linux/net/qrtr/tun.c
Sabyrzhan Tasbolatov b55528a18e net/qrtr: restrict user-controlled length in qrtr_tun_write_iter()
commit 2a80c15812372e554474b1dba0b1d8e467af295d upstream.

syzbot found WARNING in qrtr_tun_write_iter [1] when write_iter length
exceeds KMALLOC_MAX_SIZE causing order >= MAX_ORDER condition.

Additionally, there is no check for 0 length write.

[1]
WARNING: mm/page_alloc.c:5011
[..]
Call Trace:
 alloc_pages_current+0x18c/0x2a0 mm/mempolicy.c:2267
 alloc_pages include/linux/gfp.h:547 [inline]
 kmalloc_order+0x2e/0xb0 mm/slab_common.c:837
 kmalloc_order_trace+0x14/0x120 mm/slab_common.c:853
 kmalloc include/linux/slab.h:557 [inline]
 kzalloc include/linux/slab.h:682 [inline]
 qrtr_tun_write_iter+0x8a/0x180 net/qrtr/tun.c:83
 call_write_iter include/linux/fs.h:1901 [inline]

Reported-by: syzbot+c2a7e5c5211605a90865@syzkaller.appspotmail.com
Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
Link: https://lore.kernel.org/r/20210202092059.1361381-1-snovitoll@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-17 10:35:19 +01:00

171 lines
3.4 KiB
C

// SPDX-License-Identifier: GPL-2.0
/* Copyright (c) 2018, Linaro Ltd */
#include <linux/miscdevice.h>
#include <linux/module.h>
#include <linux/poll.h>
#include <linux/skbuff.h>
#include <linux/uaccess.h>
#include "qrtr.h"
struct qrtr_tun {
struct qrtr_endpoint ep;
struct sk_buff_head queue;
wait_queue_head_t readq;
};
static int qrtr_tun_send(struct qrtr_endpoint *ep, struct sk_buff *skb)
{
struct qrtr_tun *tun = container_of(ep, struct qrtr_tun, ep);
skb_queue_tail(&tun->queue, skb);
/* wake up any blocking processes, waiting for new data */
wake_up_interruptible(&tun->readq);
return 0;
}
static int qrtr_tun_open(struct inode *inode, struct file *filp)
{
struct qrtr_tun *tun;
tun = kzalloc(sizeof(*tun), GFP_KERNEL);
if (!tun)
return -ENOMEM;
skb_queue_head_init(&tun->queue);
init_waitqueue_head(&tun->readq);
tun->ep.xmit = qrtr_tun_send;
filp->private_data = tun;
return qrtr_endpoint_register(&tun->ep, QRTR_EP_NID_AUTO);
}
static ssize_t qrtr_tun_read_iter(struct kiocb *iocb, struct iov_iter *to)
{
struct file *filp = iocb->ki_filp;
struct qrtr_tun *tun = filp->private_data;
struct sk_buff *skb;
int count;
while (!(skb = skb_dequeue(&tun->queue))) {
if (filp->f_flags & O_NONBLOCK)
return -EAGAIN;
/* Wait until we get data or the endpoint goes away */
if (wait_event_interruptible(tun->readq,
!skb_queue_empty(&tun->queue)))
return -ERESTARTSYS;
}
count = min_t(size_t, iov_iter_count(to), skb->len);
if (copy_to_iter(skb->data, count, to) != count)
count = -EFAULT;
kfree_skb(skb);
return count;
}
static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from)
{
struct file *filp = iocb->ki_filp;
struct qrtr_tun *tun = filp->private_data;
size_t len = iov_iter_count(from);
ssize_t ret;
void *kbuf;
if (!len)
return -EINVAL;
if (len > KMALLOC_MAX_SIZE)
return -ENOMEM;
kbuf = kzalloc(len, GFP_KERNEL);
if (!kbuf)
return -ENOMEM;
if (!copy_from_iter_full(kbuf, len, from)) {
kfree(kbuf);
return -EFAULT;
}
ret = qrtr_endpoint_post(&tun->ep, kbuf, len);
kfree(kbuf);
return ret < 0 ? ret : len;
}
static __poll_t qrtr_tun_poll(struct file *filp, poll_table *wait)
{
struct qrtr_tun *tun = filp->private_data;
__poll_t mask = 0;
poll_wait(filp, &tun->readq, wait);
if (!skb_queue_empty(&tun->queue))
mask |= EPOLLIN | EPOLLRDNORM;
return mask;
}
static int qrtr_tun_release(struct inode *inode, struct file *filp)
{
struct qrtr_tun *tun = filp->private_data;
struct sk_buff *skb;
qrtr_endpoint_unregister(&tun->ep);
/* Discard all SKBs */
while (!skb_queue_empty(&tun->queue)) {
skb = skb_dequeue(&tun->queue);
kfree_skb(skb);
}
kfree(tun);
return 0;
}
static const struct file_operations qrtr_tun_ops = {
.owner = THIS_MODULE,
.open = qrtr_tun_open,
.poll = qrtr_tun_poll,
.read_iter = qrtr_tun_read_iter,
.write_iter = qrtr_tun_write_iter,
.release = qrtr_tun_release,
};
static struct miscdevice qrtr_tun_miscdev = {
MISC_DYNAMIC_MINOR,
"qrtr-tun",
&qrtr_tun_ops,
};
static int __init qrtr_tun_init(void)
{
int ret;
ret = misc_register(&qrtr_tun_miscdev);
if (ret)
pr_err("failed to register Qualcomm IPC Router tun device\n");
return ret;
}
static void __exit qrtr_tun_exit(void)
{
misc_deregister(&qrtr_tun_miscdev);
}
module_init(qrtr_tun_init);
module_exit(qrtr_tun_exit);
MODULE_DESCRIPTION("Qualcomm IPC Router TUN device");
MODULE_LICENSE("GPL v2");