| Message ID | 20181210232330.4707-1-xiyou.wangcong@gmail.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] tipc: compare remote and local protocols in tipc_udp_enable() | expand |
> -----Original Message----- > From: Cong Wang <xiyou.wangcong@gmail.com> > Sent: 10-Dec-18 18:24 > To: netdev@vger.kernel.org > Cc: Cong Wang <xiyou.wangcong@gmail.com>; Ying Xue > <ying.xue@windriver.com>; Jon Maloy <jon.maloy@ericsson.com> > Subject: [Patch net] tipc: compare remote and local protocols in > tipc_udp_enable() > > When TIPC_NLA_UDP_REMOTE is an IPv6 mcast address but > TIPC_NLA_UDP_LOCAL is an IPv4 address, a NULL-ptr deref is triggered as > the UDP tunnel sock is initialized to IPv4 or IPv6 sock merely based on the > protocol in local address. > > We should just error out when the remote address and local address have > different protocols. Acked-by: Jon Maloy <jon.maloy@ericsson.com> Thank you for your help, Cong. > > Reported-by: syzbot+eb4da3a20fad2e52555d@syzkaller.appspotmail.com > Cc: Ying Xue <ying.xue@windriver.com> > Cc: Jon Maloy <jon.maloy@ericsson.com> > Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> > --- > net/tipc/udp_media.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index > 1b1ba1310ea7..4d85d71f16e2 100644 > --- a/net/tipc/udp_media.c > +++ b/net/tipc/udp_media.c > @@ -679,6 +679,11 @@ static int tipc_udp_enable(struct net *net, struct > tipc_bearer *b, > if (err) > goto err; > > + if (remote.proto != local.proto) { > + err = -EINVAL; > + goto err; > + } > + > /* Checking remote ip address */ > rmcast = tipc_udp_is_mcast_addr(&remote); > > -- > 2.19.2
From: Cong Wang <xiyou.wangcong@gmail.com> Date: Mon, 10 Dec 2018 15:23:30 -0800 > When TIPC_NLA_UDP_REMOTE is an IPv6 mcast address but > TIPC_NLA_UDP_LOCAL is an IPv4 address, a NULL-ptr deref is triggered > as the UDP tunnel sock is initialized to IPv4 or IPv6 sock merely > based on the protocol in local address. > > We should just error out when the remote address and local address > have different protocols. > > Reported-by: syzbot+eb4da3a20fad2e52555d@syzkaller.appspotmail.com > Cc: Ying Xue <ying.xue@windriver.com> > Cc: Jon Maloy <jon.maloy@ericsson.com> > Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Applied and queued up for -stable, thanks.
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index 1b1ba1310ea7..4d85d71f16e2 100644 --- a/net/tipc/udp_media.c +++ b/net/tipc/udp_media.c @@ -679,6 +679,11 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b, if (err) goto err; + if (remote.proto != local.proto) { + err = -EINVAL; + goto err; + } + /* Checking remote ip address */ rmcast = tipc_udp_is_mcast_addr(&remote);
When TIPC_NLA_UDP_REMOTE is an IPv6 mcast address but TIPC_NLA_UDP_LOCAL is an IPv4 address, a NULL-ptr deref is triggered as the UDP tunnel sock is initialized to IPv4 or IPv6 sock merely based on the protocol in local address. We should just error out when the remote address and local address have different protocols. Reported-by: syzbot+eb4da3a20fad2e52555d@syzkaller.appspotmail.com Cc: Ying Xue <ying.xue@windriver.com> Cc: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> --- net/tipc/udp_media.c | 5 +++++ 1 file changed, 5 insertions(+)