mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-02 09:40:27 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/net/tipc
History
Xin Long 4f07b80c97 tipc: check msg->req data len in tipc_nl_compat_bearer_disable 
This patch is to fix an uninit-value issue, reported by syzbot:

  BUG: KMSAN: uninit-value in memchr+0xce/0x110 lib/string.c:981
  Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x191/0x1f0 lib/dump_stack.c:113
    kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622
    __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310
    memchr+0xce/0x110 lib/string.c:981
    string_is_valid net/tipc/netlink_compat.c:176 [inline]
    tipc_nl_compat_bearer_disable+0x2a1/0x480 net/tipc/netlink_compat.c:449
    __tipc_nl_compat_doit net/tipc/netlink_compat.c:327 [inline]
    tipc_nl_compat_doit+0x3ac/0xb00 net/tipc/netlink_compat.c:360
    tipc_nl_compat_handle net/tipc/netlink_compat.c:1178 [inline]
    tipc_nl_compat_recv+0x1b1b/0x27b0 net/tipc/netlink_compat.c:1281

TLV_GET_DATA_LEN() may return a negtive int value, which will be
used as size_t (becoming a big unsigned long) passed into memchr,
cause this issue.

Similar to what it does in tipc_nl_compat_bearer_enable(), this
fix is to return -EINVAL when TLV_GET_DATA_LEN() is negtive in
tipc_nl_compat_bearer_disable(), as well as in
tipc_nl_compat_link_stat_dump() and tipc_nl_compat_link_reset_stats().

v1->v2:
  - add the missing Fixes tags per Eric's request.

Fixes: 0762216c0a ("tipc: fix uninit-value in tipc_nl_compat_bearer_enable")
Fixes: 8b66fee7f8 ("tipc: fix uninit-value in tipc_nl_compat_link_reset_stats")
Reported-by: syzbot+30eaa8bf392f7fafffaf@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-24 10:03:59 -07:00
..
addr.c tipc: handle collisions of 32-bit node address hash values 2018-03-23 13:12:18 -04:00
addr.h tipc: add 128-bit node identifier 2018-03-23 13:12:18 -04:00
bcast.c tipc: add NULL pointer check 2019-04-04 17:34:11 -07:00
bcast.h tipc: fix a null pointer deref 2019-03-21 09:56:55 -07:00
bearer.c netlink: make validation more configurable for future strictness 2019-04-27 17:07:21 -04:00
bearer.h tipc: enable tracepoints in tipc 2018-12-19 11:49:24 -08:00
core.c tipc: change to use register_pernet_device 2019-06-22 16:51:47 -07:00
core.h tipc: introduce new capability flag for cluster 2019-03-19 13:56:17 -07:00
diag.c tipc: switch to rhashtable iterator 2018-08-29 18:04:54 -07:00
discover.c tipc: fix lockdep warning when reinitilaizing sockets 2018-11-17 22:01:31 -08:00
discover.h tipc: some cleanups in the file discover.c 2018-03-23 13:12:17 -04:00
eth_media.c
group.c tipc: purge deferredq list for each grp member in tipc_group_delete 2019-06-16 20:42:05 -07:00
group.h tipc: extend sock diag for group communication 2018-06-30 21:05:42 +09:00
ib_media.c
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
link.c tipc: fix issues with early FAILOVER_MSG from peer 2019-06-18 10:03:37 -07:00
link.h tipc: fix missing Name entries due to half-failover 2019-05-04 00:59:51 -04:00
Makefile tipc: enable tracepoints in tipc 2018-12-19 11:49:24 -08:00
monitor.c netlink: make nla_nest_start() add NLA_F_NESTED flag 2019-04-27 17:03:44 -04:00
monitor.h
msg.c tipc: buffer overflow handling in listener socket 2018-09-29 11:24:22 -07:00
msg.h tipc: reduce duplicate packets for unicast traffic 2019-04-04 18:29:25 -07:00
name_distr.c tipc: eliminate message disordering during binding table update 2018-10-22 19:29:12 -07:00
name_distr.h tipc: permit overlapping service ranges in name table 2018-03-31 22:19:52 -04:00
name_table.c netlink: make nla_nest_start() add NLA_F_NESTED flag 2019-04-27 17:03:44 -04:00
name_table.h tipc: eliminate message disordering during binding table update 2018-10-22 19:29:12 -07:00
net.c netlink: make validation more configurable for future strictness 2019-04-27 17:07:21 -04:00
net.h tipc: fix lockdep warning when reinitilaizing sockets 2018-11-17 22:01:31 -08:00
netlink.c genetlink: optionally validate strictly/dumps 2019-04-27 17:07:22 -04:00
netlink.h
netlink_compat.c tipc: check msg->req data len in tipc_nl_compat_bearer_disable 2019-06-24 10:03:59 -07:00
node.c tipc: fix issues with early FAILOVER_MSG from peer 2019-06-18 10:03:37 -07:00
node.h tipc: improve TIPC throughput by Gap ACK blocks 2019-04-04 18:29:25 -07:00
socket.c tipc: fix hanging clients using poll with EPOLLOUT flag 2019-05-09 09:26:09 -07:00
socket.h tipc: add trace_events for tipc socket 2018-12-19 11:49:24 -08:00
subscr.c tipc: fix unbalanced reference counter 2018-04-12 21:46:10 -04:00
subscr.h tipc: fix modprobe tipc failed after switch order of device registration 2019-05-20 10:45:43 -07:00
sysctl.c tipc: set sysctl_tipc_rmem and named_timeout right range 2019-04-16 21:32:02 -07:00
topsrv.c tipc: fix modprobe tipc failed after switch order of device registration 2019-05-20 10:45:43 -07:00
topsrv.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
trace.c tipc: remove unneeded semicolon in trace.c 2019-01-17 22:04:43 -08:00
trace.h tipc: add trace_events for tipc bearer 2018-12-19 11:49:25 -08:00
udp_media.c tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb 2019-06-18 20:48:45 -04:00
udp_media.h tipc: implement configuration of UDP media MTU 2018-04-20 11:04:05 -04:00