Wang Hai
89a0079049
kobject: Fix slab-out-of-bounds in fill_kobj_path()
...
[ Upstream commit 3bb2a01caa ]
In kobject_get_path(), if kobj->name is changed between calls
get_kobj_path_length() and fill_kobj_path() and the length becomes
longer, then fill_kobj_path() will have an out-of-bounds bug.
The actual current problem occurs when the ixgbe probe.
In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name
length becomes longer, out-of-bounds will occur.
cpu0 cpu1
ixgbe_probe
register_netdev(netdev)
netdev_register_kobject
device_add
kobject_uevent // Sending ADD events
systemd-udevd // rename netdev
dev_change_name
device_rename
kobject_rename
ixgbe_mii_bus_init |
mdiobus_register |
__mdiobus_register |
device_register |
device_add |
kobject_uevent |
kobject_get_path |
len = get_kobj_path_length // old name |
path = kzalloc(len, gfp_mask); |
kobj->name = name;
/* name length becomes
* longer
*/
fill_kobj_path /* kobj path length is
* longer than path,
* resulting in out of
* bounds when filling path
*/
This is the kasan report:
==================================================================
BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0
Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673
Workqueue: events work_for_cpu_fn
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x48
print_address_description.constprop.0+0x86/0x1e7
print_report+0x36/0x4f
kasan_report+0xad/0x130
kasan_check_range+0x35/0x1c0
memcpy+0x39/0x60
fill_kobj_path+0x50/0xc0
kobject_get_path+0x5a/0xc0
kobject_uevent_env+0x140/0x460
device_add+0x5c7/0x910
__mdiobus_register+0x14e/0x490
ixgbe_probe.cold+0x441/0x574 [ixgbe]
local_pci_probe+0x78/0xc0
work_for_cpu_fn+0x26/0x40
process_one_work+0x3b6/0x6a0
worker_thread+0x368/0x520
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
This reproducer triggers that bug:
while:
do
rmmod ixgbe
sleep 0.5
modprobe ixgbe
sleep 0.5
When calling fill_kobj_path() to fill path, if the name length of
kobj becomes longer, return failure and retry. This fixes the problem.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Wang Hai <wanghai38@huawei.com >
Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
Signed-off-by: Sasha Levin <sashal@kernel.org >
2023-03-10 09:39:35 +01:00
..
2020-08-10 01:32:59 +09:00
2022-09-05 10:30:03 +02:00
2022-05-18 10:26:49 +02:00
2022-12-31 13:14:02 +01:00
2022-06-09 10:22:53 +02:00
2022-08-17 14:24:03 +02:00
2022-04-13 20:59:21 +02:00
2020-12-15 22:46:19 -08:00
2021-09-08 11:50:26 -07:00
2023-03-10 09:39:09 +01:00
2021-07-08 11:48:20 -07:00
2022-04-08 14:23:56 +02:00
2021-07-08 11:48:20 -07:00
2022-12-02 17:41:08 +01:00
2021-11-18 19:16:17 +01:00
2020-08-10 01:32:59 +09:00
2020-12-29 15:36:49 -08:00
2021-09-24 16:13:35 -07:00
2021-07-01 11:06:05 -07:00
2021-05-02 00:43:35 +09:00
2018-06-12 16:19:22 -07:00
2019-05-24 17:39:02 +02:00
2019-05-24 17:39:02 +02:00
2020-11-18 14:15:17 -06:00
2021-07-08 11:48:20 -07:00
2022-06-06 08:43:37 +02:00
2019-05-30 11:26:32 -07:00
2021-05-26 13:20:50 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2021-05-06 19:24:12 -07:00
2020-10-16 13:25:14 -06:00
2021-08-13 10:27:50 +02:00
2019-05-21 10:50:45 +02:00
2021-09-14 13:23:22 -07:00
2020-06-11 15:14:53 +02:00
2019-06-05 17:37:16 +02:00
2018-08-16 12:14:42 -07:00
2021-04-01 09:54:37 +01:00
2019-05-24 17:27:11 +02:00
2021-07-08 11:48:22 -07:00
2018-11-30 07:22:05 +01:00
2017-11-02 11:10:55 +01:00
2020-08-20 15:45:14 -04:00
2019-06-19 17:09:55 +02:00
2017-11-02 11:10:55 +01:00
2021-06-23 16:41:41 -06:00
2021-05-05 16:07:40 +02:00
2019-05-24 17:39:02 +02:00
2017-11-02 11:10:55 +01:00
2019-10-18 15:01:57 +02:00
2021-02-05 23:28:29 +01:00
2019-06-19 17:09:06 +02:00
2021-01-21 14:06:00 -07:00
2021-05-06 19:24:12 -07:00
2019-06-19 17:09:06 +02:00
2020-10-16 11:11:20 -07:00
2018-07-27 19:04:33 +08:00
2020-11-02 12:14:19 -08:00
2021-06-05 08:58:12 -07:00
2019-06-19 17:09:06 +02:00
2019-06-19 17:09:06 +02:00
2020-06-18 17:26:43 +10:00
2017-11-02 11:10:55 +01:00
2021-08-19 09:02:55 +09:00
2021-06-22 13:56:43 +02:00
2022-12-31 13:14:01 +01:00
2018-06-12 23:33:24 +02:00
2021-07-01 11:06:05 -07:00
2020-01-31 10:30:40 -08:00
2021-07-01 11:06:06 -07:00
2021-05-06 19:24:12 -07:00
2021-07-01 11:06:06 -07:00
2021-11-18 19:16:17 +01:00
2021-07-01 11:06:05 -07:00
2020-07-31 11:49:08 +02:00
2021-08-13 14:09:32 -10:00
2021-07-08 11:48:20 -07:00
2020-11-20 14:45:33 +11:00
2021-09-08 11:50:26 -07:00
2022-10-26 12:35:08 +02:00
2020-10-16 11:11:20 -07:00
2021-04-16 16:10:37 -07:00
2023-03-10 09:39:33 +01:00
2020-12-15 22:46:19 -08:00
2020-12-15 22:46:15 -08:00
2021-01-03 20:05:18 -05:00
2020-10-16 11:11:22 -07:00
2020-04-15 21:36:41 +01:00
2020-01-08 16:59:19 +00:00
2014-04-30 19:49:37 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2019-06-05 17:36:38 +02:00
2021-05-06 19:24:12 -07:00
2020-06-04 19:06:25 -07:00
2018-07-27 19:04:33 +08:00
2018-12-29 11:36:44 -08:00
2021-05-06 19:24:12 -07:00
2019-10-14 15:04:00 -07:00
2020-11-18 14:15:17 -06:00
2017-02-24 17:46:57 -08:00
2022-05-09 09:14:30 +02:00
2019-05-13 11:07:33 +02:00
2022-07-12 16:35:18 +02:00
2017-11-02 11:10:55 +01:00
2019-05-21 10:50:45 +02:00
2019-05-21 10:50:45 +02:00
2019-06-19 17:09:56 +02:00
2020-08-14 19:56:57 -07:00
2018-05-09 06:55:44 +02:00
2022-08-17 14:22:51 +02:00
2019-02-19 20:52:19 -07:00
2019-05-30 11:26:32 -07:00
2019-05-24 17:27:11 +02:00
2021-08-19 09:02:55 +09:00
2022-06-22 14:22:03 +02:00
2023-02-25 12:06:46 +01:00
2021-09-24 16:13:34 -07:00
2021-07-20 13:49:44 -07:00
2021-11-12 15:05:49 +01:00
2020-09-28 12:14:08 +01:00
2022-04-13 20:59:27 +02:00
2021-07-08 11:48:20 -07:00
2019-06-19 17:09:08 +02:00
2021-04-10 11:09:41 +02:00
2023-03-10 09:39:35 +01:00
2021-07-02 12:08:10 -07:00
2021-05-19 15:05:11 +02:00
2020-10-16 11:11:19 -07:00
2021-08-13 18:37:38 +02:00
2022-08-25 11:40:40 +02:00
2021-07-08 11:48:20 -07:00
2022-06-09 10:23:31 +02:00
2019-06-05 17:37:06 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2021-06-22 16:42:08 +02:00
2023-02-01 08:27:19 +01:00
2022-04-13 20:58:59 +02:00
2021-02-17 17:31:06 -06:00
2021-04-16 16:10:37 -07:00
2019-05-24 17:39:02 +02:00
2022-06-22 14:22:03 +02:00
2018-10-16 13:45:44 +02:00
2022-06-22 14:22:03 +02:00
2019-05-21 10:50:45 +02:00
2020-09-26 10:33:57 -07:00
2017-11-02 11:10:55 +01:00
2019-05-24 17:39:02 +02:00
2017-11-02 11:10:55 +01:00
2019-05-21 10:50:45 +02:00
2023-02-01 08:27:26 +01:00
2021-11-25 09:48:45 +01:00
2022-06-14 18:36:24 +02:00
2022-12-31 13:14:03 +01:00
2017-11-02 11:10:55 +01:00
2020-02-16 18:33:00 -08:00
2019-05-21 10:50:45 +02:00
2021-07-08 11:48:20 -07:00
2022-10-26 12:34:49 +02:00
2021-09-17 13:52:17 +01:00
2021-04-16 16:10:37 -07:00
2021-07-01 11:06:05 -07:00
2021-09-19 17:13:35 -07:00
2021-05-06 19:24:12 -07:00
2019-05-21 10:50:45 +02:00
2022-06-06 08:43:36 +02:00
2019-05-21 11:28:45 +02:00
2019-05-21 10:50:45 +02:00
2021-04-16 16:10:37 -07:00
2022-05-30 09:29:10 +02:00
2022-08-31 17:16:43 +02:00
2019-09-25 17:51:39 -07:00
2020-08-12 10:58:00 -07:00
2021-07-08 11:48:20 -07:00
2021-07-08 11:48:20 -07:00
2021-07-08 11:48:20 -07:00
2021-09-03 10:08:28 -07:00
2021-07-08 11:48:20 -07:00
2021-08-24 19:52:40 -03:00
2019-08-08 07:45:01 -06:00
2022-05-30 09:28:59 +02:00
2019-09-24 15:54:09 -07:00
2022-05-30 09:29:15 +02:00
2021-06-29 10:53:46 -07:00
2022-08-17 14:24:08 +02:00
2021-07-08 11:48:20 -07:00
2022-04-13 20:59:28 +02:00
2019-05-30 11:26:32 -07:00
2021-11-21 13:44:12 +01:00
2021-08-30 07:50:56 -07:00
2020-11-19 11:56:16 -08:00
2020-05-01 12:35:21 +10:00
2021-06-18 11:43:09 +02:00
2021-08-13 10:27:49 +02:00
2021-07-08 11:48:20 -07:00
2020-08-12 10:58:00 -07:00
2019-07-01 19:34:46 -07:00
2022-08-17 14:23:23 +02:00
2019-05-21 10:50:45 +02:00
2022-12-31 13:14:29 +01:00
2021-01-18 11:03:26 +01:00
2020-12-15 22:46:16 -08:00
2019-05-21 10:50:45 +02:00
2018-11-30 12:13:15 -08:00
2021-07-01 11:06:03 -07:00
2022-08-17 14:23:43 +02:00
2018-10-15 16:31:29 -04:00
2021-09-03 09:58:15 -07:00
2022-08-17 14:23:05 +02:00
2022-04-08 14:23:54 +02:00
2020-05-08 18:18:12 +01:00
2021-06-25 11:31:03 -06:00
2022-04-08 14:24:01 +02:00
2018-10-16 13:45:44 +02:00
2022-01-27 11:05:44 +01:00
2020-03-06 11:56:59 +01:00
2019-05-21 10:50:45 +02:00
2020-06-15 13:32:11 -07:00
2022-12-31 13:14:33 +01:00
2017-02-26 11:03:38 -05:00
2021-09-08 12:55:35 -07:00
2021-03-24 15:16:09 -07:00
2021-09-06 11:04:03 -07:00
2017-01-09 13:58:57 -05:00
2021-09-08 11:50:26 -07:00
2021-08-22 00:21:36 -07:00
2019-06-05 17:36:37 +02:00
2019-06-05 17:36:37 +02:00
2021-07-01 11:06:05 -07:00
2019-04-08 16:44:21 -06:00
2020-10-16 11:11:20 -07:00
2022-04-13 20:59:27 +02:00
2019-10-16 14:56:21 +02:00
2017-07-21 09:38:30 +02:00
2021-09-03 09:58:14 -07:00
2022-04-08 14:24:09 +02:00
2015-09-10 13:29:01 -07:00
2021-07-19 11:39:28 +02:00
2019-10-03 12:12:23 -04:00
2021-02-17 14:08:01 +01:00
2020-08-12 10:58:00 -07:00
2020-11-18 14:15:17 -06:00
2020-04-07 10:43:43 -07:00
2023-02-01 08:27:22 +01:00
2021-02-05 11:03:47 -08:00
2019-05-24 17:39:02 +02:00
2018-06-07 17:34:39 -07:00
2023-02-25 12:06:44 +01:00
2020-03-23 17:01:47 +01:00
2022-05-30 09:29:10 +02:00
2017-11-02 11:10:55 +01:00
2022-04-08 14:24:09 +02:00
2020-08-12 10:58:00 -07:00