From nobody Sat Feb 7 13:59:19 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04F87C4332F for ; Wed, 19 Oct 2022 08:46:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231346AbiJSIqF (ORCPT ); Wed, 19 Oct 2022 04:46:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42686 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231171AbiJSIoZ (ORCPT ); Wed, 19 Oct 2022 04:44:25 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 77167248C4; Wed, 19 Oct 2022 01:43:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2DBC2617ED; Wed, 19 Oct 2022 08:40:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DEB2EC433C1; Wed, 19 Oct 2022 08:40:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666168841; bh=fKJwUNj+WZmm2S+aDmii77muhA5lPrzqkWoRYL+Sruw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pxdnKG3J0rVIcikU/e4q5Hj6k9C6saM4ebylvtbQUbLiYw+/E/HXXJ5O8zxWyiDN7 nXGxSQV+pyfEhBK6SnpkDYsQFGo1pKIvUEilyudFrli1HxEoK2PlkEHT5bZVUMbfWb jYTxaZL1GmcdWDetJo9ce2Roes+46JZpV4XrI3a4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jimmy Assarsson , Anssi Hannula , Marc Kleine-Budde Subject: [PATCH 6.0 034/862] can: kvaser_usb_leaf: Fix overread with an invalid command Date: Wed, 19 Oct 2022 10:22:01 +0200 Message-Id: <20221019083251.531275455@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Anssi Hannula commit 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 upstream. For command events read from the device, kvaser_usb_leaf_read_bulk_callback() verifies that cmd->len does not exceed the size of the received data, but the actual kvaser_cmd handlers will happily read any kvaser_cmd fields without checking for cmd->len. This can cause an overread if the last cmd in the buffer is shorter than expected for the command type (with cmd->len showing the actual short size). Maximum overread seems to be 22 bytes (CMD_LEAF_LOG_MESSAGE), some of which are delivered to userspace as-is. Fix that by verifying the length of command before handling it. This issue can only occur after RX URBs have been set up, i.e. the interface has been opened at least once. Cc: stable@vger.kernel.org Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devic= es") Tested-by: Jimmy Assarsson Signed-off-by: Anssi Hannula Signed-off-by: Jimmy Assarsson Link: https://lore.kernel.org/all/20221010150829.199676-2-extja@kvaser.com Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 75 ++++++++++++++++++= +++++ 1 file changed, 75 insertions(+) --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c @@ -310,6 +310,38 @@ struct kvaser_cmd { } u; } __packed; =20 +#define CMD_SIZE_ANY 0xff +#define kvaser_fsize(field) sizeof_field(struct kvaser_cmd, field) + +static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] =3D { + [CMD_START_CHIP_REPLY] =3D kvaser_fsize(u.simple), + [CMD_STOP_CHIP_REPLY] =3D kvaser_fsize(u.simple), + [CMD_GET_CARD_INFO_REPLY] =3D kvaser_fsize(u.cardinfo), + [CMD_TX_ACKNOWLEDGE] =3D kvaser_fsize(u.tx_acknowledge_header), + [CMD_GET_SOFTWARE_INFO_REPLY] =3D kvaser_fsize(u.leaf.softinfo), + [CMD_RX_STD_MESSAGE] =3D kvaser_fsize(u.leaf.rx_can), + [CMD_RX_EXT_MESSAGE] =3D kvaser_fsize(u.leaf.rx_can), + [CMD_LEAF_LOG_MESSAGE] =3D kvaser_fsize(u.leaf.log_message), + [CMD_CHIP_STATE_EVENT] =3D kvaser_fsize(u.leaf.chip_state_event), + [CMD_CAN_ERROR_EVENT] =3D kvaser_fsize(u.leaf.error_event), + /* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY] =3D CMD_SIZE_ANY, +}; + +static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] =3D { + [CMD_START_CHIP_REPLY] =3D kvaser_fsize(u.simple), + [CMD_STOP_CHIP_REPLY] =3D kvaser_fsize(u.simple), + [CMD_GET_CARD_INFO_REPLY] =3D kvaser_fsize(u.cardinfo), + [CMD_TX_ACKNOWLEDGE] =3D kvaser_fsize(u.tx_acknowledge_header), + [CMD_GET_SOFTWARE_INFO_REPLY] =3D kvaser_fsize(u.usbcan.softinfo), + [CMD_RX_STD_MESSAGE] =3D kvaser_fsize(u.usbcan.rx_can), + [CMD_RX_EXT_MESSAGE] =3D kvaser_fsize(u.usbcan.rx_can), + [CMD_CHIP_STATE_EVENT] =3D kvaser_fsize(u.usbcan.chip_state_event), + [CMD_CAN_ERROR_EVENT] =3D kvaser_fsize(u.usbcan.error_event), + /* ignored events: */ + [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] =3D CMD_SIZE_ANY, +}; + /* Summary of a kvaser error event, for a unified Leaf/Usbcan error * handling. Some discrepancies between the two families exist: * @@ -397,6 +429,43 @@ static const struct kvaser_usb_dev_cfg k .bittiming_const =3D &kvaser_usb_flexc_bittiming_const, }; =20 +static int kvaser_usb_leaf_verify_size(const struct kvaser_usb *dev, + const struct kvaser_cmd *cmd) +{ + /* buffer size >=3D cmd->len ensured by caller */ + u8 min_size =3D 0; + + switch (dev->driver_info->family) { + case KVASER_LEAF: + if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_leaf)) + min_size =3D kvaser_usb_leaf_cmd_sizes_leaf[cmd->id]; + break; + case KVASER_USBCAN: + if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_usbcan)) + min_size =3D kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id]; + break; + } + + if (min_size =3D=3D CMD_SIZE_ANY) + return 0; + + if (min_size) { + min_size +=3D CMD_HEADER_LEN; + if (cmd->len >=3D min_size) + return 0; + + dev_err_ratelimited(&dev->intf->dev, + "Received command %u too short (size %u, needed %u)", + cmd->id, cmd->len, min_size); + return -EIO; + } + + dev_warn_ratelimited(&dev->intf->dev, + "Unhandled command (%d, size %d)\n", + cmd->id, cmd->len); + return -EINVAL; +} + static void * kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv, const struct sk_buff *skb, int *cmd_len, @@ -502,6 +571,9 @@ static int kvaser_usb_leaf_wait_cmd(cons end: kfree(buf); =20 + if (err =3D=3D 0) + err =3D kvaser_usb_leaf_verify_size(dev, cmd); + return err; } =20 @@ -1133,6 +1205,9 @@ static void kvaser_usb_leaf_stop_chip_re static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev, const struct kvaser_cmd *cmd) { + if (kvaser_usb_leaf_verify_size(dev, cmd) < 0) + return; + switch (cmd->id) { case CMD_START_CHIP_REPLY: kvaser_usb_leaf_start_chip_reply(dev, cmd);