In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: fddi: skfp: fix NULL deref when setting the MAC address while down<\/p>\n
skfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without
\nchecking netif_running(). ResetAdapter() first calls card_stop(), which
\nsets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),
\nwhich walks the two transmit queues:<\/p>\n
\tfor (i = QUEUE_S; i hw.fp.tx[i] ;
\n\t\t…
\n\t\tt = queue->tx_curr_get ;<\/p>\n
smc->hw.fp.tx[] is only populated by init_tx(), which is reached from
\nskfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() ->
\ninit_mac() -> init_tx(). The private area is allocated and zeroed by
\nalloc_fddidev(), so on an interface that has never been brought up both
\nqueue pointers are still NULL. The hw_state test at the top of
\nmac_drv_clear_tx_queue() does not catch this, because card_stop() has
\njust set STOPPED; the function proceeds into the loop and dereferences
\nNULL. ResetAdapter() does call init_smt() itself, but only after the
\nqueues have been cleared.<\/p>\n
Setting the MAC address on a down interface therefore oopses:<\/p>\n
ip link set dev fddi0 address 02:00:00:00:00:01<\/p>\n
BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68\/0x2c0 [skfp]
\n Read of size 8 at addr 0000000000000010 by task ip\/302
\n Call Trace:<\/p>\n
mac_drv_clear_tx_queue+0x68\/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]
\n ResetAdapter+0x29\/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]
\n skfp_ctl_set_mac_address+0x57\/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]
\n netif_set_mac_address+0x1e4\/0x2c0
\n do_setlink+0x684\/0x2680<\/p>\n
Address 0x10 is the offset of tx_curr_get, the third pointer in
\nstruct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which
\nResetAdapter() calls immediately afterwards, dereferences
\nsmc->hw.fp.rx[QUEUE_R1] in the same way behind the same ineffective
\nhw_state test; the transmit queue merely crashes first. Both are
\ncovered by the guard below.<\/p>\n
Skip the adapter reset when the interface is down. dev_addr_set() is
\nleft unconditional, so the new address is still recorded in
\ndev->dev_addr. Nothing is lost by not resetting the adapter here:
\nskfp_open() deliberately re-reads the factory address on every open,<\/p>\n
\tread_address(smc, NULL);
\n\teth_hw_addr_set(dev, smc->hw.fddi_canon_addr.a);<\/p>\n
and the comment above it states this is done to discard exactly such an
\naddress override across a close\/open cycle. An address set while the
\ninterface is down could not have survived the following open even
\nbefore this change, so the guard removes no working behaviour. Guarding
\nthe hardware side of ndo_set_mac_address() with netif_running() is
\nestablished practice; skge_set_mac_address() has done so since commit
\n2eb3e621c4e0 (“skge: set mac address bonding fix”).<\/p>\n
Guarding the reset as a whole, rather than NULL-checking the queues, is
\nalso what the rest of the driver expects. After a previous open\/close
\nthe queue pointers are stale but non-NULL, so there is no crash, yet
\nResetAdapter() goes on to call smt_online() and STI_FBI() (“Enable
\nBoard Interrupts”) while skfp_close() has already called free_irq() –
\nthe adapter would be brought back online with no handler installed. The
\nonly other ResetAdapter() caller is skfp_interrupt(), which by
\nconstruction runs only while the device is open.<\/p>\n
Found by automated driver testing against an emulated SysKonnect FDDI
\nadapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires
\nCAP_NET_ADMIN.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: fddi: skfp: fix NULL deref when setting the MAC address while down<\/p>\n
skfp_ctl_set_mac_address() calls ResetAdapter() unconditio<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33371","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}