From patchwork Mon Apr 16 15:29:43 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 898734 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="aRDb4UHV"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40Pskw3GJYz9s3M for ; Tue, 17 Apr 2018 01:30:00 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752833AbeDPP37 (ORCPT ); Mon, 16 Apr 2018 11:29:59 -0400 Received: from mail-pl0-f67.google.com ([209.85.160.67]:42043 "EHLO mail-pl0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752776AbeDPP3x (ORCPT ); Mon, 16 Apr 2018 11:29:53 -0400 Received: by mail-pl0-f67.google.com with SMTP id t20-v6so10229302ply.9 for ; Mon, 16 Apr 2018 08:29:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=iJPY22ohntcm1ZQV+KH+kyeuiGlKLOV5xCT8P5NRHLA=; b=aRDb4UHVsXzvm0TamiCUFUFNxQp6TgCR1zY5XMLYK9cOB7NaCQzJjSC1hUTRqPj3Y7 hauNZBsIIyVQDqBby39F4UfJLKvnuwAkeak4Y1WEwmUjnlHFnUt3q/5rI2IxjDry0qMt /Mmn/+uWPzcAhvko5ZyEIS0NmwwaVG6q8Zj0XNG0LJbgMs+82SUIlym28knWH73YCPm4 dZLb1mChqYD4tXzm8imVuZXBtPPQRJmrXm3wI6+J8OSr6jAKI80L1k2jfjPthxP76TWY w2dd3zzwmvStxduWsSY/vPsP0OMqg0nfaF1Pxuy3DoU6nGiS4geDI6OzJTuZwpQ+SaEj hZSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=iJPY22ohntcm1ZQV+KH+kyeuiGlKLOV5xCT8P5NRHLA=; b=nqtRyw9sW4YTbJeZaLnmGpgljoR84SP+ECFhqJep4su6Pih2gOq19IxACj6Mt5m2By i/CBddG8LW4bN/IO9EIKRjgwPxIRKlheduhlhhUaKnzT/eWYVgnoLyNt67Xt0ns8Ov6U YXKz12JW2crDakOnqwLyOzgX5yJIgoz3C4wblKf+RqeyvoI/1xESsBIlyXR7oCJtvYFE 7NbaLG9BPwipuAg/eWdHdXB4norDv01Y2Dk6wkKvI6Q3Ytwssc7lziMLRfGgVhHaaaAr jGdOfxbshuevU4HnDQ1HvnsKJ6Vx69QOHI2V8EBrq2cSTUKYNG4Q67if1oLWI9LJx9kA ll/Q== X-Gm-Message-State: ALQs6tBng213iewJ8c/wLNL5wJOaGYijYx3AjgYHGNFGHnXQvrhXLnlK QM9b7JsE5H9PMt1HAoR8+8FbgA== X-Google-Smtp-Source: AIpwx49Q/ibGVYcB/vEQEIuxFEyKFlmHJvSN5NvJUPKjnxfcww1FnqFENZQBqKhns01m5D6dOHONZw== X-Received: by 2002:a17:902:694a:: with SMTP id k10-v6mr15457117plt.161.1523892592897; Mon, 16 Apr 2018 08:29:52 -0700 (PDT) Received: from localhost ([2620:15c:2c4:1:7e6f:1e60:1805:893c]) by smtp.gmail.com with ESMTPSA id i2sm1199291pgo.57.2018.04.16.08.29.51 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 16 Apr 2018 08:29:51 -0700 (PDT) From: Eric Dumazet To: "David S . Miller" Cc: netdev , Eric Dumazet , Eric Dumazet , Jon Maloy , Ying Xue Subject: [PATCH net 2/2] tipc: fix possible crash in __tipc_nl_net_set() Date: Mon, 16 Apr 2018 08:29:43 -0700 Message-Id: <20180416152943.103989-3-edumazet@google.com> X-Mailer: git-send-email 2.17.0.484.g0c8726318c-goog In-Reply-To: <20180416152943.103989-1-edumazet@google.com> References: <20180416152943.103989-1-edumazet@google.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org syzbot reported a crash in __tipc_nl_net_set() caused by NULL dereference. We need to check that both TIPC_NLA_NET_NODEID and TIPC_NLA_NET_NODEID_W1 are present. We also need to make sure userland provided u64 attributes. Fixes: d50ccc2d3909 ("tipc: add 128-bit node identifier") Signed-off-by: Eric Dumazet Cc: Jon Maloy Cc: Ying Xue Reported-by: syzbot Acked-by: Ying Xue --- net/tipc/net.c | 2 ++ net/tipc/netlink.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/net/tipc/net.c b/net/tipc/net.c index 856f9e97ea293210bea1d2003d2092482732ace9..4fbaa0464405370601cb2fd1dd3b03733836d342 100644 --- a/net/tipc/net.c +++ b/net/tipc/net.c @@ -252,6 +252,8 @@ int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info) u64 *w0 = (u64 *)&node_id[0]; u64 *w1 = (u64 *)&node_id[8]; + if (!attrs[TIPC_NLA_NET_NODEID_W1]) + return -EINVAL; *w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]); *w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]); tipc_net_init(net, node_id, 0); diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c index d4e0bbeee72793a060befaf8a9d0239731c0d48c..6ff2254088f647d4f7410c3335ccdae2e68ec522 100644 --- a/net/tipc/netlink.c +++ b/net/tipc/netlink.c @@ -81,6 +81,8 @@ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = { [TIPC_NLA_NET_UNSPEC] = { .type = NLA_UNSPEC }, [TIPC_NLA_NET_ID] = { .type = NLA_U32 }, [TIPC_NLA_NET_ADDR] = { .type = NLA_U32 }, + [TIPC_NLA_NET_NODEID] = { .type = NLA_U64 }, + [TIPC_NLA_NET_NODEID_W1] = { .type = NLA_U64 }, }; const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {