Commit 735929cf authored Jun 30, 2020 by Dan Carpenter Committed by Greg Kroah-Hartman Jul 16, 2020

net: qrtr: Fix an out of bounds read qrtr_endpoint_post()

commit 8ff41cc21714704ef0158a546c3c4d07fae2c952 upstream.

This code assumes that the user passed in enough data for a
qrtr_hdr_v1 or qrtr_hdr_v2 struct, but it's not necessarily true. If
the buffer is too small then it will read beyond the end.

Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reported-by: <syzbot+b8fe393f999a291a9ea6@syzkaller.appspotmail.com>
Fixes: 194ccc88 ("net: qrtr: Support decoding incoming v2 packets")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent fa4a80a1

net/qrtr/qrtr.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -266,7 +266,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint ep, const void data, size_t len)
		unsigned int ver;
		size_t hdrlen;

		if (len & 3)
		if (len == 0 \|\| len & 3)
		return -EINVAL;

		skb = netdev_alloc_skb(NULL, len);
		@@ -280,6 +280,8 @@ int qrtr_endpoint_post(struct qrtr_endpoint ep, const void data, size_t len)

		switch (ver) {
		case QRTR_PROTO_VER_1:
		if (len < sizeof(*v1))
		goto err;
		v1 = data;
		hdrlen = sizeof(*v1);

		@@ -293,6 +295,8 @@ int qrtr_endpoint_post(struct qrtr_endpoint ep, const void data, size_t len)
		size = le32_to_cpu(v1->size);
		break;
		case QRTR_PROTO_VER_2:
		if (len < sizeof(*v2))
		goto err;
		v2 = data;
		hdrlen = sizeof(*v2) + v2->optlen;