Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1643612 > unrolled thread

Re: drivers/net/hamradio: divide error in hdlcdrv_ioctl

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: drivers/net/hamradio: divide error in hdlcdrv_ioctl Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-05-17 22:10 +0200
    Re: drivers/net/hamradio: divide error in hdlcdrv_ioctl Andrey Konovalov <andreyknvl@google.com> - 2017-05-19 02:30 +0200

#1643612 — Re: drivers/net/hamradio: divide error in hdlcdrv_ioctl

On Tue, 16 May 2017 17:05:32 +0200
Andrey Konovalov <andreyknvl@google.com> wrote:

> Hi,
> 
> I've got the following error report while fuzzing the kernel with syzkaller.
> 
> On commit 2ea659a9ef488125eb46da6eb571de5eae5c43f6 (4.12-rc1).
> 
> A reproducer and .config are attached.

This should fix it.

commit 37b3fa4b617681f00cfa1f76d6d7716cc6d9f79a
Author: Alan Cox <alan@llwyncelyn.cymru>
Date:   Wed May 17 21:04:27 2017 +0100

    hdlcdrv: Fix division by zero when bitrate is unset
    
    The code attempts to check for out of range calibration. What it forgets to do
    is check for the 0 bitrate case. As a result the range check itself oopses the
    kernel.
    
    Found by Andrey Konovalov using Syzkaller.
    
    Signed-off-by: Alan Cox <alan@linux.intel.com>

diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 8c3633c..9f34a48 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -576,7 +576,7 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 	case HDLCDRVCTL_CALIBRATE:
 		if(!capable(CAP_SYS_RAWIO))
 			return -EPERM;
-		if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+		if (!s->par.bitrate || bi.data.calibrate > INT_MAX / s->par.bitrate)
 			return -EINVAL;
 		s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
 		return 0;

[toc] | [next] | [standalone]

#1644965

On Wed, May 17, 2017 at 10:07 PM, Alan Cox <gnomes@lxorguk.ukuu.org.uk> wrote:
> On Tue, 16 May 2017 17:05:32 +0200
> Andrey Konovalov <andreyknvl@google.com> wrote:
>
>> Hi,
>>
>> I've got the following error report while fuzzing the kernel with syzkaller.
>>
>> On commit 2ea659a9ef488125eb46da6eb571de5eae5c43f6 (4.12-rc1).
>>
>> A reproducer and .config are attached.
>
> This should fix it.

Hi Alan,

Someone else has already sent a couple of versions of a similar fix.

https://patchwork.ozlabs.org/patch/763832/

Thanks!

>
> commit 37b3fa4b617681f00cfa1f76d6d7716cc6d9f79a
> Author: Alan Cox <alan@llwyncelyn.cymru>
> Date:   Wed May 17 21:04:27 2017 +0100
>
>     hdlcdrv: Fix division by zero when bitrate is unset
>
>     The code attempts to check for out of range calibration. What it forgets to do
>     is check for the 0 bitrate case. As a result the range check itself oopses the
>     kernel.
>
>     Found by Andrey Konovalov using Syzkaller.
>
>     Signed-off-by: Alan Cox <alan@linux.intel.com>
>
> diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
> index 8c3633c..9f34a48 100644
> --- a/drivers/net/hamradio/hdlcdrv.c
> +++ b/drivers/net/hamradio/hdlcdrv.c
> @@ -576,7 +576,7 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
>         case HDLCDRVCTL_CALIBRATE:
>                 if(!capable(CAP_SYS_RAWIO))
>                         return -EPERM;
> -               if (bi.data.calibrate > INT_MAX / s->par.bitrate)
> +               if (!s->par.bitrate || bi.data.calibrate > INT_MAX / s->par.bitrate)
>                         return -EINVAL;
>                 s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
>                 return 0;

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web