Skip to content

Conversation

@RazManor
Copy link
Contributor

@RazManor RazManor commented Feb 2, 2017

There was a discussion in the mailing list about the reuse of tmp in scan_dma_completions().
I made the changes as linus suggested, according to my original patch.
The changes works for me, hope that others will be able to test them, and merge them.

This was my logic for the patch:

  1. The req->td->dmadesc equals to 0 iff:
    -- There was a transaction ending with a short packet, and
    -- The read() to read it was shorter than the transaction length, and
    -- The read() to complete it is longer than the residue.
    I believe this is true from the printouts of various cases, but I can't be positive it is correct.

  2. Entering this if, there should be no more data in the endpoint (a short packet terminated the transaction). If there is, the transaction wasn't really done and we should exit and wait for it to finish entirely. That is the inner if.
    That inner if should never happen, but it is there to be on the safe side. That is why it is marked with the comment /* paranoia */.
    The size of the data available in the endpoint is ep->dma->dmacount and it is read to tmp.
    This entire clause is based on my own educated guesses.

  3. If we passed that inner if without breaking in the original code, than tmp & DMA_BYTE_MASK_COUNT== 0.
    That means we will always pass dma bytes count of 0 to dma_done(), meaning all the requested bytes were read.

  4. dma_done() reports back to the upper layer that the request (read()) was done and how many bytes were read. In the original code that would always be the request size, regardless of the actual size of the data.
    That did not make sense to me at all.

  5. However, the original value of tmp is req->td->dmacount, which is the dmacount value when the request's dma transaction was finished. And that is a much more reasonable value to report back to the caller.

As you can see, this is based a lot on educated guesses and debug printouts of various cases. That is why I would like to get your input on this, to make sure I'm on the right track.

To recreate the problem., try reading from a bulk out endpoint in a loop, 1024 * n bytes in each iteration. Connect the PLX to a host you can control, and send to that endpoint 1024 * n +x bytes such that 0 < x < 1024 * n and (x % 1024) != 0 You would expect the first read() to return 1024 * n and the second read to return x, but you will get the first read to return 1024 *n and the second one to return 1024 * n.
That is true for every positive integer n.

My patch solves the problem, and does not break any of the other cases I've tried.

@KernelPRBot
Copy link

Hi @RazManor!

Thanks for your contribution to the Linux kernel!

Linux kernel development happens on mailing lists, rather than on GitHub - this GitHub repository is a read-only mirror that isn't used for accepting contributions. So that your change can become part of Linux, please email it to us as a patch.

Sending patches isn't quite as simple as sending a pull request, but fortunately it is a well documented process.

Here's what to do:

  • Format your contribution according to kernel requirements
  • Decide who to send your contribution to
  • Set up your system to send your contribution as an email
  • Send your contribution and wait for feedback

How do I format my contribution?

The Linux kernel community is notoriously picky about how contributions are formatted and sent. Fortunately, they have documented their expectations.

Firstly, all contributions need to be formatted as patches. A patch is a plain text document showing the change you want to make to the code, and documenting why it is a good idea.

You can create patches with git format-patch.

Secondly, patches need 'commit messages', which is the human-friendly documentation explaining what the change is and why it's necessary.

Thirdly, changes have some technical requirements. There is a Linux kernel coding style, and there are licensing requirements you need to comply with.

Both of these are documented in the Submitting Patches documentation that is part of the kernel.

Note that you will almost certainly have to modify your existing git commits to satisfy these requirements. Don't worry: there are many guides on the internet for doing this.

Who do I send my contribution to?

The Linux kernel is composed of a number of subsystems. These subsystems are maintained by different people, and have different mailing lists where they discuss proposed changes.

If you don't already know what subsystem your change belongs to, the get_maintainer.pl script in the kernel source can help you.

get_maintainer.pl will take the patch or patches you created in the previous step, and tell you who is responsible for them, and what mailing lists are used. You can also take a look at the MAINTAINERS file by hand.

Make sure that your list of recipients includes a mailing list. If you can't find a more specific mailing list, then LKML - the Linux Kernel Mailing List - is the place to send your patches.

It's not usually necessary to subscribe to the mailing list before you send the patches, but if you're interested in kernel development, subscribing to a subsystem mailing list is a good idea. (At this point, you probably don't need to subscribe to LKML - it is a very high traffic list with about a thousand messages per day, which is often not useful for beginners.)

How do I send my contribution?

Use git send-email, which will ensure that your patches are formatted in the standard manner. In order to use git send-email, you'll need to configure git to use your SMTP email server.

For more information about using git send-email, look at the Git documentation or type git help send-email. There are a number of useful guides and tutorials about git send-email that can be found on the internet.

How do I get help if I'm stuck?

Firstly, don't get discouraged! There are an enormous number of resources on the internet, and many kernel developers who would like to see you succeed.

Many issues - especially about how to use certain tools - can be resolved by using your favourite internet search engine.

If you can't find an answer, there are a few places you can turn:

  • Kernel Newbies - this website contains a lot of useful resources for new kernel developers.
  • If you'd like a step-by-step, challenge-based introduction to kernel development, the Eudyptula Challenge would be an excellent start.
  • The kernel documentation - see also the Documentation directory in the kernel tree.

If you get really, really stuck, you could try the owners of this bot, @daxtens and @ajdlinux. Please be aware that we do have full-time jobs, so we are almost certainly the slowest way to get answers!

I sent my patch - now what?

You wait.

You can check that your email has been received by checking the mailing list archives for the mailing list you sent your patch to. Messages may not be received instantly, so be patient. Kernel developers are generally very busy people, so it may take a few weeks before your patch is looked at.

Then, you keep waiting. Three things may happen:

  • You might get a response to your email. Often these will be comments, which may require you to make changes to your patch, or explain why your way is the best way. You should respond to these comments, and you may need to submit another revision of your patch to address the issues raised.
  • Your patch might be merged into the subsystem tree. Code that becomes part of Linux isn't merged into the main repository straight away - it first goes into the subsystem tree, which is managed by the subsystem maintainer. It is then batched up with a number of other changes sent to Linus for inclusion. (This process is described in some detail in the kernel development process guide).
  • Your patch might be ignored completely. This happens sometimes - don't take it personally. Here's what to do:
    • Wait a bit more - patches often take several weeks to get a response; more if they were sent at a busy time.
    • Kernel developers often silently ignore patches that break the rules. Check for obvious violations of the the Submitting Patches guidelines, the style guidelines, and any other documentation you can find about your subsystem. Check that you're sending your patch to the right place.
    • Try again later. When you resend it, don't add angry commentary, as that will get your patch ignored. It might also get you silently blacklisted.

Further information

Happy hacking!

This message was posted by a bot - if you have any questions or suggestions, please talk to my owners, @ajdlinux and @daxtens, or raise an issue at https://github.com/ajdlinux/KernelPRBot.

In the function scan_dma_completions() there is a reusage of tmp variable.
That coused a wrong value being used in some case when reading a
short packet terminated transaction from an endpoint, in 2 concecutive reads.

This was my logic for the patch:

The req->td->dmadesc equals to 0 iff:
-- There was a transaction ending with a short packet, and
-- The read() to read it was shorter than the transaction length, and
-- The read() to complete it is longer than the residue.
I believe this is true from the printouts of various cases, but I can't be positive it is correct.

Entering this if, there should be no more data in the endpoint (a short packet terminated the transaction). If there is, the transaction wasn't really done and we should exit and wait for it to finish entirely. That is the inner if.
That inner if should never happen, but it is there to be on the safe side. That is why it is marked with the comment /* paranoia */.
The size of the data available in the endpoint is ep->dma->dmacount and it is read to tmp.
This entire clause is based on my own educated guesses.

If we passed that inner if without breaking in the original code, than tmp & DMA_BYTE_MASK_COUNT== 0.
That means we will always pass dma bytes count of 0 to dma_done(), meaning all the requested bytes were read.

dma_done() reports back to the upper layer that the request (read()) was done and how many bytes were read. In the original code that would always be the request size, regardless of the actual size of the data.
That did not make sense to me at all.

However, the original value of tmp is req->td->dmacount, which is the dmacount value when the request's dma transaction was finished. And that is a much more reasonable value to report back to the caller.

To recreate the problem:
Read from a bulk out endpoint in a loop, 1024 * n bytes in each iteration.
Connect the PLX to a host you can control.
Send to that endpoint 1024 * n + x bytes such that 0 < x < 1024 * n and (x % 1024) != 0
You would expect the first read() to return 1024 * n and the second read to return x.
But you will get the first read to return 1024 * n and the second one to return 1024 * n.
That is true for every positive integer n.

Reported-by: Raz Manor <Raz.Manor@valens.com>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Signed-off-by: Raz Manor <Raz.Manor@valens.com>
@getsadzeg
Copy link

It has conflicts with drivers/usb/gadget/udc/net2280.c , doesn't it?

fengguang pushed a commit to 0day-ci/linux that referenced this pull request Jul 1, 2020
__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
fengguang pushed a commit to 0day-ci/linux that referenced this pull request Jul 4, 2020
__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
fengguang pushed a commit to 0day-ci/linux that referenced this pull request Jul 4, 2020
__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
FireflyTang pushed a commit to FireflyTang/linux-wireguard-bind that referenced this pull request Jul 14, 2020
__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Noltari pushed a commit to Noltari/linux that referenced this pull request Jul 16, 2020
[ Upstream commit d005fbb ]

__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
snajpa pushed a commit to vpsfreecz/linux that referenced this pull request Jul 16, 2020
[ Upstream commit d005fbb ]

__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fifteenhex pushed a commit to fifteenhex/linux that referenced this pull request Jul 25, 2020
__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
fifteenhex pushed a commit to fifteenhex/linux that referenced this pull request Jul 28, 2020
__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
fifteenhex pushed a commit to fifteenhex/linux that referenced this pull request Jul 28, 2020
__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
fifteenhex pushed a commit to fifteenhex/linux that referenced this pull request Jul 29, 2020
__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
fifteenhex pushed a commit to fifteenhex/linux that referenced this pull request Aug 1, 2020
__nf_conntrack_update() might refresh the conntrack object that is
attached to the skbuff. Otherwise, this triggers UAF.

[  633.200434] ==================================================================
[  633.200472] BUG: KASAN: use-after-free in nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200478] Read of size 1 at addr ffff888370804c00 by task nfqnl_test/6769

[  633.200487] CPU: 1 PID: 6769 Comm: nfqnl_test Not tainted 5.8.0-rc2+ torvalds#388
[  633.200490] Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
[  633.200491] Call Trace:
[  633.200499]  dump_stack+0x7c/0xb0
[  633.200526]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200532]  print_address_description.constprop.6+0x1a/0x200
[  633.200539]  ? _raw_write_lock_irqsave+0xc0/0xc0
[  633.200568]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200594]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200598]  kasan_report.cold.9+0x1f/0x42
[  633.200604]  ? call_rcu+0x2c0/0x390
[  633.200633]  ? nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200659]  nf_conntrack_update+0x34e/0x770 [nf_conntrack]
[  633.200687]  ? nf_conntrack_find_get+0x30/0x30 [nf_conntrack]

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1436
Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ojeda added a commit to ojeda/linux that referenced this pull request Jun 29, 2021
rust: update IoctlHandler to allow arbitrary type as well.
hbiyik pushed a commit to hbiyik/linux that referenced this pull request Sep 8, 2025
…valds#388)

The simple-audio-card hp-pin-name was referencing "Headphone Jack"
but the actual widget is defined as "Headphones", causing ALSA
to report "ASoC: DAPM unknown pin Headphone Jack" error.
hbiyik pushed a commit to hbiyik/linux that referenced this pull request Sep 8, 2025
…valds#388)

The simple-audio-card hp-pin-name was referencing "Headphone Jack"
but the actual widget is defined as "Headphones", causing ALSA
to report "ASoC: DAPM unknown pin Headphone Jack" error.
@torvalds torvalds closed this Sep 22, 2025
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this pull request Nov 17, 2025
During OBEX Abort command, iOS may return an incomplete SDU packet
which ends with the reply to the Abort command.
During OBEX Abort command, iOS may return the L2CAP_SAR_END packet
before the normal end of the SAR packets:

  < ACL Data TX: Handle 21 [2/8] flags 0x00 dlen 11  torvalds#194 [hci0] 14.923741
      Channel: 3080 len 7 ctrl 0x060a [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Unsegmented TxSeq 5 ReqSeq 6
        0a 06 ff 00 03 47 84                             .....G.
...
  > ACL Data RX: Handle 21 flags 0x01 dlen 458       torvalds#382 [hci0] 19.701854
      Channel: 65 len 1006 ctrl 0x460e [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Start (len 32767) TxSeq 7 ReqSeq 6
        0e 46 ff 7f 90 7f ff 48 7f fc 43 48 41 52 53 45  .F.....H..CHARSE
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 552         torvalds#383 [hci0] 19.701854
> ACL Data RX: Handle 21 flags 0x01 dlen 458         torvalds#384 [hci0] 19.755918
      Channel: 65 len 1006 ctrl 0xc610 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Continuation TxSeq 8 ReqSeq 6
        10 c6 6e 6f 73 61 69 72 65 73 64 65 73 69 67 6e  ..nosairesdesign
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 552         torvalds#385 [hci0] 19.775016
> ACL Data RX: Handle 21 flags 0x01 dlen 458         torvalds#386 [hci0] 19.775024
      Channel: 65 len 1006 ctrl 0xc612 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Continuation TxSeq 9 ReqSeq 6
        12 c6 69 63 6f 20 43 69 74 79 20 54 65 63 68 20  ..ico City Tech
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 552         torvalds#387 [hci0] 19.775024
> ACL Data RX: Handle 21 flags 0x01 dlen 458         torvalds#388 [hci0] 19.821542
      Channel: 65 len 1006 ctrl 0xc614 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Continuation TxSeq 10 ReqSeq 6
        14 c6 6c 74 69 6e 67 20 50 61 72 74 6e 65 72 0d  ..lting Partner.
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 552         torvalds#389 [hci0] 19.821610
> ACL Data RX: Handle 21 flags 0x01 dlen 458         torvalds#390 [hci0] 19.821610
      Channel: 65 len 1006 ctrl 0xc616 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Continuation TxSeq 11 ReqSeq 6
        16 c6 6c 74 69 6e 67 2e 63 6f 6d 0d 0a 55 49 44  ..lting.com..UID
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 11          torvalds#391 [hci0] 19.821610
      Channel: 65 len 7 ctrl 0x8618 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: End TxSeq 12 ReqSeq 6
        18 86 a0 00 03 3e 5d                             .....>]
< ACL Data TX: Handle 21 [1/8] flags 0x00 dlen 12    torvalds#392 [hci0] 19.822491
      L2CAP: Disconnection Request (0x06) ident 10 len 4
        Destination CID: 3080
        Source CID: 65

In this case the re-assembled packet should be 32767 bytes as defined
in Start packet (torvalds#382), i.e. 33 segmented packets, but the End packet
is sent as the 6th packet.

The l2cap_reassemble_sdu() function returns error -EINVAL if reassembled
packet size != expected size, triggering the L2CAP disconnection, which
disconnects the OBEX session, preventing further OBEX actions.

Log this, discard previous segmented packet data and only send data
from SAR End packet to upstream.

Closes: bluez/bluetooth-next#17
Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this pull request Nov 17, 2025
During OBEX Abort command, iOS may return an incomplete SDU packet
which ends with the reply to the Abort command.
During OBEX Abort command, iOS may return the L2CAP_SAR_END packet
before the normal end of the SAR packets:

  < ACL Data TX: Handle 21 [2/8] flags 0x00 dlen 11  torvalds#194 [hci0] 14.923741
      Channel: 3080 len 7 ctrl 0x060a [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Unsegmented TxSeq 5 ReqSeq 6
        0a 06 ff 00 03 47 84                             .....G.
...
  > ACL Data RX: Handle 21 flags 0x01 dlen 458       torvalds#382 [hci0] 19.701854
      Channel: 65 len 1006 ctrl 0x460e [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Start (len 32767) TxSeq 7 ReqSeq 6
        0e 46 ff 7f 90 7f ff 48 7f fc 43 48 41 52 53 45  .F.....H..CHARSE
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 552         torvalds#383 [hci0] 19.701854
> ACL Data RX: Handle 21 flags 0x01 dlen 458         torvalds#384 [hci0] 19.755918
      Channel: 65 len 1006 ctrl 0xc610 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Continuation TxSeq 8 ReqSeq 6
        10 c6 6e 6f 73 61 69 72 65 73 64 65 73 69 67 6e  ..nosairesdesign
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 552         torvalds#385 [hci0] 19.775016
> ACL Data RX: Handle 21 flags 0x01 dlen 458         torvalds#386 [hci0] 19.775024
      Channel: 65 len 1006 ctrl 0xc612 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Continuation TxSeq 9 ReqSeq 6
        12 c6 69 63 6f 20 43 69 74 79 20 54 65 63 68 20  ..ico City Tech
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 552         torvalds#387 [hci0] 19.775024
> ACL Data RX: Handle 21 flags 0x01 dlen 458         torvalds#388 [hci0] 19.821542
      Channel: 65 len 1006 ctrl 0xc614 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Continuation TxSeq 10 ReqSeq 6
        14 c6 6c 74 69 6e 67 20 50 61 72 74 6e 65 72 0d  ..lting Partner.
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 552         torvalds#389 [hci0] 19.821610
> ACL Data RX: Handle 21 flags 0x01 dlen 458         torvalds#390 [hci0] 19.821610
      Channel: 65 len 1006 ctrl 0xc616 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: Continuation TxSeq 11 ReqSeq 6
        16 c6 6c 74 69 6e 67 2e 63 6f 6d 0d 0a 55 49 44  ..lting.com..UID
        ...
> ACL Data RX: Handle 21 flags 0x02 dlen 11          torvalds#391 [hci0] 19.821610
      Channel: 65 len 7 ctrl 0x8618 [PSM 4101 mode Enhanced
               Retransmission (0x03)] {chan 0}
      I-frame: End TxSeq 12 ReqSeq 6
        18 86 a0 00 03 3e 5d                             .....>]
< ACL Data TX: Handle 21 [1/8] flags 0x00 dlen 12    torvalds#392 [hci0] 19.822491
      L2CAP: Disconnection Request (0x06) ident 10 len 4
        Destination CID: 3080
        Source CID: 65

In this case the re-assembled packet should be 32767 bytes as defined
in Start packet (torvalds#382), i.e. 33 segmented packets, but the End packet
is sent as the 6th packet.

The l2cap_reassemble_sdu() function returns error -EINVAL if reassembled
packet size != expected size, triggering the L2CAP disconnection, which
disconnects the OBEX session, preventing further OBEX actions.

Log this, discard previous segmented packet data and only send data
from SAR End packet to upstream.

Closes: bluez/bluetooth-next#17
Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants