In ca8210_skb_rx(), data_ind is read at offsets 22 (msdulen), 23
(mpdulinkquality), 29 + msdulen (hdr.sec.level), 30..39 + msdulen
(security header), and 29 .. 29 + msdulen (payload) without verifying
that the received SPI frame length len covers those offsets, causing an
out-of-bounds read when msdulen exceeds len - 30:
BUG: KASAN: slab-out-of-bounds in ca8210_skb_rx.constprop.0.isra.0+0x137/0x160
Read of size 64 at addr ffff888006453ddd by task init/1
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
kasan_check_range+0x125/0x200
__asan_memcpy+0x23/0x60
ca8210_skb_rx.constprop.0.isra.0+0x137/0x160
ca8210_net_rx+0x96/0xc0
...
The buggy address belongs to the object at ffff888006453dc0
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 29 bytes inside of
allocated 32-byte region [ffff888006453dc0, ffff888006453de0)
Consolidate all length and msdulen validations into a single upfront check
at the beginning of ca8210_skb_rx() before allocating the skb.
Tested in QEMU with KASAN enabled by passing a short data_ind buffer with
msdulen = 64 and len = 30 into ca8210_skb_rx().
Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
---
Changes in v2:
- Split out as patch 3/3.
- Consolidated all length checks in ca8210_skb_rx() into a single place
at the beginning of the function before dev_alloc_skb() and dropped the
unrelated hdr.seq assignment as requested by Miquel Raynal.
drivers/net/ieee802154/ca8210.c | 32 ++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 1de6314..2aa7d8c 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -1759,19 +1759,15 @@ static int ca8210_skb_rx(
u8 *data_ind
)
{
- struct ieee802154_hdr hdr;
+ struct ieee802154_hdr hdr = { };
int msdulen;
int hlen;
- u8 mpdulinkquality = data_ind[23];
+ u8 mpdulinkquality;
struct sk_buff *skb;
struct ca8210_priv *priv = hw->priv;
- /* Allocate mtu size buffer for every rx packet */
- skb = dev_alloc_skb(IEEE802154_MTU + sizeof(hdr));
- if (!skb)
- return -ENOMEM;
-
- skb_reserve(skb, sizeof(hdr));
+ if (len < 30)
+ return -EMSGSIZE;
msdulen = data_ind[22]; /* msdu_length */
if (msdulen > IEEE802154_MTU) {
@@ -1779,9 +1775,25 @@ static int ca8210_skb_rx(
&priv->spi->dev,
"received erroneously large msdu length!\n"
);
- kfree_skb(skb);
return -EMSGSIZE;
}
+
+ if (len < 30 + msdulen ||
+ (!priv->promiscuous && data_ind[29 + msdulen] > 0 &&
+ len < 29 + msdulen + sizeof(struct secspec))) {
+ dev_err(&priv->spi->dev,
+ "received truncated data indication!\n");
+ return -EMSGSIZE;
+ }
+
+ mpdulinkquality = data_ind[23];
+
+ /* Allocate mtu size buffer for every rx packet */
+ skb = dev_alloc_skb(IEEE802154_MTU + sizeof(hdr));
+ if (!skb)
+ return -ENOMEM;
+
+ skb_reserve(skb, sizeof(hdr));
dev_dbg(&priv->spi->dev, "skb buffer length = %d\n", msdulen);
if (priv->promiscuous)
--
2.47.3
