linux_dsm_epyc7002/net
Cong Wang 47733f9daf tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
__tipc_nl_compat_dumpit() has two callers, and it expects them to
pass a valid nlmsghdr via arg->data. This header is artificial and
crafted just for __tipc_nl_compat_dumpit().

tipc_nl_compat_publ_dump() does so by putting a genlmsghdr as well
as some nested attribute, TIPC_NLA_SOCK. But the other caller
tipc_nl_compat_dumpit() does not, this leaves arg->data uninitialized
on this call path.

Fix this by just adding a similar nlmsghdr without any payload in
tipc_nl_compat_dumpit().

This bug exists since day 1, but the recent commit 6ea67769ff
("net: tipc: prepare attrs in __tipc_nl_compat_dumpit()") makes it
easier to appear.

Reported-and-tested-by: syzbot+0e7181deafa7e0b79923@syzkaller.appspotmail.com
Fixes: d0796d1ef6 ("tipc: convert legacy nl bearer dump to nl compat")
Cc: Jon Maloy <jmaloy@redhat.com>
Cc: Ying Xue <ying.xue@windriver.com>
Cc: Richard Alpe <richard.alpe@ericsson.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-16 21:03:19 -07:00
..
6lowpan
9p
802
8021q
appletalk
atm mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
ax25
batman-adv
bluetooth mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
bpf
bpfilter
bridge netfilter: ebtables: reject bogus getopt len value 2020-08-14 11:59:08 +02:00
caif
can can: j1939: add rxtimer for multipacket broadcast session 2020-08-15 11:12:58 +02:00
ceph
core net: Fix potential wrong skb->protocol in skb_vlan_untag() 2020-08-16 15:33:49 -07:00
dcb
dccp
decnet
dns_resolver
dsa
ethernet
ethtool
hsr
ieee802154
ife
ipv4 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-08-13 20:03:11 -07:00
ipv6 netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency 2020-08-13 04:16:15 +02:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc
mac80211 mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
mac802154 mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
mpls
mptcp mptcp: sendmsg: reset iter on error 2020-08-14 14:11:37 -07:00
ncsi
netfilter Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2020-08-16 16:05:36 -07:00
netlabel
netlink - Add support to enable/disable the thermal zones resulting on core code and 2020-08-06 18:10:55 -07:00
netrom
nfc net/nfc/rawsock.c: add CAP_NET_RAW check. 2020-08-11 10:34:30 -07:00
nsh
openvswitch net: openvswitch: introduce common code for flushing flows 2020-08-13 15:53:30 -07:00
packet af_packet: TPACKET_V3: fix fill status rwlock imbalance 2020-08-13 15:37:30 -07:00
phonet
psample
qrtr
rds
rfkill
rose
rxrpc
sched
sctp mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
smc
strparser
sunrpc Highlights: 2020-08-09 13:58:04 -07:00
switchdev
tipc tipc: fix uninit skb->data in tipc_nl_compat_dumpit() 2020-08-16 21:03:19 -07:00
tls net/tls: Fix kmap usage 2020-08-11 10:20:34 -07:00
unix
vmw_vsock vsock: fix potential null pointer dereference in vsock_poll() 2020-08-12 12:56:06 -07:00
wimax
wireless mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
x25
xdp
xfrm A set of locking fixes and updates: 2020-08-10 19:07:44 -07:00
compat.c net/scm: Fix typo in SCM_RIGHTS compat refactoring 2020-08-07 12:43:25 -07:00
devres.c
Kconfig
Makefile
socket.c net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces" 2020-08-10 12:06:44 -07:00
sysctl_net.c