[PATCH net 0/2] tipc: Better check user provided attributes

[PATCH net 0/2] tipc: Better check user provided attributes

[Eric Dumazet]

syzbot reported a crash in __tipc_nl_net_set()

While fixing it, I also had to fix an old bug involving TIPC_NLA_NET_ADDR

Eric Dumazet (2):
  tipc: add policy for TIPC_NLA_NET_ADDR
  tipc: fix possible crash in __tipc_nl_net_set()

 net/tipc/net.c     | 2 ++
 net/tipc/netlink.c | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

-- 
2.17.0.484.g0c8726318c-goog

[PATCH net 1/2] tipc: add policy for TIPC_NLA_NET_ADDR

[Eric Dumazet]

Before syzbot/KMSAN bites, add the missing policy for TIPC_NLA_NET_ADDR

Fixes: 27c21416727a ("tipc: add net set to new netlink api")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
---
 net/tipc/netlink.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index b76f13f6fea10a53d00ed14a38cdf5cdf7afa44c..d4e0bbeee72793a060befaf8a9d0239731c0d48c 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -79,7 +79,8 @@ const struct nla_policy tipc_nl_sock_policy[TIPC_NLA_SOCK_MAX + 1] = {
 
 const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {
 	[TIPC_NLA_NET_UNSPEC]		= { .type = NLA_UNSPEC },
-	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 }
+	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 },
+	[TIPC_NLA_NET_ADDR]		= { .type = NLA_U32 },
 };
 
 const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
-- 
2.17.0.484.g0c8726318c-goog

[PATCH net 2/2] tipc: fix possible crash in __tipc_nl_net_set()

[Eric Dumazet]

syzbot reported a crash in __tipc_nl_net_set() caused by NULL dereference.

We need to check that both TIPC_NLA_NET_NODEID and TIPC_NLA_NET_NODEID_W1
are present.

We also need to make sure userland provided u64 attributes.

Fixes: d50ccc2d3909 ("tipc: add 128-bit node identifier")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
 net/tipc/net.c     | 2 ++
 net/tipc/netlink.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/net/tipc/net.c b/net/tipc/net.c
index 856f9e97ea293210bea1d2003d2092482732ace9..4fbaa0464405370601cb2fd1dd3b03733836d342 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -252,6 +252,8 @@ int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
 		u64 *w0 = (u64 *)&node_id[0];
 		u64 *w1 = (u64 *)&node_id[8];
 
+		if (!attrs[TIPC_NLA_NET_NODEID_W1])
+			return -EINVAL;
 		*w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]);
 		*w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]);
 		tipc_net_init(net, node_id, 0);
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index d4e0bbeee72793a060befaf8a9d0239731c0d48c..6ff2254088f647d4f7410c3335ccdae2e68ec522 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -81,6 +81,8 @@ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {
 	[TIPC_NLA_NET_UNSPEC]		= { .type = NLA_UNSPEC },
 	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 },
 	[TIPC_NLA_NET_ADDR]		= { .type = NLA_U32 },
+	[TIPC_NLA_NET_NODEID]		= { .type = NLA_U64 },
+	[TIPC_NLA_NET_NODEID_W1]	= { .type = NLA_U64 },
 };
 
 const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
-- 
2.17.0.484.g0c8726318c-goog

RE: [PATCH net 0/2] tipc: Better check user provided attributes

[Jon Maloy]

Acked-by: Jon Maloy <jon.maloy@ericsson.com>

Thank you, Eric.


> -----Original Message-----
> From: netdev-owner@vger.kernel.org [mailto:netdev-
> owner@vger.kernel.org] On Behalf Of Eric Dumazet
> Sent: Monday, April 16, 2018 11:30
> To: David S . Miller <davem@davemloft.net>
> Cc: netdev <netdev@vger.kernel.org>; Eric Dumazet
> <edumazet@google.com>; Eric Dumazet <eric.dumazet@gmail.com>
> Subject: [PATCH net 0/2] tipc: Better check user provided attributes
> 
> syzbot reported a crash in __tipc_nl_net_set()
> 
> While fixing it, I also had to fix an old bug involving TIPC_NLA_NET_ADDR
> 
> Eric Dumazet (2):
>   tipc: add policy for TIPC_NLA_NET_ADDR
>   tipc: fix possible crash in __tipc_nl_net_set()
> 
>  net/tipc/net.c     | 2 ++
>  net/tipc/netlink.c | 5 ++++-
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> --
> 2.17.0.484.g0c8726318c-goog

Re: [PATCH net 0/2] tipc: Better check user provided attributes

[David Miller]

From: Jon Maloy <jon.maloy@ericsson.com>
Date: Mon, 16 Apr 2018 19:21:44 +0000

> Acked-by: Jon Maloy <jon.maloy@ericsson.com>
> 
> Thank you, Eric.

Series applied and patch #1 queued up for -stable, thanks Eric.

Re: [PATCH net 1/2] tipc: add policy for TIPC_NLA_NET_ADDR

[Ying Xue]

On 04/16/2018 11:29 PM, Eric Dumazet wrote:
> Before syzbot/KMSAN bites, add the missing policy for TIPC_NLA_NET_ADDR
> 
> Fixes: 27c21416727a ("tipc: add net set to new netlink api")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Jon Maloy <jon.maloy@ericsson.com>
> Cc: Ying Xue <ying.xue@windriver.com>

Acked-by: Ying Xue <ying.xue@windriver.com>

> ---
>  net/tipc/netlink.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
> index b76f13f6fea10a53d00ed14a38cdf5cdf7afa44c..d4e0bbeee72793a060befaf8a9d0239731c0d48c 100644
> --- a/net/tipc/netlink.c
> +++ b/net/tipc/netlink.c
> @@ -79,7 +79,8 @@ const struct nla_policy tipc_nl_sock_policy[TIPC_NLA_SOCK_MAX + 1] = {
>  
>  const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {
>  	[TIPC_NLA_NET_UNSPEC]		= { .type = NLA_UNSPEC },
> -	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 }
> +	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 },
> +	[TIPC_NLA_NET_ADDR]		= { .type = NLA_U32 },
>  };
>  
>  const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
> 

Re: [PATCH net 2/2] tipc: fix possible crash in __tipc_nl_net_set()

[Ying Xue]

On 04/16/2018 11:29 PM, Eric Dumazet wrote:
> syzbot reported a crash in __tipc_nl_net_set() caused by NULL dereference.
> 
> We need to check that both TIPC_NLA_NET_NODEID and TIPC_NLA_NET_NODEID_W1
> are present.
> 
> We also need to make sure userland provided u64 attributes.
> 
> Fixes: d50ccc2d3909 ("tipc: add 128-bit node identifier")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Jon Maloy <jon.maloy@ericsson.com>
> Cc: Ying Xue <ying.xue@windriver.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>

Acked-by: Ying Xue <ying.xue@windriver.com>

> ---
>  net/tipc/net.c     | 2 ++
>  net/tipc/netlink.c | 2 ++
>  2 files changed, 4 insertions(+)
> 
> diff --git a/net/tipc/net.c b/net/tipc/net.c
> index 856f9e97ea293210bea1d2003d2092482732ace9..4fbaa0464405370601cb2fd1dd3b03733836d342 100644
> --- a/net/tipc/net.c
> +++ b/net/tipc/net.c
> @@ -252,6 +252,8 @@ int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
>  		u64 *w0 = (u64 *)&node_id[0];
>  		u64 *w1 = (u64 *)&node_id[8];
>  
> +		if (!attrs[TIPC_NLA_NET_NODEID_W1])
> +			return -EINVAL;
>  		*w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]);
>  		*w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]);
>  		tipc_net_init(net, node_id, 0);
> diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
> index d4e0bbeee72793a060befaf8a9d0239731c0d48c..6ff2254088f647d4f7410c3335ccdae2e68ec522 100644
> --- a/net/tipc/netlink.c
> +++ b/net/tipc/netlink.c
> @@ -81,6 +81,8 @@ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {
>  	[TIPC_NLA_NET_UNSPEC]		= { .type = NLA_UNSPEC },
>  	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 },
>  	[TIPC_NLA_NET_ADDR]		= { .type = NLA_U32 },
> +	[TIPC_NLA_NET_NODEID]		= { .type = NLA_U64 },
> +	[TIPC_NLA_NET_NODEID_W1]	= { .type = NLA_U64 },
>  };
>  
>  const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
>