Page MenuHomeFreeBSD

rsu: add a runtime TX buffer bound check for a kernel buffer overflow
ClosedPublic

Authored by markj on Mon, Aug 17, 8:17 PM.
Tags
None
Referenced Files
F170686188: D58898.id.diff
Sun, Sep 6, 12:51 AM
F170654953: D58898.id184215.diff
Sat, Sep 5, 8:24 PM
F170654950: D58898.id184215.diff
Sat, Sep 5, 8:24 PM
Unknown Object (File)
Sat, Sep 5, 7:15 AM
Unknown Object (File)
Fri, Sep 4, 11:01 PM
Unknown Object (File)
Thu, Sep 3, 5:48 PM
Unknown Object (File)
Wed, Sep 2, 10:24 PM
Unknown Object (File)
Tue, Sep 1, 1:41 AM
Subscribers

Details

Summary

The rsu driver currently relies on a KASSERT to prove that the mbuf payload
plus TX descriptor fits in the per-transfer USB TX buffer. On production
kernels without INVARIANTS, an oversized raw 802.11 frame can reach
m_copydata() and overwrite past that buffer, causing local kernel memory
corruption.

This suggested patch replaces the assertion-only guard with a runtime size
check before the copy. Oversized frames return EMSGSIZE, leaving the existing
caller cleanup paths responsible for freeing m0, ni, and the unused
transfer buffer.

Reachable via root / bpf access

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable