* [PATCH] tipc: fix panic in tipc_udp_nl_dump_remoteip() using bearer as udp without check
@ 2025-06-13 5:55 Haixia Qu
2025-06-13 6:44 ` Eric Dumazet
2025-06-13 7:38 ` Haixia Qu
0 siblings, 2 replies; 4+ messages in thread
From: Haixia Qu @ 2025-06-13 5:55 UTC (permalink / raw)
To: Jon Maloy, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman
Cc: Haixia Qu, netdev, tipc-discussion, linux-kernel
When TIPC_NL_UDP_GET_REMOTEIP cmd calls tipc_udp_nl_dump_remoteip()
with media name set to a l2 name, kernel panics [1].
The reproduction steps:
1. create a tun interface
2. enable l2 bearer
3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun
the ub was in fact a struct dev.
when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or
other media when other thread changes it.
fix this by checking media_id.
[1]
tipc: Started in network mode
tipc: Node identity 8af312d38a21, cluster identity 4711
tipc: Enabled bearer <eth:syz_tun>, priority 1
Oops: general protection fault
KASAN: null-ptr-deref in range
CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT
Hardware name: QEMU Ubuntu 24.04 PC
RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0
Signed-off-by: Haixia Qu <hxqu@hillstonenet.com>
---
net/tipc/udp_media.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index 108a4cc2e001..258d6aa4f21a 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -489,7 +489,7 @@ int tipc_udp_nl_dump_remoteip(struct sk_buff *skb, struct netlink_callback *cb)
rtnl_lock();
b = tipc_bearer_find(net, bname);
- if (!b) {
+ if (!b || b->bcast_addr.media_id != TIPC_MEDIA_TYPE_UDP) {
rtnl_unlock();
return -EINVAL;
}
@@ -500,7 +500,7 @@ int tipc_udp_nl_dump_remoteip(struct sk_buff *skb, struct netlink_callback *cb)
rtnl_lock();
b = rtnl_dereference(tn->bearer_list[bid]);
- if (!b) {
+ if (!b || b->bcast_addr.media_id != TIPC_MEDIA_TYPE_UDP) {
rtnl_unlock();
return -EINVAL;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] tipc: fix panic in tipc_udp_nl_dump_remoteip() using bearer as udp without check
2025-06-13 5:55 [PATCH] tipc: fix panic in tipc_udp_nl_dump_remoteip() using bearer as udp without check Haixia Qu
@ 2025-06-13 6:44 ` Eric Dumazet
2025-06-13 7:38 ` Haixia Qu
1 sibling, 0 replies; 4+ messages in thread
From: Eric Dumazet @ 2025-06-13 6:44 UTC (permalink / raw)
To: Haixia Qu
Cc: Jon Maloy, David S. Miller, Jakub Kicinski, Paolo Abeni,
Simon Horman, netdev, tipc-discussion, linux-kernel
On Thu, Jun 12, 2025 at 10:55 PM Haixia Qu <hxqu@hillstonenet.com> wrote:
>
> When TIPC_NL_UDP_GET_REMOTEIP cmd calls tipc_udp_nl_dump_remoteip()
> with media name set to a l2 name, kernel panics [1].
>
> The reproduction steps:
> 1. create a tun interface
> 2. enable l2 bearer
> 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun
>
> the ub was in fact a struct dev.
>
> when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or
> other media when other thread changes it.
>
> fix this by checking media_id.
>
> [1]
> tipc: Started in network mode
> tipc: Node identity 8af312d38a21, cluster identity 4711
> tipc: Enabled bearer <eth:syz_tun>, priority 1
> Oops: general protection fault
> KASAN: null-ptr-deref in range
> CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT
> Hardware name: QEMU Ubuntu 24.04 PC
> RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0
>
> Signed-off-by: Haixia Qu <hxqu@hillstonenet.com>
Please add a FIxes: tag, as instructed in
Documentation/process/maintainer-netdev.rst
Thank you.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] tipc: fix panic in tipc_udp_nl_dump_remoteip() using bearer as udp without check
2025-06-13 5:55 [PATCH] tipc: fix panic in tipc_udp_nl_dump_remoteip() using bearer as udp without check Haixia Qu
2025-06-13 6:44 ` Eric Dumazet
@ 2025-06-13 7:38 ` Haixia Qu
2025-06-13 14:51 ` Jakub Kicinski
1 sibling, 1 reply; 4+ messages in thread
From: Haixia Qu @ 2025-06-13 7:38 UTC (permalink / raw)
To: Jon Maloy, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Richard Alpe
Cc: Haixia Qu, Jon Maloy, netdev, tipc-discussion, linux-kernel
When TIPC_NL_UDP_GET_REMOTEIP cmd calls tipc_udp_nl_dump_remoteip()
with media name set to a l2 name, kernel panics [1].
The reproduction steps:
1. create a tun interface
2. enable l2 bearer
3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun
the ub was in fact a struct dev.
when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or
other media when other thread changes it.
fix this by checking media_id.
[1]
tipc: Started in network mode
tipc: Node identity 8af312d38a21, cluster identity 4711
tipc: Enabled bearer <eth:syz_tun>, priority 1
Oops: general protection fault
KASAN: null-ptr-deref in range
CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT
Hardware name: QEMU Ubuntu 24.04 PC
RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0
Fixes: 832629ca5c31 ("tipc: add UDP remoteip dump to netlink API")
Signed-off-by: Haixia Qu <hxqu@hillstonenet.com>
---
net/tipc/udp_media.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index 108a4cc2e001..258d6aa4f21a 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -489,7 +489,7 @@ int tipc_udp_nl_dump_remoteip(struct sk_buff *skb, struct netlink_callback *cb)
rtnl_lock();
b = tipc_bearer_find(net, bname);
- if (!b) {
+ if (!b || b->bcast_addr.media_id != TIPC_MEDIA_TYPE_UDP) {
rtnl_unlock();
return -EINVAL;
}
@@ -500,7 +500,7 @@ int tipc_udp_nl_dump_remoteip(struct sk_buff *skb, struct netlink_callback *cb)
rtnl_lock();
b = rtnl_dereference(tn->bearer_list[bid]);
- if (!b) {
+ if (!b || b->bcast_addr.media_id != TIPC_MEDIA_TYPE_UDP) {
rtnl_unlock();
return -EINVAL;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] tipc: fix panic in tipc_udp_nl_dump_remoteip() using bearer as udp without check
2025-06-13 7:38 ` Haixia Qu
@ 2025-06-13 14:51 ` Jakub Kicinski
0 siblings, 0 replies; 4+ messages in thread
From: Jakub Kicinski @ 2025-06-13 14:51 UTC (permalink / raw)
To: Haixia Qu
Cc: Jon Maloy, David S. Miller, Eric Dumazet, Paolo Abeni,
Simon Horman, Richard Alpe, Jon Maloy, netdev, tipc-discussion,
linux-kernel
On Fri, 13 Jun 2025 07:38:26 +0000 Haixia Qu wrote:
> When TIPC_NL_UDP_GET_REMOTEIP cmd calls tipc_udp_nl_dump_remoteip()
> with media name set to a l2 name, kernel panics [1].
Please take the time and read the doc Eric mentioned to you.
You're doing other things wrong, too.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-06-13 14:51 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-06-13 5:55 [PATCH] tipc: fix panic in tipc_udp_nl_dump_remoteip() using bearer as udp without check Haixia Qu
2025-06-13 6:44 ` Eric Dumazet
2025-06-13 7:38 ` Haixia Qu
2025-06-13 14:51 ` Jakub Kicinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).