Hi, syzbot found a KASAN/UBSAN out of bounds report in the LLC connection state machine, and has now bisected a reproducer for it:
https://lore.kernel.org/all/[email protected] BUG: KASAN: global-out-of-bounds in llc_qualify_conn_ev net/llc/llc_conn.c:394 The buggy address belongs to the variable: llc_temp_state_transitions+0x58/0x60 UBSAN: array-index-out-of-bounds in net/llc/llc_conn.c:681:8 index -1 is out of range for type 'int[12][5]' llc_conn_state_table[] and llc_offset_table[] are indexed with "llc->state - 1" because connection states are 1-based, and LLC_CONN_OUT_OF_SVC is 0, so a connection in that pseudo state indexes both tables with -1. Add bounds checking, regularize connect(2) errno, and add KUnit tests for it all. See the respective patches for way more details. :) While I did build testing and convinced myself that the KUnit tests (which pass only with the fixes applied) are sensible, I would like more eyes on these changes, as I'm not entirely sure the best way to test them in the real world. Note that this collides with proposed patch[1] which also noted we needed to do better sanity checking of llc->state in llc_conn_service(). Since this check is needed in llc_conn_state_process() as well, I made it a common function and did other work of keeping the sizes of things double-checked with static asserts. -Kees [1] https://lore.kernel.org/all/8fa3c9e6d5dcf328979ed2bdc27817c11a5eff91.1787752861.git.zih...@nebusec.ai/ Kees Cook (3): llc: do not run the state machine on out of service connections llc: report a closed connection for out of service sockets llc: add KUnit tests for the connection state machine bounds net/llc/Kconfig | 14 ++++ include/net/llc_c_st.h | 2 +- net/llc/llc_conn.c | 42 ++++++++++- net/llc/llc_if.c | 12 ++- net/llc/tests/conn_kunit.c | 146 +++++++++++++++++++++++++++++++++++++ 5 files changed, 213 insertions(+), 3 deletions(-) create mode 100644 net/llc/tests/conn_kunit.c -- 2.34.1
