AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-23 06:57:49 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
797060ec42
linux_dsm_epyc7002/net/tipc
History
Xin Long 4f07b80c97 tipc: check msg->req data len in tipc_nl_compat_bearer_disable 
This patch is to fix an uninit-value issue, reported by syzbot:

  BUG: KMSAN: uninit-value in memchr+0xce/0x110 lib/string.c:981
  Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x191/0x1f0 lib/dump_stack.c:113
    kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622
    __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310
    memchr+0xce/0x110 lib/string.c:981
    string_is_valid net/tipc/netlink_compat.c:176 [inline]
    tipc_nl_compat_bearer_disable+0x2a1/0x480 net/tipc/netlink_compat.c:449
    __tipc_nl_compat_doit net/tipc/netlink_compat.c:327 [inline]
    tipc_nl_compat_doit+0x3ac/0xb00 net/tipc/netlink_compat.c:360
    tipc_nl_compat_handle net/tipc/netlink_compat.c:1178 [inline]
    tipc_nl_compat_recv+0x1b1b/0x27b0 net/tipc/netlink_compat.c:1281

TLV_GET_DATA_LEN() may return a negtive int value, which will be
used as size_t (becoming a big unsigned long) passed into memchr,
cause this issue.

Similar to what it does in tipc_nl_compat_bearer_enable(), this
fix is to return -EINVAL when TLV_GET_DATA_LEN() is negtive in
tipc_nl_compat_bearer_disable(), as well as in
tipc_nl_compat_link_stat_dump() and tipc_nl_compat_link_reset_stats().

v1->v2:
  - add the missing Fixes tags per Eric's request.

Fixes: 0762216c0a ("tipc: fix uninit-value in tipc_nl_compat_bearer_enable")
Fixes: 8b66fee7f8 ("tipc: fix uninit-value in tipc_nl_compat_link_reset_stats")
Reported-by: syzbot+30eaa8bf392f7fafffaf@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-06-24 10:03:59 -07:00
..
addr.c
addr.h
bcast.c tipc: add NULL pointer check 2019-04-04 17:34:11 -07:00
bcast.h tipc: fix a null pointer deref 2019-03-21 09:56:55 -07:00
bearer.c netlink: make validation more configurable for future strictness 2019-04-27 17:07:21 -04:00
bearer.h tipc: enable tracepoints in tipc 2018-12-19 11:49:24 -08:00
core.c tipc: change to use register_pernet_device 2019-06-22 16:51:47 -07:00
core.h tipc: introduce new capability flag for cluster 2019-03-19 13:56:17 -07:00
diag.c
discover.c tipc: fix lockdep warning when reinitilaizing sockets 2018-11-17 22:01:31 -08:00
discover.h
eth_media.c
group.c tipc: purge deferredq list for each grp member in tipc_group_delete 2019-06-16 20:42:05 -07:00
group.h
ib_media.c
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
link.c tipc: fix issues with early FAILOVER_MSG from peer 2019-06-18 10:03:37 -07:00
link.h tipc: fix missing Name entries due to half-failover 2019-05-04 00:59:51 -04:00
Makefile tipc: enable tracepoints in tipc 2018-12-19 11:49:24 -08:00
monitor.c netlink: make nla_nest_start() add NLA_F_NESTED flag 2019-04-27 17:03:44 -04:00
monitor.h
msg.c
msg.h tipc: reduce duplicate packets for unicast traffic 2019-04-04 18:29:25 -07:00
name_distr.c
name_distr.h
name_table.c netlink: make nla_nest_start() add NLA_F_NESTED flag 2019-04-27 17:03:44 -04:00
name_table.h
net.c netlink: make validation more configurable for future strictness 2019-04-27 17:07:21 -04:00
net.h tipc: fix lockdep warning when reinitilaizing sockets 2018-11-17 22:01:31 -08:00
netlink_compat.c tipc: check msg->req data len in tipc_nl_compat_bearer_disable 2019-06-24 10:03:59 -07:00
netlink.c genetlink: optionally validate strictly/dumps 2019-04-27 17:07:22 -04:00
netlink.h
node.c tipc: fix issues with early FAILOVER_MSG from peer 2019-06-18 10:03:37 -07:00
node.h tipc: improve TIPC throughput by Gap ACK blocks 2019-04-04 18:29:25 -07:00
socket.c tipc: fix hanging clients using poll with EPOLLOUT flag 2019-05-09 09:26:09 -07:00
socket.h tipc: add trace_events for tipc socket 2018-12-19 11:49:24 -08:00
subscr.c
subscr.h tipc: fix modprobe tipc failed after switch order of device registration 2019-05-20 10:45:43 -07:00
sysctl.c tipc: set sysctl_tipc_rmem and named_timeout right range 2019-04-16 21:32:02 -07:00
topsrv.c tipc: fix modprobe tipc failed after switch order of device registration 2019-05-20 10:45:43 -07:00
topsrv.h
trace.c tipc: remove unneeded semicolon in trace.c 2019-01-17 22:04:43 -08:00
trace.h tipc: add trace_events for tipc bearer 2018-12-19 11:49:25 -08:00
udp_media.c tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb 2019-06-18 20:48:45 -04:00
udp_media.h