linux/drivers/net/hamradio
Xu Jia 2b04495e21 hamradio: 6pack: fix array-index-out-of-bounds in decode_std_command()
Hulk Robot reports incorrect sp->rx_count_cooked value in decode_std_command().
This should be caused by the subtracting from sp->rx_count_cooked before.
It seems that sp->rx_count_cooked value is changed to 0, which bypassed the
previous judgment.

The situation is shown below:

         (Thread 1)			|  (Thread 2)
decode_std_command()		| resync_tnc()
...					|
if (rest == 2)			|
	sp->rx_count_cooked -= 2;	|
else if (rest == 3)			| ...
					| sp->rx_count_cooked = 0;
	sp->rx_count_cooked -= 1;	|
for (i = 0; i < sp->rx_count_cooked; i++) // report error
	checksum += sp->cooked_buf[i];

sp->rx_count_cooked is a shared variable but is not protected by a lock.
The same applies to sp->rx_count. This patch adds a lock to fix the bug.

The fail log is shown below:
=======================================================================
UBSAN: array-index-out-of-bounds in drivers/net/hamradio/6pack.c:925:31
index 400 is out of range for type 'unsigned char [400]'
CPU: 3 PID: 7433 Comm: kworker/u10:1 Not tainted 5.18.0-rc5-00163-g4b97bac0756a #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events_unbound flush_to_ldisc
Call Trace:
 <TASK>
 dump_stack_lvl+0xcd/0x134
 ubsan_epilogue+0xb/0x50
 __ubsan_handle_out_of_bounds.cold+0x62/0x6c
 sixpack_receive_buf+0xfda/0x1330
 tty_ldisc_receive_buf+0x13e/0x180
 tty_port_default_receive_buf+0x6d/0xa0
 flush_to_ldisc+0x213/0x3f0
 process_one_work+0x98f/0x1620
 worker_thread+0x665/0x1080
 kthread+0x2e9/0x3a0
 ret_from_fork+0x1f/0x30
 ...

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Xu Jia <xujia39@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-06-17 11:39:46 +01:00
..
6pack.c hamradio: 6pack: fix array-index-out-of-bounds in decode_std_command() 2022-06-17 11:39:46 +01:00
baycom_epp.c hamradio: Fix wrong assignment of 'bbc->cfg.loopback' 2022-03-16 19:17:49 -07:00
baycom_par.c hamradio: use ndo_siocdevprivate 2021-07-27 20:11:44 +01:00
baycom_ser_fdx.c hamradio: use ndo_siocdevprivate 2021-07-27 20:11:44 +01:00
baycom_ser_hdx.c hamradio: use ndo_siocdevprivate 2021-07-27 20:11:44 +01:00
bpqether.c hamradio: use dev_addr_set() for setting device address 2021-10-13 09:41:37 -07:00
hdlcdrv.c net: Don't include filter.h from net/sock.h 2021-12-29 08:48:14 -08:00
Kconfig net: hamradio: remove support for DMA SCC devices 2022-04-27 12:22:56 +01:00
Makefile net: hamradio: remove support for DMA SCC devices 2022-04-27 12:22:56 +01:00
mkiss.c TTY/Serial driver updates for 5.17-rc1 2022-01-12 11:21:52 -08:00
scc.c net: Don't include filter.h from net/sock.h 2021-12-29 08:48:14 -08:00
yam.c yam: fix a memory leak in yam_siocdevprivate() 2022-01-25 11:04:55 +00:00
z8530.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00