AX.25: Fix out-of-bounds read in ax25_connect()
Checks on `addr_len` and `fsa->fsa_ax25.sax25_ndigis` are insufficient. ax25_connect() can go out of bounds when `fsa->fsa_ax25.sax25_ndigis` equals to 7 or 8. Fix it. This issue has been reported as a KMSAN uninit-value bug, because in such a case, ax25_connect() reaches into the uninitialized portion of the `struct sockaddr_storage` statically allocated in __sys_connect(). It is safe to remove `fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS` because `addr_len` is guaranteed to be less than or equal to `sizeof(struct full_sockaddr_ax25)`. Reported-by:<syzbot+c82752228ed975b0a623@syzkaller.appspotmail.com> Link: https://syzkaller.appspot.com/bug?id=55ef9d629f3b3d7d70b69558015b63b48d01af66 Signed-off-by:
Peilin Ye <yepeilin.cs@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
parent
26cb7085
-
mentioned in commit 17ad73e9
-
mentioned in commit 253c17d9
-
mentioned in commit 0724acc5
-
mentioned in commit c1142de6
-
mentioned in commit f0965dc9
-
mentioned in commit b1cd0a68
-
mentioned in commit c8a826b2
-
mentioned in commit 9aaa5f94
-
mentioned in commit 15a9765c
-
mentioned in commit 2f1624fa
-
mentioned in commit 350cffdc
-
mentioned in commit bbf6af4a
-
mentioned in commit 2dadee3d
Please register or sign in to comment