ' && ax25_dev->values[AX25_VALUES_IPDEFMODE])) {
|
2005-04-17 06:20:36 +08:00
|
|
|
/*
|
|
|
|
* We copy the buffer and release the original thereby
|
|
|
|
* keeping it straight
|
|
|
|
*
|
|
|
|
* Note: we report 1 back so the caller will
|
|
|
|
* not feed the frame direct to the physical device
|
|
|
|
* We don't want that to happen. (It won't be upset
|
|
|
|
* as we have pulled the frame from the queue by
|
|
|
|
* freeing it).
|
|
|
|
*
|
|
|
|
* NB: TCP modifies buffers that are still
|
|
|
|
* on a device queue, thus we use skb_copy()
|
|
|
|
* instead of using skb_clone() unless this
|
|
|
|
* gets fixed.
|
|
|
|
*/
|
|
|
|
|
|
|
|
ax25_address src_c;
|
|
|
|
ax25_address dst_c;
|
|
|
|
|
|
|
|
if ((ourskb = skb_copy(skb, GFP_ATOMIC)) == NULL) {
|
|
|
|
kfree_skb(skb);
|
|
|
|
goto put;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (skb->sk != NULL)
|
|
|
|
skb_set_owner_w(ourskb, skb->sk);
|
|
|
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
/* dl9sau: bugfix
|
|
|
|
* after kfree_skb(), dst and src which were pointer
|
|
|
|
* to bp which is part of skb->data would not be valid
|
|
|
|
* anymore hope that after skb_pull(ourskb, ..) our
|
|
|
|
* dsc_c and src_c will not become invalid
|
|
|
|
*/
|
|
|
|
bp = ourskb->data;
|
|
|
|
dst_c = *(ax25_address *)(bp + 1);
|
|
|
|
src_c = *(ax25_address *)(bp + 8);
|
|
|
|
|
|
|
|
skb_pull(ourskb, AX25_HEADER_LEN - 1); /* Keep PID */
|
2007-04-11 11:45:18 +08:00
|
|
|
skb_reset_network_header(ourskb);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
ax25=ax25_send_frame(
|
2007-02-09 22:24:31 +08:00
|
|
|
ourskb,
|
|
|
|
ax25_dev->values[AX25_VALUES_PACLEN],
|
2005-04-17 06:20:36 +08:00
|
|
|
&src_c,
|
2006-07-04 10:30:18 +08:00
|
|
|
&dst_c, digipeat, dev);
|
2005-04-17 06:20:36 +08:00
|
|
|
if (ax25) {
|
|
|
|
ax25_cb_put(ax25);
|
|
|
|
}
|
|
|
|
goto put;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-02-09 22:24:31 +08:00
|
|
|
bp[7] &= ~AX25_CBIT;
|
|
|
|
bp[7] &= ~AX25_EBIT;
|
|
|
|
bp[7] |= AX25_SSSID_SPARE;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2007-02-09 22:24:31 +08:00
|
|
|
bp[14] &= ~AX25_CBIT;
|
|
|
|
bp[14] |= AX25_EBIT;
|
|
|
|
bp[14] |= AX25_SSSID_SPARE;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
skb_pull(skb, AX25_KISS_HEADER_LEN);
|
|
|
|
|
2006-07-04 10:30:18 +08:00
|
|
|
if (digipeat != NULL) {
|
2005-04-17 06:20:36 +08:00
|
|
|
if ((ourskb = ax25_rt_build_path(skb, src, dst, route->digipeat)) == NULL) {
|
|
|
|
kfree_skb(skb);
|
|
|
|
goto put;
|
|
|
|
}
|
|
|
|
|
|
|
|
skb = ourskb;
|
|
|
|
}
|
|
|
|
|
2005-04-22 07:46:56 +08:00
|
|
|
ax25_queue_xmit(skb, dev);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
put:
|
|
|
|
|
ax25: fix possible use-after-free
syzbot found that ax25 routes where not properly protected
against concurrent use [1].
In this particular report the bug happened while
copying ax25->digipeat.
Fix this problem by making sure we call ax25_get_route()
while ax25_route_lock is held, so that no modification
could happen while using the route.
The current two ax25_get_route() callers do not sleep,
so this change should be fine.
Once we do that, ax25_get_route() no longer needs to
grab a reference on the found route.
[1]
ax25_connect(): syz-executor0 uses autobind, please contact jreuter@yaina.de
BUG: KASAN: use-after-free in memcpy include/linux/string.h:352 [inline]
BUG: KASAN: use-after-free in kmemdup+0x42/0x60 mm/util.c:113
Read of size 66 at addr ffff888066641a80 by task syz-executor2/531
ax25_connect(): syz-executor0 uses autobind, please contact jreuter@yaina.de
CPU: 1 PID: 531 Comm: syz-executor2 Not tainted 5.0.0-rc2+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x123/0x190 mm/kasan/generic.c:191
memcpy+0x24/0x50 mm/kasan/common.c:130
memcpy include/linux/string.h:352 [inline]
kmemdup+0x42/0x60 mm/util.c:113
kmemdup include/linux/string.h:425 [inline]
ax25_rt_autobind+0x25d/0x750 net/ax25/ax25_route.c:424
ax25_connect.cold+0x30/0xa4 net/ax25/af_ax25.c:1224
__sys_connect+0x357/0x490 net/socket.c:1664
__do_sys_connect net/socket.c:1675 [inline]
__se_sys_connect net/socket.c:1672 [inline]
__x64_sys_connect+0x73/0xb0 net/socket.c:1672
do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458099
Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f870ee22c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458099
RDX: 0000000000000048 RSI: 0000000020000080 RDI: 0000000000000005
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
ax25_connect(): syz-executor4 uses autobind, please contact jreuter@yaina.de
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f870ee236d4
R13: 00000000004be48e R14: 00000000004ce9a8 R15: 00000000ffffffff
Allocated by task 526:
save_stack+0x45/0xd0 mm/kasan/common.c:73
set_track mm/kasan/common.c:85 [inline]
__kasan_kmalloc mm/kasan/common.c:496 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:469
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:504
ax25_connect(): syz-executor5 uses autobind, please contact jreuter@yaina.de
kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3609
kmalloc include/linux/slab.h:545 [inline]
ax25_rt_add net/ax25/ax25_route.c:95 [inline]
ax25_rt_ioctl+0x3b9/0x1270 net/ax25/ax25_route.c:233
ax25_ioctl+0x322/0x10b0 net/ax25/af_ax25.c:1763
sock_do_ioctl+0xe2/0x400 net/socket.c:950
sock_ioctl+0x32f/0x6c0 net/socket.c:1074
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
ax25_connect(): syz-executor5 uses autobind, please contact jreuter@yaina.de
Freed by task 550:
save_stack+0x45/0xd0 mm/kasan/common.c:73
set_track mm/kasan/common.c:85 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:458
kasan_slab_free+0xe/0x10 mm/kasan/common.c:466
__cache_free mm/slab.c:3487 [inline]
kfree+0xcf/0x230 mm/slab.c:3806
ax25_rt_add net/ax25/ax25_route.c:92 [inline]
ax25_rt_ioctl+0x304/0x1270 net/ax25/ax25_route.c:233
ax25_ioctl+0x322/0x10b0 net/ax25/af_ax25.c:1763
sock_do_ioctl+0xe2/0x400 net/socket.c:950
sock_ioctl+0x32f/0x6c0 net/socket.c:1074
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff888066641a80
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 0 bytes inside of
96-byte region [ffff888066641a80, ffff888066641ae0)
The buggy address belongs to the page:
page:ffffea0001999040 count:1 mapcount:0 mapping:ffff88812c3f04c0 index:0x0
flags: 0x1fffc0000000200(slab)
ax25_connect(): syz-executor4 uses autobind, please contact jreuter@yaina.de
raw: 01fffc0000000200 ffffea0001817948 ffffea0002341dc8 ffff88812c3f04c0
raw: 0000000000000000 ffff888066641000 0000000100000020 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888066641980: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888066641a00: 00 00 00 00 00 00 00 00 02 fc fc fc fc fc fc fc
>ffff888066641a80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888066641b00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888066641b80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-01-23 02:40:59 +08:00
|
|
|
ax25_route_lock_unuse();
|
2015-03-03 23:41:47 +08:00
|
|
|
return NETDEV_TX_OK;
|
2015-03-02 14:05:28 +08:00
|
|
|
}
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
#else /* INET */
|
|
|
|
|
2015-03-02 14:04:31 +08:00
|
|
|
static int ax25_hard_header(struct sk_buff *skb, struct net_device *dev,
|
|
|
|
unsigned short type, const void *daddr,
|
|
|
|
const void *saddr, unsigned int len)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
return -AX25_HEADER_LEN;
|
|
|
|
}
|
|
|
|
|
2015-03-05 20:54:00 +08:00
|
|
|
netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
|
2015-03-02 14:05:28 +08:00
|
|
|
{
|
2015-03-03 23:41:47 +08:00
|
|
|
kfree_skb(skb);
|
|
|
|
return NETDEV_TX_OK;
|
2015-03-02 14:05:28 +08:00
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
#endif
|
|
|
|
|
2016-03-10 10:58:33 +08:00
|
|
|
static bool ax25_validate_header(const char *header, unsigned int len)
|
|
|
|
{
|
|
|
|
ax25_digi digi;
|
|
|
|
|
|
|
|
if (!len)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
if (header[0])
|
|
|
|
return true;
|
|
|
|
|
|
|
|
return ax25_addr_parse(header + 1, len - 1, NULL, NULL, &digi, NULL,
|
|
|
|
NULL);
|
|
|
|
}
|
|
|
|
|
2007-10-09 16:40:57 +08:00
|
|
|
const struct header_ops ax25_header_ops = {
|
|
|
|
.create = ax25_hard_header,
|
2016-03-10 10:58:33 +08:00
|
|
|
.validate = ax25_validate_header,
|
2007-10-09 16:40:57 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(ax25_header_ops);
|
2015-03-03 23:41:47 +08:00
|
|
|
EXPORT_SYMBOL(ax25_ip_xmit);
|