[syzbot] [nfc?] [net?] KMSAN: uninit-value in nci_ntf_packet (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 614da38e2f7a Merge tag 'hid-for-linus-2024051401' of git:/..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=160b7244980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5d2cbf33633f507
dashboard link: https://syzkaller.appspot.com/bug?extid=71bfed2b2bcea46c98f2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1065f33f180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13113a34980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/89eafb874b71/disk-614da38e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/356000512ad9/vmlinux-614da38e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/839c73939115/bzImage-614da38e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+71bfed...@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in nci_rf_intf_activated_ntf_packet net/nfc/nci/ntf.c:620 [inline]
BUG: KMSAN: uninit-value in nci_ntf_packet+0x27f4/0x39c0 net/nfc/nci/ntf.c:802
nci_rf_intf_activated_ntf_packet net/nfc/nci/ntf.c:620 [inline]
nci_ntf_packet+0x27f4/0x39c0 net/nfc/nci/ntf.c:802
nci_rx_work+0x288/0x5d0 net/nfc/nci/core.c:1532
process_one_work kernel/workqueue.c:3267 [inline]
process_scheduled_works+0xa81/0x1bd0 kernel/workqueue.c:3348
worker_thread+0xea5/0x1560 kernel/workqueue.c:3429
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
slab_post_alloc_hook mm/slub.c:3877 [inline]
slab_alloc_node mm/slub.c:3918 [inline]
kmem_cache_alloc_node+0x622/0xc90 mm/slub.c:3961
kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
__alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1319 [inline]
virtual_ncidev_write+0x6d/0x290 drivers/nfc/virtual_ncidev.c:120
vfs_write+0x497/0x14d0 fs/read_write.c:588
ksys_write+0x20f/0x4c0 fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__x64_sys_write+0x93/0xe0 fs/read_write.c:652
x64_sys_call+0x3062/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 PID: 3730 Comm: kworker/u8:19 Not tainted 6.9.0-syzkaller-02707-g614da38e2f7a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: nfc2_nci_rx_wq nci_rx_work
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Edward Adam Davis]

please test uv in nci_ntf_packet

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 614da38e2f7a

diff --git a/drivers/nfc/virtual_ncidev.c b/drivers/nfc/virtual_ncidev.c
index 590b038e449e..6b89d596ba9a 100644
--- a/drivers/nfc/virtual_ncidev.c
+++ b/drivers/nfc/virtual_ncidev.c
@@ -125,6 +125,10 @@ static ssize_t virtual_ncidev_write(struct file *file,
kfree_skb(skb);
return -EFAULT;
}
+ if (strnlen(skb->data, count) != count) {
+ kfree_skb(skb);
+ return -EINVAL;
+ }

nci_recv_frame(vdev->ndev, skb);
return count;

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+71bfed...@syzkaller.appspotmail.com

Tested on:

commit: 614da38e Merge tag 'hid-for-linus-2024051401' of git:/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=10f2d63c980000

kernel config: https://syzkaller.appspot.com/x/.config?x=f5d2cbf33633f507
dashboard link: https://syzkaller.appspot.com/bug?extid=71bfed2b2bcea46c98f2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10071592980000

Note: testing is done by a robot and is best-effort only.

[Edward Adam Davis]

write$nci(r0, &(0x7f0000000740)=ANY=[@ANYBLOB="610501"], 0xf)

Syzbot constructed a write() call with a data length of 3 bytes but a count value
of 15, which passed too little data to meet the basic requirements of the function
nci_rf_intf_activated_ntf_packet().

Therefore, increasing the comparison between data length and count value to avoid
problems caused by inconsistent data length and count.

Reported-and-tested-by: syzbot+71bfed...@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---
drivers/nfc/virtual_ncidev.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/drivers/nfc/virtual_ncidev.c b/drivers/nfc/virtual_ncidev.c
index 590b038e449e..6b89d596ba9a 100644
--- a/drivers/nfc/virtual_ncidev.c
+++ b/drivers/nfc/virtual_ncidev.c
@@ -125,6 +125,10 @@ static ssize_t virtual_ncidev_write(struct file *file,
kfree_skb(skb);
return -EFAULT;
}
+ if (strnlen(skb->data, count) != count) {
+ kfree_skb(skb);
+ return -EINVAL;
+ }

nci_recv_frame(vdev->ndev, skb);
return count;

--
2.43.0

[patchwork-b...@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <da...@davemloft.net>:

On Tue, 28 May 2024 11:12:31 +0800 you wrote:
> write$nci(r0, &(0x7f0000000740)=ANY=[@ANYBLOB="610501"], 0xf)
>
> Syzbot constructed a write() call with a data length of 3 bytes but a count value
> of 15, which passed too little data to meet the basic requirements of the function
> nci_rf_intf_activated_ntf_packet().
>
> Therefore, increasing the comparison between data length and count value to avoid
> problems caused by inconsistent data length and count.
>

> [...]

Here is the summary with links:
- nfc/nci: Add the inconsistency check between the input data length and count
https://git.kernel.org/netdev/net/c/068648aab72c

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html