mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
KMSAN reported a kernel-infoleak in move_addr_to_user():
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/linux/instrumented.h:131 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user
include/linux/uaccess.h:205 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120
lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:131 [inline]
_inline_copy_to_user include/linux/uaccess.h:205 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:236 [inline]
move_addr_to_user+0x2e7/0x440 net/socket.c:302
____sys_recvmsg+0x232/0x610 net/socket.c:2925
...
Uninit was stored to memory at:
ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline]
dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739
The issue occurs because the `pan_id` field of `struct ieee802154_addr`
is left uninitialized when the address mode is `IEEE802154_ADDR_NONE`.
The execution flow is as follows:
1. `__ieee802154_rx_handle_packet()` declares a local `struct
ieee802154_hdr hdr` on the stack.
2. `ieee802154_hdr_pull()` calls `ieee802154_hdr_get_addr()` to parse
the source and destination addresses into this structure.
3. If the address mode is `IEEE802154_ADDR_NONE`,
`ieee802154_hdr_get_addr()` previously only set the `mode` field,
leaving the `pan_id` field containing uninitialized stack memory.
4. This uninitialized `pan_id` is later copied into a `struct
sockaddr_ieee802154` in `dgram_recvmsg()` via `ieee802154_addr_to_sa()`.
5. Finally, `move_addr_to_user()` copies the socket address structure to
user space, leaking the uninitialized bytes.
Fix this by using `memset` to zero out the address structure in
`ieee802154_hdr_get_addr()` when the mode is `IEEE802154_ADDR_NONE`.
Fixes: 94b4f6c21c ("ieee802154: add header structs with endiannes and operations")
Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot
Reported-by: syzbot+346474e3bf0b26bd3090@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=346474e3bf0b26bd3090
Link: https://syzkaller.appspot.com/ai_job?id=a507a109-d683-4a2c-bc03-93394f491b17
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/62795fd9-fc0c-48eb-bb82-05ffc5a57104@mail.kernel.org
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
382 lines
7.9 KiB
C
382 lines
7.9 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright (C) 2014 Fraunhofer ITWM
|
|
*
|
|
* Written by:
|
|
* Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
|
|
*/
|
|
|
|
#include <linux/ieee802154.h>
|
|
|
|
#include <net/mac802154.h>
|
|
#include <net/ieee802154_netdev.h>
|
|
|
|
static int
|
|
ieee802154_hdr_push_addr(u8 *buf, const struct ieee802154_addr *addr,
|
|
bool omit_pan)
|
|
{
|
|
int pos = 0;
|
|
|
|
if (addr->mode == IEEE802154_ADDR_NONE)
|
|
return 0;
|
|
|
|
if (!omit_pan) {
|
|
memcpy(buf + pos, &addr->pan_id, 2);
|
|
pos += 2;
|
|
}
|
|
|
|
switch (addr->mode) {
|
|
case IEEE802154_ADDR_SHORT:
|
|
memcpy(buf + pos, &addr->short_addr, 2);
|
|
pos += 2;
|
|
break;
|
|
|
|
case IEEE802154_ADDR_LONG:
|
|
memcpy(buf + pos, &addr->extended_addr, IEEE802154_ADDR_LEN);
|
|
pos += IEEE802154_ADDR_LEN;
|
|
break;
|
|
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
|
|
return pos;
|
|
}
|
|
|
|
static int
|
|
ieee802154_hdr_push_sechdr(u8 *buf, const struct ieee802154_sechdr *hdr)
|
|
{
|
|
int pos = 5;
|
|
|
|
memcpy(buf, hdr, 1);
|
|
memcpy(buf + 1, &hdr->frame_counter, 4);
|
|
|
|
switch (hdr->key_id_mode) {
|
|
case IEEE802154_SCF_KEY_IMPLICIT:
|
|
return pos;
|
|
|
|
case IEEE802154_SCF_KEY_INDEX:
|
|
break;
|
|
|
|
case IEEE802154_SCF_KEY_SHORT_INDEX:
|
|
memcpy(buf + pos, &hdr->short_src, 4);
|
|
pos += 4;
|
|
break;
|
|
|
|
case IEEE802154_SCF_KEY_HW_INDEX:
|
|
memcpy(buf + pos, &hdr->extended_src, IEEE802154_ADDR_LEN);
|
|
pos += IEEE802154_ADDR_LEN;
|
|
break;
|
|
}
|
|
|
|
buf[pos++] = hdr->key_id;
|
|
|
|
return pos;
|
|
}
|
|
|
|
int
|
|
ieee802154_hdr_push(struct sk_buff *skb, struct ieee802154_hdr *hdr)
|
|
{
|
|
u8 buf[IEEE802154_MAX_HEADER_LEN];
|
|
int pos = 2;
|
|
int rc;
|
|
struct ieee802154_hdr_fc *fc = &hdr->fc;
|
|
|
|
buf[pos++] = hdr->seq;
|
|
|
|
fc->dest_addr_mode = hdr->dest.mode;
|
|
|
|
rc = ieee802154_hdr_push_addr(buf + pos, &hdr->dest, false);
|
|
if (rc < 0)
|
|
return -EINVAL;
|
|
pos += rc;
|
|
|
|
fc->source_addr_mode = hdr->source.mode;
|
|
|
|
if (hdr->source.pan_id == hdr->dest.pan_id &&
|
|
hdr->dest.mode != IEEE802154_ADDR_NONE)
|
|
fc->intra_pan = true;
|
|
|
|
rc = ieee802154_hdr_push_addr(buf + pos, &hdr->source, fc->intra_pan);
|
|
if (rc < 0)
|
|
return -EINVAL;
|
|
pos += rc;
|
|
|
|
if (fc->security_enabled) {
|
|
fc->version = 1;
|
|
|
|
rc = ieee802154_hdr_push_sechdr(buf + pos, &hdr->sec);
|
|
if (rc < 0)
|
|
return -EINVAL;
|
|
|
|
pos += rc;
|
|
}
|
|
|
|
memcpy(buf, fc, 2);
|
|
|
|
memcpy(skb_push(skb, pos), buf, pos);
|
|
|
|
return pos;
|
|
}
|
|
EXPORT_SYMBOL_GPL(ieee802154_hdr_push);
|
|
|
|
int ieee802154_mac_cmd_push(struct sk_buff *skb, void *f,
|
|
const void *pl, unsigned int pl_len)
|
|
{
|
|
struct ieee802154_mac_cmd_frame *frame = f;
|
|
struct ieee802154_mac_cmd_pl *mac_pl = &frame->mac_pl;
|
|
struct ieee802154_hdr *mhr = &frame->mhr;
|
|
int ret;
|
|
|
|
skb_reserve(skb, sizeof(*mhr));
|
|
ret = ieee802154_hdr_push(skb, mhr);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
skb_reset_mac_header(skb);
|
|
skb->mac_len = ret;
|
|
|
|
skb_put_data(skb, mac_pl, sizeof(*mac_pl));
|
|
skb_put_data(skb, pl, pl_len);
|
|
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL_GPL(ieee802154_mac_cmd_push);
|
|
|
|
int ieee802154_beacon_push(struct sk_buff *skb,
|
|
struct ieee802154_beacon_frame *beacon)
|
|
{
|
|
struct ieee802154_beacon_hdr *mac_pl = &beacon->mac_pl;
|
|
struct ieee802154_hdr *mhr = &beacon->mhr;
|
|
int ret;
|
|
|
|
skb_reserve(skb, sizeof(*mhr));
|
|
ret = ieee802154_hdr_push(skb, mhr);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
skb_reset_mac_header(skb);
|
|
skb->mac_len = ret;
|
|
|
|
skb_put_data(skb, mac_pl, sizeof(*mac_pl));
|
|
|
|
if (mac_pl->pend_short_addr_count || mac_pl->pend_ext_addr_count)
|
|
return -EOPNOTSUPP;
|
|
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL_GPL(ieee802154_beacon_push);
|
|
|
|
static int
|
|
ieee802154_hdr_get_addr(const u8 *buf, int mode, bool omit_pan,
|
|
struct ieee802154_addr *addr)
|
|
{
|
|
int pos = 0;
|
|
|
|
if (mode == IEEE802154_ADDR_NONE) {
|
|
memset(addr, 0, sizeof(*addr));
|
|
addr->mode = IEEE802154_ADDR_NONE;
|
|
return 0;
|
|
}
|
|
|
|
addr->mode = mode;
|
|
|
|
if (!omit_pan) {
|
|
memcpy(&addr->pan_id, buf + pos, 2);
|
|
pos += 2;
|
|
}
|
|
|
|
if (mode == IEEE802154_ADDR_SHORT) {
|
|
memcpy(&addr->short_addr, buf + pos, 2);
|
|
return pos + 2;
|
|
} else {
|
|
memcpy(&addr->extended_addr, buf + pos, IEEE802154_ADDR_LEN);
|
|
return pos + IEEE802154_ADDR_LEN;
|
|
}
|
|
}
|
|
|
|
static int ieee802154_hdr_addr_len(int mode, bool omit_pan)
|
|
{
|
|
int pan_len = omit_pan ? 0 : 2;
|
|
|
|
switch (mode) {
|
|
case IEEE802154_ADDR_NONE: return 0;
|
|
case IEEE802154_ADDR_SHORT: return 2 + pan_len;
|
|
case IEEE802154_ADDR_LONG: return IEEE802154_ADDR_LEN + pan_len;
|
|
default: return -EINVAL;
|
|
}
|
|
}
|
|
|
|
static int
|
|
ieee802154_hdr_get_sechdr(const u8 *buf, struct ieee802154_sechdr *hdr)
|
|
{
|
|
int pos = 5;
|
|
|
|
memcpy(hdr, buf, 1);
|
|
memcpy(&hdr->frame_counter, buf + 1, 4);
|
|
|
|
switch (hdr->key_id_mode) {
|
|
case IEEE802154_SCF_KEY_IMPLICIT:
|
|
return pos;
|
|
|
|
case IEEE802154_SCF_KEY_INDEX:
|
|
break;
|
|
|
|
case IEEE802154_SCF_KEY_SHORT_INDEX:
|
|
memcpy(&hdr->short_src, buf + pos, 4);
|
|
pos += 4;
|
|
break;
|
|
|
|
case IEEE802154_SCF_KEY_HW_INDEX:
|
|
memcpy(&hdr->extended_src, buf + pos, IEEE802154_ADDR_LEN);
|
|
pos += IEEE802154_ADDR_LEN;
|
|
break;
|
|
}
|
|
|
|
hdr->key_id = buf[pos++];
|
|
|
|
return pos;
|
|
}
|
|
|
|
static int ieee802154_sechdr_lengths[4] = {
|
|
[IEEE802154_SCF_KEY_IMPLICIT] = 5,
|
|
[IEEE802154_SCF_KEY_INDEX] = 6,
|
|
[IEEE802154_SCF_KEY_SHORT_INDEX] = 10,
|
|
[IEEE802154_SCF_KEY_HW_INDEX] = 14,
|
|
};
|
|
|
|
static int ieee802154_hdr_sechdr_len(u8 sc)
|
|
{
|
|
return ieee802154_sechdr_lengths[IEEE802154_SCF_KEY_ID_MODE(sc)];
|
|
}
|
|
|
|
static int ieee802154_hdr_minlen(const struct ieee802154_hdr *hdr)
|
|
{
|
|
int dlen, slen;
|
|
|
|
dlen = ieee802154_hdr_addr_len(hdr->fc.dest_addr_mode, false);
|
|
slen = ieee802154_hdr_addr_len(hdr->fc.source_addr_mode,
|
|
hdr->fc.intra_pan);
|
|
|
|
if (slen < 0 || dlen < 0)
|
|
return -EINVAL;
|
|
|
|
return 3 + dlen + slen + hdr->fc.security_enabled;
|
|
}
|
|
|
|
static int
|
|
ieee802154_hdr_get_addrs(const u8 *buf, struct ieee802154_hdr *hdr)
|
|
{
|
|
int pos = 0;
|
|
|
|
pos += ieee802154_hdr_get_addr(buf + pos, hdr->fc.dest_addr_mode,
|
|
false, &hdr->dest);
|
|
pos += ieee802154_hdr_get_addr(buf + pos, hdr->fc.source_addr_mode,
|
|
hdr->fc.intra_pan, &hdr->source);
|
|
|
|
if (hdr->fc.intra_pan)
|
|
hdr->source.pan_id = hdr->dest.pan_id;
|
|
|
|
return pos;
|
|
}
|
|
|
|
int
|
|
ieee802154_hdr_pull(struct sk_buff *skb, struct ieee802154_hdr *hdr)
|
|
{
|
|
int pos = 3, rc;
|
|
|
|
if (!pskb_may_pull(skb, 3))
|
|
return -EINVAL;
|
|
|
|
memcpy(hdr, skb->data, 3);
|
|
|
|
rc = ieee802154_hdr_minlen(hdr);
|
|
if (rc < 0 || !pskb_may_pull(skb, rc))
|
|
return -EINVAL;
|
|
|
|
pos += ieee802154_hdr_get_addrs(skb->data + pos, hdr);
|
|
|
|
if (hdr->fc.security_enabled) {
|
|
int want = pos + ieee802154_hdr_sechdr_len(skb->data[pos]);
|
|
|
|
if (!pskb_may_pull(skb, want))
|
|
return -EINVAL;
|
|
|
|
pos += ieee802154_hdr_get_sechdr(skb->data + pos, &hdr->sec);
|
|
}
|
|
|
|
skb_pull(skb, pos);
|
|
return pos;
|
|
}
|
|
EXPORT_SYMBOL_GPL(ieee802154_hdr_pull);
|
|
|
|
int ieee802154_mac_cmd_pl_pull(struct sk_buff *skb,
|
|
struct ieee802154_mac_cmd_pl *mac_pl)
|
|
{
|
|
if (!pskb_may_pull(skb, sizeof(*mac_pl)))
|
|
return -EINVAL;
|
|
|
|
memcpy(mac_pl, skb->data, sizeof(*mac_pl));
|
|
skb_pull(skb, sizeof(*mac_pl));
|
|
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL_GPL(ieee802154_mac_cmd_pl_pull);
|
|
|
|
int
|
|
ieee802154_hdr_peek_addrs(const struct sk_buff *skb, struct ieee802154_hdr *hdr)
|
|
{
|
|
const u8 *buf = skb_mac_header(skb);
|
|
int pos = 3, rc;
|
|
|
|
if (buf + 3 > skb_tail_pointer(skb))
|
|
return -EINVAL;
|
|
|
|
memcpy(hdr, buf, 3);
|
|
|
|
rc = ieee802154_hdr_minlen(hdr);
|
|
if (rc < 0 || buf + rc > skb_tail_pointer(skb))
|
|
return -EINVAL;
|
|
|
|
pos += ieee802154_hdr_get_addrs(buf + pos, hdr);
|
|
return pos;
|
|
}
|
|
EXPORT_SYMBOL_GPL(ieee802154_hdr_peek_addrs);
|
|
|
|
int
|
|
ieee802154_hdr_peek(const struct sk_buff *skb, struct ieee802154_hdr *hdr)
|
|
{
|
|
const u8 *buf = skb_mac_header(skb);
|
|
int pos;
|
|
|
|
pos = ieee802154_hdr_peek_addrs(skb, hdr);
|
|
if (pos < 0)
|
|
return -EINVAL;
|
|
|
|
if (hdr->fc.security_enabled) {
|
|
u8 key_id_mode = IEEE802154_SCF_KEY_ID_MODE(*(buf + pos));
|
|
int want = pos + ieee802154_sechdr_lengths[key_id_mode];
|
|
|
|
if (buf + want > skb_tail_pointer(skb))
|
|
return -EINVAL;
|
|
|
|
pos += ieee802154_hdr_get_sechdr(buf + pos, &hdr->sec);
|
|
}
|
|
|
|
return pos;
|
|
}
|
|
EXPORT_SYMBOL_GPL(ieee802154_hdr_peek);
|
|
|
|
int ieee802154_max_payload(const struct ieee802154_hdr *hdr)
|
|
{
|
|
int hlen = ieee802154_hdr_minlen(hdr);
|
|
|
|
if (hdr->fc.security_enabled) {
|
|
hlen += ieee802154_sechdr_lengths[hdr->sec.key_id_mode] - 1;
|
|
hlen += ieee802154_sechdr_authtag_len(&hdr->sec);
|
|
}
|
|
|
|
return IEEE802154_MTU - hlen - IEEE802154_MFR_SIZE;
|
|
}
|
|
EXPORT_SYMBOL_GPL(ieee802154_max_payload);
|