Patch "net/irda: handle iriap_register_lsap() allocation failure" has been added to the 4.4-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
net/irda: handle iriap_register_lsap() allocation failure
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-irda-handle-iriap_register_lsap-allocation-failure.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From foo@baz Wed Sep 21 12:45:10 CEST 2016
From: Vegard Nossum <[email protected]>
Date: Fri, 12 Aug 2016 10:29:13 +0200
Subject: net/irda: handle iriap_register_lsap() allocation failure
From: Vegard Nossum <[email protected]>
[ Upstream commit 5ba092efc7ddff040777ae7162f1d195f513571b ]
If iriap_register_lsap() fails to allocate memory, self->lsap is set to NULL. However, none of the callers handle the failure and irlmp_connect_request() will happily dereference it:
iriap_register_lsap: Unable to allocated LSAP!
================================================================================
UBSAN: Undefined behaviour in net/irda/irlmp.c:378:2
member access within null pointer of type 'struct lsap_cb'
CPU: 1 PID: 15403 Comm: trinity-c0 Not tainted 4.8.0-rc1+ #81
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org
04/01/2014
0000000000000000 ffff88010c7e78a8 ffffffff82344f40 0000000041b58ab3
ffffffff84f98000 ffffffff82344e94 ffff88010c7e78d0 ffff88010c7e7880
ffff88010630ad00 ffffffff84a5fae0 ffffffff84d3f5c0 000000000000017a
Call Trace:
[<ffffffff82344f40>] dump_stack+0xac/0xfc
[<ffffffff8242f5a8>] ubsan_epilogue+0xd/0x8a
[<ffffffff824302bf>] __ubsan_handle_type_mismatch+0x157/0x411
[<ffffffff83b7bdbc>] irlmp_connect_request+0x7ac/0x970
[<ffffffff83b77cc0>] iriap_connect_request+0xa0/0x160
[<ffffffff83b77f48>] state_s_disconnect+0x88/0xd0
[<ffffffff83b78904>] iriap_do_client_event+0x94/0x120
[<ffffffff83b77710>] iriap_getvaluebyclass_request+0x3e0/0x6d0
[<ffffffff83ba6ebb>] irda_find_lsap_sel+0x1eb/0x630
[<ffffffff83ba90c8>] irda_connect+0x828/0x12d0
[<ffffffff833c0dfb>] SYSC_connect+0x22b/0x340
[<ffffffff833c7e09>] SyS_connect+0x9/0x10
[<ffffffff81007bd3>] do_syscall_64+0x1b3/0x4b0
[<ffffffff845f946a>] entry_SYSCALL64_slow_path+0x25/0x25
================================================================================The bug seems to have been around since forever.
There's more problems with missing error checks in iriap_init() (and indeed all of irda_init()), but that's a bigger problem that needs very careful review and testing. This patch will fix the most serious bug (as it's easily reached from unprivileged userspace).
I have tested my patch with a reproducer.
--- net/irda/iriap.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/irda/iriap.c +6 -2
@@ -185,8 +185,12 @@ struct iriap_cb *iriap_open(__u8 slsap_s self->magic =IAS_MAGIC ; self->mode = mode; -if (mode ==IAS_CLIENT ) -iriap_register_lsap (self, slsap_sel, mode); +if (mode ==IAS_CLIENT ) { +if (iriap_register_lsap (self, slsap_sel, mode)) { +kfree (self); +return NULL ; + } + } self->confirm = callback; self->priv = priv;
Patches currently in stable-queue which might be from [email protected] are
queue-4.4/net-irda-handle-iriap_register_lsap-allocation-failure.patch queue-4.4/tipc-fix-null-pointer-dereference-in-shutdown.patch