Commit 69b06d30 authored by Oleksij Rempel's avatar Oleksij Rempel Committed by Zhang Changzhong
Browse files

can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_txtimer() 

mainline inclusion
from mainline-v5.9-rc2
commit cd3b3636
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4CE
CVE: CVE-2021-47232

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cd3b3636c99fcac52c598b64061f3fe4413c6a12



--------------------------------

The current stack implementation do not support ECTS requests of not
aligned TP sized blocks.

If ECTS will request a block with size and offset spanning two TP
blocks, this will cause memcpy() to read beyond the queued skb (which
does only contain one TP sized block).

Sometimes KASAN will detect this read if the memory region beyond the
skb was previously allocated and freed. In other situations it will stay
undetected. The ETP transfer in any case will be corrupted.

This patch adds a sanity check to avoid this kind of read and abort the
session with error J1939_XTP_ABORT_ECTS_TOO_BIG.

Reported-by: default avatar <syzbot+5322482fe520b02aea30@syzkaller.appspotmail.com>
Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
Cc: linux-stable <stable@vger.kernel.org> # >= v5.4
Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20200807105200.26441-3-o.rempel@pengutronix.de


Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parent 85ae3aec

net/can/j1939/transport.c

+15 −0
Original line number Diff line number Diff line
@@ -794,6 +794,18 @@ static int j1939_session_tx_dat(struct j1939_session *session) 
		if (len > 7)

			len = 7;



		if (offset + len > se_skb->len) {

			netdev_err_once(priv->ndev,

					"%s: 0x%p: requested data outside of queued buffer: offset %i, len %i, pkt.tx: %i\n",

					__func__, session, skcb->offset, se_skb->len , session->pkt.tx);

			return -EOVERFLOW;

		}



		if (!len) {

			ret = -ENOBUFS;

			break;

		}



		memcpy(&dat[1], &tpdat[offset], len);

		ret = j1939_tp_tx_dat(session, dat, len + 1);

		if (ret < 0) {
@@ -1127,6 +1139,9 @@ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer) 
		 * cleanup including propagation of the error to user space.

		 */

		break;

	case -EOVERFLOW:

		j1939_session_cancel(session, J1939_XTP_ABORT_ECTS_TOO_BIG);

		break;

	case 0:

		session->tx_retry = 0;

		break;