iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/ipv4
History
Eric Dumazet d5e4d0a5e6 inet_diag: validate INET_DIAG_REQ_PROTOCOL attribute 
User space could send an invalid INET_DIAG_REQ_PROTOCOL attribute
as caught by syzbot.

BUG: KMSAN: uninit-value in inet_diag_lock_handler net/ipv4/inet_diag.c:55 [inline]
BUG: KMSAN: uninit-value in __inet_diag_dump+0x58c/0x720 net/ipv4/inet_diag.c:1147
CPU: 0 PID: 8505 Comm: syz-executor174 Not tainted 5.9.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:122
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:219
 inet_diag_lock_handler net/ipv4/inet_diag.c:55 [inline]
 __inet_diag_dump+0x58c/0x720 net/ipv4/inet_diag.c:1147
 inet_diag_dump_compat+0x2a5/0x380 net/ipv4/inet_diag.c:1254
 netlink_dump+0xb73/0x1cb0 net/netlink/af_netlink.c:2246
 __netlink_dump_start+0xcf2/0xea0 net/netlink/af_netlink.c:2354
 netlink_dump_start include/linux/netlink.h:246 [inline]
 inet_diag_rcv_msg_compat+0x5da/0x6c0 net/ipv4/inet_diag.c:1288
 sock_diag_rcv_msg+0x24f/0x620 net/core/sock_diag.c:256
 netlink_rcv_skb+0x6d7/0x7e0 net/netlink/af_netlink.c:2470
 sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:275
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x11c8/0x1490 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x173a/0x1840 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 ____sys_sendmsg+0xc82/0x1240 net/socket.c:2353
 ___sys_sendmsg net/socket.c:2407 [inline]
 __sys_sendmsg+0x6d1/0x820 net/socket.c:2440
 __do_sys_sendmsg net/socket.c:2449 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2447
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2447
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x441389
Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff3b02ce98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441389
RDX: 0000000000000000 RSI: 0000000020001500 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402130
R13: 00000000004021c0 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:143 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:126
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:80
 slab_alloc_node mm/slub.c:2907 [inline]
 __kmalloc_node_track_caller+0x9aa/0x12f0 mm/slub.c:4511
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0x35f/0xb30 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1094 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1176 [inline]
 netlink_sendmsg+0xdb9/0x1840 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 ____sys_sendmsg+0xc82/0x1240 net/socket.c:2353
 ___sys_sendmsg net/socket.c:2407 [inline]
 __sys_sendmsg+0x6d1/0x820 net/socket.c:2440
 __do_sys_sendmsg net/socket.c:2449 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2447
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2447
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 3f935c75eb52 ("inet_diag: support for wider protocol numbers")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Christoph Paasch <cpaasch@apple.com>
Cc: Mat Martineau <mathew.j.martineau@linux.intel.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-09-21 17:38:51 -07:00
..
bpfilter
net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces"
2020-08-10 12:06:44 -07:00
netfilter
netfilter: delete repeated words
2020-08-28 20:11:38 +02:00
af_inet.c
net: remove compat_sock_common_{get,set}sockopt
2020-07-19 18:16:40 -07:00
ah4.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
arp.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
bpf_tcp_ca.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2020-03-30 19:52:37 -07:00
cipso_ipv4.c
net: ipv4: kerneldoc fixes
2020-07-13 17:20:39 -07:00
datagram.c
inet: stop leaking jiffies on the wire
2019-11-01 14:57:52 -07:00
devinet.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-05-31 17:48:46 -07:00
esp4_offload.c
net: Add MODULE_DESCRIPTION entries to network modules
2020-06-20 21:33:57 -07:00
esp4.c
ESP: Export esp_output_fill_trailer function
2020-02-19 13:52:32 +01:00
fib_frontend.c
ipv4: Initialize flowi4_multipath_hash in data path
2020-09-14 14:54:56 -07:00
fib_lookup.h
net: add net available in build_state
2020-03-29 22:30:57 -07:00
fib_notifier.c
net: fib_notifier: propagate extack down to the notifier block callback
2019-10-04 11:10:56 -07:00
fib_rules.c
fib: use indirect call wrappers in the most common fib_rules_ops
2020-07-28 17:42:31 -07:00
fib_semantics.c
net: Fix the arp error in some cases
2020-06-18 20:21:51 -07:00
fib_trie.c
ipv4: Silence suspicious RCU usage warning
2020-08-26 15:58:48 -07:00
fou.c
net: Add MODULE_DESCRIPTION entries to network modules
2020-06-20 21:33:57 -07:00
gre_demux.c
gre: fix uninit-value in __iptunnel_pull_header
2020-03-08 21:25:37 -07:00
gre_offload.c
net: gre: recompute gre csum for sctp over gre tunnels
2020-08-03 15:29:44 -07:00
icmp.c
icmp6: support rfc 4884
2020-07-24 17:12:41 -07:00
igmp.c
ip*_mc_gsfget(): lift copyout of struct group_filter into callers
2020-05-20 20:31:27 -04:00
inet_connection_sock.c
net: refactor bind_bucket fastreuse into helper
2020-08-11 15:49:08 -07:00
inet_diag.c
inet_diag: validate INET_DIAG_REQ_PROTOCOL attribute
2020-09-21 17:38:51 -07:00
inet_fragment.c
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
inet_hashtables.c
net: initialize fastreuse on inet_inherit_port
2020-08-11 15:49:08 -07:00
inet_timewait_sock.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
inetpeer.c
inetpeer: fix data-race in inet_putpeer / inet_putpeer
2019-11-07 16:15:56 -08:00
ip_forward.c
ipv4: Revert removal of rt_uses_gateway
2019-09-20 18:23:33 -07:00
ip_fragment.c
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
ip_gre.c
net: add a new ndo_tunnel_ioctl method
2020-05-19 15:45:11 -07:00
ip_input.c
bpf: Add socket assign support
2020-03-30 13:45:04 -07:00
ip_options.c
net/ipv4: merge ip_options_get and ip_options_get_from_user
2020-07-24 15:41:54 -07:00
ip_output.c
ip: fix tos reflection in ack and reset packets
2020-09-08 20:19:08 -07:00
ip_sockglue.c
icmp: prepare rfc 4884 for ipv6
2020-07-24 17:12:41 -07:00
ip_tunnel_core.c
lwtunnel: only keep the available bits when setting vxlan md->gbp
2020-09-14 16:49:39 -07:00
ip_tunnel.c
ip_tunnel: fix use-after-free in ip_tunnel_lookup()
2020-06-18 20:12:34 -07:00
ip_vti.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next
2020-07-30 14:39:31 -07:00
ipcomp.c
ipcomp: assign if_id to child tunnel from parent tunnel
2020-07-09 12:55:37 +02:00
ipconfig.c
Documentation: nfsroot.rst: Fix references to nfsroot.rst
2020-03-02 13:11:46 -07:00
ipip.c
net: ipip: implement header_ops->parse_protocol for AF_PACKET
2020-06-30 12:29:39 -07:00
ipmr_base.c
net: fib_notifier: propagate extack down to the notifier block callback
2019-10-04 11:10:56 -07:00
ipmr.c
ipmr: Copy option to correct variable
2020-07-27 11:39:55 -07:00
Kconfig
net: ipv4: remove duplicate "the the" phrase in Kconfig text
2020-08-18 16:02:16 -07:00
Makefile
udp_tunnel: add central NIC RX port offload infrastructure
2020-07-10 13:54:00 -07:00
metrics.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
netfilter.c
netfilter: ipv4: remove useless export_symbol
2019-01-28 11:32:58 +01:00
netlink.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
nexthop.c
net: nexthop: don't allow empty NHA_GROUP
2020-08-22 12:39:55 -07:00
ping.c
ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
2020-07-07 15:26:37 -07:00
proc.c
tcp: add SNMP counter for no. of duplicate segments reported by DSACK
2020-07-17 12:54:30 -07:00
protocol.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
raw_diag.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-03-12 22:34:48 -07:00
raw.c
net: Fix some comments
2020-08-27 07:55:59 -07:00
route.c
ipv4: Update exception handling for multipath routes via same device
2020-09-15 15:44:09 -07:00
syncookies.c
tcp: fix build fong CONFIG_MPTCP=n
2020-08-01 11:46:29 -07:00
sysctl_net_ipv4.c
tcp: correct read of TFO keys on big endian systems
2020-08-10 12:12:35 -07:00
tcp_bbr.c
tcp_bbr: improve arithmetic division in bbr_update_bw()
2020-01-21 10:45:49 +01:00
tcp_bic.c
tcp: fix stretch ACK bugs in BIC
2020-03-16 18:26:54 -07:00
tcp_bpf.c
bpf: tcp: Recv() should return 0 when the peer socket is closed
2020-06-12 15:10:12 -07:00
tcp_cdg.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_cong.c
tcp: make sure listeners don't initialize congestion-control state
2020-07-09 13:07:45 -07:00
tcp_cubic.c
tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
2020-06-25 16:08:47 -07:00
tcp_dctcp.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp_dctcp.h
…
tcp_diag.c
inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data
2020-02-27 18:50:19 -08:00
tcp_fastopen.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-08-13 20:03:11 -07:00
tcp_highspeed.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_htcp.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_hybla.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_illinois.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_input.c
tcp: apply a floor of 1 for RTT samples from TCP timestamps
2020-08-03 17:54:03 -07:00
tcp_ipv4.c
bpf: Refactor to provide aux info to bpf_iter_init_seq_priv_t
2020-07-25 20:16:32 -07:00
tcp_lp.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_metrics.c
net-tcp: Disable TCP ssthresh metrics cache by default
2019-12-09 20:17:48 -08:00
tcp_minisocks.c
mptcp: add new sock flag to deal with join subflows
2020-05-15 12:30:13 -07:00
tcp_nv.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_offload.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp_output.c
tcp: rename request_sock cookie_ts bit to syncookie
2020-07-31 16:55:32 -07:00
tcp_rate.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
tcp_recovery.c
…
tcp_scalable.c
tcp: fix stretch ACK bugs in Scalable
2020-03-16 18:26:54 -07:00
tcp_timer.c
net: ipv4: kerneldoc fixes
2020-07-13 17:20:39 -07:00
tcp_ulp.c
bpf: sockmap: Only check ULP for TCP sockets
2020-03-09 22:34:58 +01:00
tcp_vegas.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_vegas.h
…
tcp_veno.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_westwood.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_yeah.c
tcp: fix stretch ACK bugs in Yeah
2020-03-16 18:26:55 -07:00
tcp.c
tcp: correct read of TFO keys on big endian systems
2020-08-10 12:12:35 -07:00
tunnel4.c
tunnel4: add cb_handler to struct xfrm_tunnel
2020-07-09 12:51:36 +02:00
udp_bpf.c
bpf: Add sockmap hooks for UDP sockets
2020-03-09 22:34:58 +01:00
udp_diag.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-03-12 22:34:48 -07:00
udp_impl.h
net: pass a sockptr_t into ->setsockopt
2020-07-24 15:41:54 -07:00
udp_offload.c
udp: initialize is_flist with 0 in udp_gro_receive
2020-03-30 10:35:03 -07:00
udp_tunnel_core.c
udp_tunnel: add central NIC RX port offload infrastructure
2020-07-10 13:54:00 -07:00
udp_tunnel_nic.c
udp_tunnel: add the ability to hard-code IANA VXLAN
2020-08-03 10:13:54 -07:00
udp_tunnel_stub.c
udp_tunnel: add central NIC RX port offload infrastructure
2020-07-10 13:54:00 -07:00
udp.c
udp, bpf: Ignore connections in reuseport group after BPF sk lookup
2020-07-31 02:00:48 +02:00
udplite.c
net/ipv4: remove compat_ip_{get,set}sockopt
2020-07-19 18:16:41 -07:00
xfrm4_input.c
xfrm: state: remove extract_input indirection from xfrm_state_afinfo
2020-05-06 09:40:08 +02:00
xfrm4_output.c
xfrm: fix unused variable warning if CONFIG_NETFILTER=n
2020-05-11 15:12:27 +02:00
xfrm4_policy.c
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2019-12-24 22:28:54 -08:00
xfrm4_protocol.c
xfrm: add route lookup to xfrm4_rcv_encap
2019-12-09 09:59:07 +01:00
xfrm4_state.c
xfrm: remove output_finish indirection from xfrm_state_afinfo
2020-05-06 09:40:08 +02:00
xfrm4_tunnel.c
xfrm: remove type and offload_type map from xfrm_state_afinfo
2019-06-06 08:34:50 +02:00