From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, kernel test robot <rong.a.chen@intel.com>,
Dmitry Safonov <dima@arista.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 06/17] netlink: Dont shift with UB on nlk->ngroups
Date: Tue, 7 Aug 2018 20:51:42 +0200 [thread overview]
Message-ID: <20180807172342.511324554@linuxfoundation.org> (raw)
In-Reply-To: <20180807172342.071526922@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <dima@arista.com>
[ Upstream commit 61f4b23769f0cc72ae62c9a81cf08f0397d40da8 ]
On i386 nlk->ngroups might be 32 or 0. Which leads to UB, resulting in
hang during boot.
Check for 0 ngroups and use (unsigned long long) as a type to shift.
Fixes: 7acf9d4237c4 ("netlink: Do not subscribe to non-existent groups").
Reported-by: kernel test robot <rong.a.chen@intel.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netlink/af_netlink.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -985,7 +985,11 @@ static int netlink_bind(struct socket *s
if (err)
return err;
}
- groups &= (1UL << nlk->ngroups) - 1;
+
+ if (nlk->ngroups == 0)
+ groups = 0;
+ else
+ groups &= (1ULL << nlk->ngroups) - 1;
bound = nlk->bound;
if (bound) {
next prev parent reply other threads:[~2018-08-07 18:55 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-07 18:51 [PATCH 4.9 00/17] 4.9.119-stable review Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 01/17] scsi: qla2xxx: Fix ISP recovery on unload Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 02/17] scsi: qla2xxx: Return error when TMF returns Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 03/17] genirq: Make force irq threading setup more robust Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 04/17] nohz: Fix local_timer_softirq_pending() Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 05/17] netlink: Do not subscribe to non-existent groups Greg Kroah-Hartman
2018-08-07 18:51 ` Greg Kroah-Hartman [this message]
2018-08-07 18:51 ` [PATCH 4.9 07/17] netlink: Dont shift on 64 for ngroups Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 08/17] ext4: fix false negatives *and* false positives in ext4_check_descriptors() Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 09/17] ACPI / PCI: Bail early in acpi_pci_add_bus() if there is no ACPI handle Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 10/17] ring_buffer: tracing: Inherit the tracing setting to next ring buffer Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 12/17] Btrfs: fix file data corruption after cloning a range and fsync Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 13/17] tcp: add tcp_ooo_try_coalesce() helper Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 14/17] kmemleak: clear stale pointers from task stacks Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 15/17] fork: unconditionally clear stack on fork Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 16/17] IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 4.9 17/17] jfs: Fix inconsistency between memory allocation and ea_buf->max_size Greg Kroah-Hartman
2018-08-07 22:32 ` [PATCH 4.9 00/17] 4.9.119-stable review Nathan Chancellor
2018-08-08 2:56 ` Shuah Khan
2018-08-08 5:22 ` Naresh Kamboju
2018-08-08 15:47 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180807172342.511324554@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=dima@arista.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rong.a.chen@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.