Xiaolong Huang
9b7f1e7a60
isdn: cpai: check ctr->cnr to avoid array index out of bound
commit 1f3e2e97c0 upstream.
The cmtp_add_connection() would add a cmtp session to a controller
and run a kernel thread to process cmtp.
__module_get(THIS_MODULE);
session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d",
session->num);
During this process, the kernel thread would call detach_capi_ctr()
to detach a register controller. if the controller
was not attached yet, detach_capi_ctr() would
trigger an array-index-out-bounds bug.
[ 46.866069][ T6479] UBSAN: array-index-out-of-bounds in
drivers/isdn/capi/kcapi.c:483:21
[ 46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]'
[ 46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted
5.15.0-rc2+ #8
[ 46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.14.0-2 04/01/2014
[ 46.870107][ T6479] Call Trace:
[ 46.870473][ T6479] dump_stack_lvl+0x57/0x7d
[ 46.870974][ T6479] ubsan_epilogue+0x5/0x40
[ 46.871458][ T6479] __ubsan_handle_out_of_bounds.cold+0x43/0x48
[ 46.872135][ T6479] detach_capi_ctr+0x64/0xc0
[ 46.872639][ T6479] cmtp_session+0x5c8/0x5d0
[ 46.873131][ T6479] ? __init_waitqueue_head+0x60/0x60
[ 46.873712][ T6479] ? cmtp_add_msgpart+0x120/0x120
[ 46.874256][ T6479] kthread+0x147/0x170
[ 46.874709][ T6479] ? set_kthread_struct+0x40/0x40
[ 46.875248][ T6479] ret_from_fork+0x1f/0x30
[ 46.875773][ T6479]
Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211008065830.305057-1-butterflyhuangxx@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-16 12:01:30 +09:00
..
2023-05-16 11:41:51 +09:00
2023-05-16 10:37:49 +09:00
2023-05-16 09:46:39 +09:00
2023-05-16 12:01:07 +09:00
2023-05-16 11:25:37 +09:00
2023-05-16 11:52:24 +09:00
2023-05-16 11:44:50 +09:00
2023-05-16 11:43:11 +09:00
2023-05-16 11:25:48 +09:00
2023-05-16 11:02:09 +09:00
2023-05-16 11:05:40 +09:00
2023-05-16 11:27:25 +09:00
2023-05-16 11:44:57 +09:00
2023-05-16 10:37:41 +09:00
2023-05-16 11:53:41 +09:00
2023-05-15 17:34:06 +09:00
2023-05-16 11:52:26 +09:00
2023-05-16 09:14:54 +09:00
2023-05-16 11:52:41 +09:00
2023-05-16 11:54:02 +09:00
2023-05-16 11:24:53 +09:00
2023-05-16 10:50:08 +09:00
2023-05-16 12:00:48 +09:00
2023-05-16 11:26:47 +09:00
2023-05-16 12:01:09 +09:00
2023-05-16 12:00:34 +09:00
2023-05-16 11:02:44 +09:00
2023-05-16 11:02:24 +09:00
2023-05-16 11:53:47 +09:00
2023-05-16 10:53:58 +09:00
2023-05-16 11:44:46 +09:00
2023-05-16 09:04:57 +09:00
2023-05-16 12:00:57 +09:00
2023-05-16 11:42:47 +09:00
2023-05-16 12:00:49 +09:00
2023-05-16 11:34:38 +09:00
2023-05-16 11:53:57 +09:00
2023-05-16 09:58:09 +09:00
2023-05-16 12:01:30 +09:00
2023-05-16 11:24:56 +09:00
2023-05-15 17:34:39 +09:00
2023-05-16 11:53:10 +09:00
2023-05-16 11:26:12 +09:00
2023-05-16 11:45:11 +09:00
2023-05-16 11:27:51 +09:00
2023-05-16 09:57:42 +09:00
2023-05-16 09:45:15 +09:00
2023-05-16 11:46:58 +09:00
2023-05-16 12:00:45 +09:00
2023-05-16 11:46:15 +09:00
2023-05-16 11:47:04 +09:00
2023-05-16 12:01:19 +09:00
2023-05-16 11:35:07 +09:00
2023-05-16 09:39:21 +09:00
2023-05-16 10:38:48 +09:00
2023-05-16 11:43:31 +09:00
2023-05-16 12:00:53 +09:00
2023-05-16 11:24:47 +09:00
2023-05-16 11:52:39 +09:00
2023-05-16 11:46:21 +09:00
2023-05-16 11:45:26 +09:00
2023-05-16 11:36:00 +09:00
2023-05-16 11:24:50 +09:00
2023-05-16 11:45:22 +09:00
2023-05-16 11:46:34 +09:00
2023-05-16 11:45:07 +09:00
2023-05-16 09:46:33 +09:00
2023-05-16 09:58:13 +09:00
2023-05-16 12:00:25 +09:00
2023-05-16 11:52:37 +09:00
2023-05-16 11:05:25 +09:00
2023-05-16 11:23:19 +09:00
2023-05-16 10:35:30 +09:00
2023-05-16 11:33:29 +09:00
2023-05-16 11:45:00 +09:00
2023-05-16 11:26:42 +09:00
2023-05-16 12:00:39 +09:00
2023-05-16 11:44:21 +09:00
2023-05-16 11:53:33 +09:00
2023-05-16 11:22:54 +09:00
2023-05-16 11:53:04 +09:00
2023-05-16 11:34:08 +09:00
2023-05-16 09:46:44 +09:00
2023-05-16 11:52:31 +09:00
2023-05-16 11:53:38 +09:00
2023-05-16 08:31:00 +09:00
2023-05-16 12:00:51 +09:00
2023-05-16 11:45:19 +09:00
2023-05-16 11:42:53 +09:00
2023-05-16 11:45:48 +09:00
2023-05-16 09:38:07 +09:00
2023-05-16 11:42:52 +09:00
2023-05-15 16:59:11 +09:00
2023-05-16 09:45:14 +09:00
2023-05-16 11:27:31 +09:00
2023-05-16 11:41:58 +09:00