netdev - Re: [PATCH net 2/2] tipc: fix possible crash in __tipc_nl_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0232c2f1-024c-7f6c-f62d-4899a1fd4f14@windriver.com>
Date:   Tue, 17 Apr 2018 19:45:05 +0800
From:   Ying Xue <ying.xue@...driver.com>
To:     Eric Dumazet <edumazet@...gle.com>,
        "David S . Miller" <davem@...emloft.net>
CC:     netdev <netdev@...r.kernel.org>,
        Eric Dumazet <eric.dumazet@...il.com>,
        Jon Maloy <jon.maloy@...csson.com>
Subject: Re: [PATCH net 2/2] tipc: fix possible crash in __tipc_nl_net_set()

On 04/16/2018 11:29 PM, Eric Dumazet wrote:
> syzbot reported a crash in __tipc_nl_net_set() caused by NULL dereference.
> 
> We need to check that both TIPC_NLA_NET_NODEID and TIPC_NLA_NET_NODEID_W1
> are present.
> 
> We also need to make sure userland provided u64 attributes.
> 
> Fixes: d50ccc2d3909 ("tipc: add 128-bit node identifier")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Jon Maloy <jon.maloy@...csson.com>
> Cc: Ying Xue <ying.xue@...driver.com>
> Reported-by: syzbot <syzkaller@...glegroups.com>

Acked-by: Ying Xue <ying.xue@...driver.com>

> ---
>  net/tipc/net.c     | 2 ++
>  net/tipc/netlink.c | 2 ++
>  2 files changed, 4 insertions(+)
> 
> diff --git a/net/tipc/net.c b/net/tipc/net.c
> index 856f9e97ea293210bea1d2003d2092482732ace9..4fbaa0464405370601cb2fd1dd3b03733836d342 100644
> --- a/net/tipc/net.c
> +++ b/net/tipc/net.c
> @@ -252,6 +252,8 @@ int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
>  		u64 *w0 = (u64 *)&node_id[0];
>  		u64 *w1 = (u64 *)&node_id[8];
>  
> +		if (!attrs[TIPC_NLA_NET_NODEID_W1])
> +			return -EINVAL;
>  		*w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]);
>  		*w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]);
>  		tipc_net_init(net, node_id, 0);
> diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
> index d4e0bbeee72793a060befaf8a9d0239731c0d48c..6ff2254088f647d4f7410c3335ccdae2e68ec522 100644
> --- a/net/tipc/netlink.c
> +++ b/net/tipc/netlink.c
> @@ -81,6 +81,8 @@ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {
>  	[TIPC_NLA_NET_UNSPEC]		= { .type = NLA_UNSPEC },
>  	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 },
>  	[TIPC_NLA_NET_ADDR]		= { .type = NLA_U32 },
> +	[TIPC_NLA_NET_NODEID]		= { .type = NLA_U64 },
> +	[TIPC_NLA_NET_NODEID_W1]	= { .type = NLA_U64 },
>  };
>  
>  const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
>