From acd8cecddf929c77cebfd3b71bbd82e64f102729 Mon Sep 17 00:00:00 2001 From: Hanumanth Reddy Pothula Date: Thu, 8 Sep 2016 13:45:01 +0530 Subject: qcacld-3.0: Fix out of bound issue in wlan_logging_proc_sock_rx_msg qcacld-2.0 to qcacld-3.0 propagation. Out of bound access is reported by kernel address sanitizer (KASAN) tool. ================================================================= BUG: KASAN: slab-out-of-bounds in memcpy+0x28/0x54 at addr ffffffc03f9b1f94 Read of size 1024 by task WifiLogger_app/662 ================================================================= page dumped because: kasan: bad access detected ----------------------------------------------------------------- [] dump_backtrace+0x0/0x284 [] show_stack+0x10/0x1c [] dump_stack+0x74/0xfc [] print_trailer+0x150/0x164 [] object_err+0x38/0x4c [] kasan_report+0x34c/0x504 [] __asan_loadN+0x20/0x14c [] memcpy+0x24/0x54 [] vos_mem_copy+0x68/0x7c [wlan] [] wlan_logging_proc_sock_rx_msg+0x39c/0x3f0 [wlan] [] nl_srv_rcv+0x1c0/0x218 [wlan] [] netlink_unicast+0x3b0/0x4c0 [] netlink_sendmsg+0xa2c/0xb30 [] sock_sendmsg+0x1d4/0x22c [] SyS_sendto+0x194/0x224 ================================================================ There is possibility of out of bound memory access, if user sends a netlink packet with message length greater than skb data_len. Don't process netlink packet if message length is greater than skb data_len. Change-Id: Ice6492aa191da0af3fe4fc9b58dfddcb2a59d6d0 CRs-Fixed: 975923 --- core/utils/logging/src/wlan_logging_sock_svc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/core/utils/logging/src/wlan_logging_sock_svc.c b/core/utils/logging/src/wlan_logging_sock_svc.c index 4396139f6c18..a3f45d18f09a 100644 --- a/core/utils/logging/src/wlan_logging_sock_svc.c +++ b/core/utils/logging/src/wlan_logging_sock_svc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved. + * Copyright (c) 2014-2017 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -887,6 +887,13 @@ static int wlan_logging_proc_sock_rx_msg(struct sk_buff *skb) return -EINVAL; } + if (wnl->wmsg.length > skb->data_len) { + LOGGING_TRACE(QDF_TRACE_LEVEL_ERROR, + "%s: invalid length msgLen:%x skb data_len:%x\n", + __func__, wnl->wmsg.length, skb->data_len); + return -EINVAL; + } + if (gapp_pid != INVALID_PID) { if (wnl->nlh.nlmsg_pid > gapp_pid) { gapp_pid = wnl->nlh.nlmsg_pid; -- cgit v1.2.3