Oliver Hartkopp 7b53d2204c can: isotp: fix potential CAN frame reception race in isotp_rcv() ... commit 7c759040c1 upstream. When receiving a CAN frame the current code logic does not consider concurrently receiving processes which do not show up in real world usage. Ziyang Xuan writes: The following syz problem is one of the scenarios. so->rx.len is changed by isotp_rcv_ff() during isotp_rcv_cf(), so->rx.len equals 0 before alloc_skb() and equals 4096 after alloc_skb(). That will trigger skb_over_panic() in skb_put(). ======================================================= CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0 RIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113 Call Trace: <TASK> skb_over_panic net/core/skbuff.c:118 [inline] skb_put.cold+0x24/0x24 net/core/skbuff.c:1990 isotp_rcv_cf net/can/isotp.c:570 [inline] isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635 can_receive+0x31d/0x580 net/can/af_can.c:665 can_rcv+0x120/0x1c0 net/can/af_can.c:696 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579 Therefore we make sure the state changes and data structures stay consistent at CAN frame reception time by adding a spin_lock in isotp_rcv(). This fixes the issue reported by syzkaller but does not affect real world operation. Fixes: e057dd3fc2 ("can: add ISO 15765-2:2016 transport protocol") Link: https://lore.kernel.org/linux-can/d7e69278-d741-c706-65e1-e87623d9a8e8@huawei.com/T/ Link: https://lore.kernel.org/all/20220208200026.13783-1-socketcan@hartkopp.net Cc: stable@vger.kernel.org Reported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com Reported-by: Ziyang Xuan <william.xuanziyang@huawei.com> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-02-16 12:54:16 +01:00
..
j1939	can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM	2021-12-08 09:03:17 +01:00
af_can.c	net: introduce CAN specific pointer in the struct net_device	2021-04-07 15:00:07 +02:00
af_can.h	can: introduce CAN midlayer private and allocate it automatically	2019-09-04 13:29:14 +02:00
bcm.c	can: bcm: delay release of struct bcm_op after synchronize_rcu()	2021-07-14 16:55:41 +02:00
gw.c	can: gw: synchronize rcu operations before removing gw job entry	2021-07-14 16:55:41 +02:00
isotp.c	can: isotp: fix potential CAN frame reception race in isotp_rcv()	2022-02-16 12:54:16 +01:00
Kconfig	can: isotp: Explain PDU in CAN_ISOTP help text	2020-11-03 22:30:31 +01:00
Makefile	can: add ISO 15765-2:2016 transport protocol	2020-10-07 23:18:33 +02:00
proc.c	net: introduce CAN specific pointer in the struct net_device	2021-04-07 15:00:07 +02:00
raw.c	can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF	2021-08-04 12:46:40 +02:00