| From foo@baz Thu 06 Feb 2020 06:50:11 AM GMT |
| From: Taehee Yoo <ap420073@gmail.com> |
| Date: Sat, 1 Feb 2020 16:43:22 +0000 |
| Subject: netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init() |
| |
| From: Taehee Yoo <ap420073@gmail.com> |
| |
| [ Upstream commit 6fb8852b1298200da39bd85788bc5755d1d56f32 ] |
| |
| When netdevsim dev is being created, a debugfs directory is created. |
| The variable "dev_ddir_name" is 16bytes device name pointer and device |
| name is "netdevsim<dev id>". |
| The maximum dev id length is 10. |
| So, 16bytes for device name isn't enough. |
| |
| Test commands: |
| modprobe netdevsim |
| echo "1000000000 0" > /sys/bus/netdevsim/new_device |
| |
| Splat looks like: |
| [ 249.622710][ T900] BUG: KASAN: stack-out-of-bounds in number+0x824/0x880 |
| [ 249.623658][ T900] Write of size 1 at addr ffff88804c527988 by task bash/900 |
| [ 249.624521][ T900] |
| [ 249.624830][ T900] CPU: 1 PID: 900 Comm: bash Not tainted 5.5.0+ #322 |
| [ 249.625691][ T900] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 |
| [ 249.626712][ T900] Call Trace: |
| [ 249.627103][ T900] dump_stack+0x96/0xdb |
| [ 249.627639][ T900] ? number+0x824/0x880 |
| [ 249.628173][ T900] print_address_description.constprop.5+0x1be/0x360 |
| [ 249.629022][ T900] ? number+0x824/0x880 |
| [ 249.629569][ T900] ? number+0x824/0x880 |
| [ 249.630105][ T900] __kasan_report+0x12a/0x170 |
| [ 249.630717][ T900] ? number+0x824/0x880 |
| [ 249.631201][ T900] kasan_report+0xe/0x20 |
| [ 249.631723][ T900] number+0x824/0x880 |
| [ 249.632235][ T900] ? put_dec+0xa0/0xa0 |
| [ 249.632716][ T900] ? rcu_read_lock_sched_held+0x90/0xc0 |
| [ 249.633392][ T900] vsnprintf+0x63c/0x10b0 |
| [ 249.633983][ T900] ? pointer+0x5b0/0x5b0 |
| [ 249.634543][ T900] ? mark_lock+0x11d/0xc40 |
| [ 249.635200][ T900] sprintf+0x9b/0xd0 |
| [ 249.635750][ T900] ? scnprintf+0xe0/0xe0 |
| [ 249.636370][ T900] nsim_dev_probe+0x63c/0xbf0 [netdevsim] |
| [ ... ] |
| |
| Reviewed-by: Jakub Kicinski <kuba@kernel.org> |
| Fixes: ab1d0cc004d7 ("netdevsim: change debugfs tree topology") |
| Signed-off-by: Taehee Yoo <ap420073@gmail.com> |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/netdevsim/dev.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/net/netdevsim/dev.c |
| +++ b/drivers/net/netdevsim/dev.c |
| @@ -73,7 +73,7 @@ static const struct file_operations nsim |
| |
| static int nsim_dev_debugfs_init(struct nsim_dev *nsim_dev) |
| { |
| - char dev_ddir_name[16]; |
| + char dev_ddir_name[sizeof(DRV_NAME) + 10]; |
| |
| sprintf(dev_ddir_name, DRV_NAME "%u", nsim_dev->nsim_bus_dev->dev.id); |
| nsim_dev->ddir = debugfs_create_dir(dev_ddir_name, nsim_dev_ddir); |