Eric Dumazet 29dc0ea979 nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies ... [ Upstream commit 7a87441c96 ] syzbot reported unsafe calls to copy_from_sockptr() [1] Use copy_safe_from_sockptr() instead. [1] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255 Read of size 4 at addr ffff88801caa1ec3 by task syz-executor459/5078 CPU: 0 PID: 5078 Comm: syz-executor459 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255 do_sock_setsockopt+0x3b1/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfd/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f7fac07fd89 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff660eb788 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7fac07fd89 RDX: 0000000000000000 RSI: 0000000000000118 RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020000a80 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20240408082845.3957374-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-05-17 12:14:45 +02:00
..
hci	NFC: hci: Split memcpy() of struct hcp_message flexible array	2022-09-27 07:45:18 -07:00
nci	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-04-10 16:37:54 +02:00
af_nfc.c	nfc: fix error handling of nfc_proto_register()	2021-10-13 17:32:38 -07:00
core.c	net: nfc: Directly use ida_alloc()/free()	2022-05-28 15:28:47 +01:00
digital_core.c	net: fill in MODULE_DESCRIPTION()s for NFC	2024-01-11 16:16:08 -08:00
digital_dep.c	net:nfc:digital: Fix a double free in digital_tg_recv_dep_req	2021-04-27 15:36:10 -07:00
digital_technology.c	NFC: digital: fix possible memory leak in digital_in_send_sdd_req()	2021-10-13 17:44:29 -07:00
digital.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288	2019-06-05 17:36:37 +02:00
Kconfig	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
llcp_commands.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-06-27 09:45:22 -07:00
llcp_core.c	nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local	2023-12-25 07:29:04 +00:00
llcp_sock.c	nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies	2024-05-17 12:14:45 +02:00
llcp.h	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-06-26 10:57:23 +01:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
netlink.c	genetlink: use attrs from struct genl_info	2023-08-15 15:00:45 -07:00
nfc.h	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-06-26 10:57:23 +01:00
rawsock.c	nfc: Add KCOV annotations	2022-11-02 11:58:13 +00:00