lkml.org 
[lkml]   [2020]   [Dec]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] net: mac80211: cfg: enforce sanity checks for key_index in ieee80211_del_key()
Date
Currently, it is assumed that key_idx values that are passed to
ieee80211_del_key() are all valid indexes as is, and no sanity checks
are performed for it.
However, syzbot was able to trigger an array-index-out-of-bounds bug
by passing a key_idx value of 5, when the maximum permissible index
value is (NUM_DEFAULT_KEYS - 1).
Enforcing sanity checks helps in preventing this bug, or a similar
instance in the context of ieee80211_del_key() from occurring.

Reported-by: syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com
Tested-by: syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
---
net/mac80211/cfg.c | 24 +++++++++++++++++++++---
1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7276e66ae435..d349e33134e6 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -516,12 +516,30 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
if (!sta)
goto out_unlock;

- if (pairwise)
+ if (pairwise) {
+ if (key_idx >= NUM_DEFAULT_KEYS) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
key = key_mtx_dereference(local, sta->ptk[key_idx]);
- else
+ } else {
+ if (key_idx >= (NUM_DEFAULT_KEYS +
+ NUM_DEFAULT_MGMT_KEYS +
+ NUM_DEFAULT_BEACON_KEYS)) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
key = key_mtx_dereference(local, sta->gtk[key_idx]);
- } else
+ }
+ } else {
+ if (key_idx >= (NUM_DEFAULT_KEYS +
+ NUM_DEFAULT_MGMT_KEYS +
+ NUM_DEFAULT_BEACON_KEYS)) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
key = key_mtx_dereference(local, sdata->keys[key_idx]);
+ }

if (!key) {
ret = -ENOENT;
--
2.25.1
\
 
 \ /
  Last update: 2020-12-01 10:59    [W:0.055 / U:2.272 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site