iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/core
History
Ido Schimmel 30188bd783 rtnetlink: Reject negative ifindexes in RTM_NEWLINK 
Negative ifindexes are illegal, but the kernel does not validate the
ifindex in the ancillary header of RTM_NEWLINK messages, resulting in
the kernel generating a warning [1] when such an ifindex is specified.

Fix by rejecting negative ifindexes.

[1]
WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593
[...]
Call Trace:
 <TASK>
 register_netdevice+0x69a/0x1490 net/core/dev.c:10081
 br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552
 rtnl_newlink_create net/core/rtnetlink.c:3471 [inline]
 __rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688
 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701
 rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910
 sock_sendmsg_nosec net/socket.c:728 [inline]
 sock_sendmsg+0xd9/0x180 net/socket.c:751
 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2538
 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2592
 __sys_sendmsg+0x117/0x1e0 net/socket.c:2621
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fixes: 38f7b870d4a6 ("[RTNETLINK]: Link creation API")
Reported-by: syzbot+5ba06978f34abb058571@syzkaller.appspotmail.com
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/r/20230823064348.2252280-1-idosch@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2023-08-24 09:45:52 +02:00
..
bpf_sk_storage.c
bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
2023-07-27 10:07:56 -07:00
datagram.c
net: datagram: fix data-races in datagram_poll()
2023-05-10 19:06:49 -07:00
dev_addr_lists_test.c
kunit: Use KUNIT_EXPECT_MEMEQ macro
2022-10-27 02:40:14 -06:00
dev_addr_lists.c
net: extract a few internals from netdevice.h
2022-04-07 20:32:09 -07:00
dev_ioctl.c
net: dsa: replace NETDEV_PRE_CHANGE_HWTSTAMP notifier with a stub
2023-04-09 15:35:49 +01:00
dev.c
net: fix net device address assign type
2023-06-22 19:55:12 -07:00
dev.h
net-sysctl: factor-out rpm mask manipulation helpers
2023-02-09 17:45:55 -08:00
drop_monitor.c
net: extend drop reasons for multiple subsystems
2023-04-20 20:20:49 -07:00
dst_cache.c
wireguard: device: reset peer src endpoint when netns exits
2021-11-29 19:50:45 -08:00
dst.c
net: dst: fix missing initialization of rt_uncached
2023-04-21 20:26:56 -07:00
failover.c
net: failover: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf
2022-12-12 15:18:25 -08:00
fib_notifier.c
…
fib_rules.c
fib: expand fib_rule_policy
2021-12-16 07:18:35 -08:00
filter.c
net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()
2023-08-07 19:14:41 -07:00
flow_dissector.c
net: flow_dissector: add support for cfm packets
2023-06-12 17:01:45 -07:00
flow_offload.c
net: flow_offload: add support for ARP frame matching
2022-11-14 11:24:16 +00:00
gen_estimator.c
treewide: Convert del_timer*() to timer_shutdown*()
2022-12-25 13:38:09 -08:00
gen_stats.c
net: Remove the obsolte u64_stats_fetch_*_irq() users (net).
2022-10-28 20:13:54 -07:00
gro_cells.c
net: drop the weight argument from netif_napi_add
2022-09-28 18:57:14 -07:00
gro.c
gro: move the tc_ext comparison to a helper
2023-06-18 18:08:35 +01:00
gso.c
net: move gso declarations and functions to their own files
2023-06-10 00:11:41 -07:00
hwbm.c
…
link_watch.c
net: linkwatch: only report IF_OPER_LOWERLAYERDOWN if iflink is actually down
2022-11-16 09:45:00 +00:00
lwt_bpf.c
bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook
2022-04-22 17:45:25 +02:00
lwtunnel.c
xfrm: lwtunnel: squelch kernel warning in case XFRM encap type is not available
2022-10-12 10:45:51 +02:00
Makefile
net: move gso declarations and functions to their own files
2023-06-10 00:11:41 -07:00
neighbour.c
neighbour: switch to standard rcu, instead of rcu_bh
2023-03-21 21:32:18 -07:00
net_namespace.c
lib/ref_tracker: improve printing stats
2023-06-05 15:28:42 -07:00
net-procfs.c
net-sysfs: display two backlog queue len separately
2023-03-22 12:03:52 +01:00
net-sysfs.c
net: make default_rps_mask a per netns attribute
2023-02-20 11:22:54 +00:00
net-sysfs.h
…
net-traces.c
udp6: add a missing call into udp_fail_queue_rcv_skb tracepoint
2023-07-07 09:16:52 +01:00
netclassid_cgroup.c
core: Variable type completion
2022-08-31 09:40:34 +01:00
netdev-genl-gen.c
net: ynl: prefix uAPI header include with uapi/
2023-05-26 10:30:14 +01:00
netdev-genl-gen.h
net: ynl: prefix uAPI header include with uapi/
2023-05-26 10:30:14 +01:00
netdev-genl.c
netdev-genl: create a simple family for netdev stuff
2023-02-02 20:48:23 -08:00
netevent.c
net: core: Correct function name netevent_unregister_notifier() in the kerneldoc
2021-03-28 17:56:56 -07:00
netpoll.c
netpoll: allocate netdev tracker right away
2023-06-15 08:21:11 +01:00
netprio_cgroup.c
bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode
2021-09-13 16:35:58 -07:00
of_net.c
of: net: export of_get_mac_address_nvmem()
2022-11-29 10:45:53 +01:00
page_pool.c
page_pool: fix inconsistency for page_pool_ring_[un]lock()
2023-05-23 20:25:13 -07:00
pktgen.c
net: introduce and use skb_frag_fill_page_desc()
2023-05-13 19:47:56 +01:00
ptp_classifier.c
ptp: Add generic PTP is_sync() function
2022-03-07 11:31:34 +00:00
request_sock.c
…
rtnetlink.c
rtnetlink: Reject negative ifindexes in RTM_NEWLINK
2023-08-24 09:45:52 +02:00
scm.c
net: Ensure ->msg_control_user is used for user buffers
2023-04-14 11:09:27 +01:00
secure_seq.c
tcp: Fix data-races around sysctl knobs related to SYN option.
2022-07-20 10:14:49 +01:00
selftests.c
net: core: constify mac addrs in selftests
2021-10-24 13:59:44 +01:00
skbuff.c
net: prevent skb corruption on frag list segmentation
2023-07-08 10:03:26 +01:00
skmsg.c
bpf, sockmap: Fix bug that strp_done cannot be called
2023-08-09 20:29:02 -07:00
sock_destructor.h
skb_expand_head() adjust skb->truesize incorrectly
2021-10-22 12:35:51 -07:00
sock_diag.c
net: fix __sock_gen_cookie()
2022-11-21 20:36:30 -08:00
sock_map.c
bpf, sockmap: Fix map type error in sock_map_del_link
2023-08-09 20:29:02 -07:00
sock_reuseport.c
soreuseport: Fix socket selection for SO_INCOMING_CPU.
2022-10-25 11:35:16 +02:00
sock.c
sock: Fix misuse of sk_under_memory_pressure()
2023-08-17 11:34:36 -07:00
stream.c
net: deal with most data-races in sk_wait_event()
2023-05-10 10:03:32 +01:00
sysctl_net_core.c
net/sysctl: Rename kvfree_rcu() to kvfree_rcu_mightsleep()
2023-04-05 13:48:04 +00:00
timestamping.c
…
tso.c
net: tso: inline tso_count_descs()
2022-12-12 15:04:39 -08:00
utils.c
net: core: inet[46]_pton strlen len types
2022-11-01 21:14:39 -07:00
xdp.c
xdp: use trusted arguments in XDP hints kfuncs
2023-07-11 20:04:50 -07:00