• Taehee Yoo's avatar
    netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init() · 6fb8852b
    Taehee Yoo authored
    When netdevsim dev is being created, a debugfs directory is created.
    The variable "dev_ddir_name" is 16bytes device name pointer and device
    name is "netdevsim<dev id>".
    The maximum dev id length is 10.
    So, 16bytes for device name isn't enough.
    
    Test commands:
        modprobe netdevsim
        echo "1000000000 0" > /sys/bus/netdevsim/new_device
    
    Splat looks like:
    [  249.622710][  T900] BUG: KASAN: stack-out-of-bounds in number+0x824/0x880
    [  249.623658][  T900] Write of size 1 at addr ffff88804c527988 by task bash/900
    [  249.624521][  T900]
    [  249.624830][  T900] CPU: 1 PID: 900 Comm: bash Not tainted 5.5.0+ #322
    [  249.625691][  T900] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
    [  249.626712][  T900] Call Trace:
    [  249.627103][  T900]  dump_stack+0x96/0xdb
    [  249.627639][  T900]  ? number+0x824/0x880
    [  249.628173][  T900]  print_address_description.constprop.5+0x1be/0x360
    [  249.629022][  T900]  ? number+0x824/0x880
    [  249.629569][  T900]  ? number+0x824/0x880
    [  249.630105][  T900]  __kasan_report+0x12a/0x170
    [  249.630717][  T900]  ? number+0x824/0x880
    [  249.631201][  T900]  kasan_report+0xe/0x20
    [  249.631723][  T900]  number+0x824/0x880
    [  249.632235][  T900]  ? put_dec+0xa0/0xa0
    [  249.632716][  T900]  ? rcu_read_lock_sched_held+0x90/0xc0
    [  249.633392][  T900]  vsnprintf+0x63c/0x10b0
    [  249.633983][  T900]  ? pointer+0x5b0/0x5b0
    [  249.634543][  T900]  ? mark_lock+0x11d/0xc40
    [  249.635200][  T900]  sprintf+0x9b/0xd0
    [  249.635750][  T900]  ? scnprintf+0xe0/0xe0
    [  249.636370][  T900]  nsim_dev_probe+0x63c/0xbf0 [netdevsim]
    [ ... ]
    Reviewed-by: default avatarJakub Kicinski <kuba@kernel.org>
    Fixes: ab1d0cc0 ("netdevsim: change debugfs tree topology")
    Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
    Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    6fb8852b
dev.c 25.8 KB