From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.6 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF830C43387 for ; Mon, 7 Jan 2019 13:11:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 979BA2089F for ; Mon, 7 Jan 2019 13:11:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1546866661; bh=IEVSNX9tgVaqqhZMmwuHULrWU+d+8HgHgaPWJt4BHuc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=wmhD6uGSTvDWmsPTfW/6xvQATl4dKnX3zLEyZDUvVu2AqsWbwjVOp6wSuEZD0Rom/ bwBe4G24HMOstkNFeOXJ+BZVPxOyFujU6yL9VFv7Jjf1Bdsr0j8Rg791P6Bm3nXAWr jg+jChHby33iZ86z5eqnVgPEvL/II24KXKIx0498= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731704AbfAGNIv (ORCPT ); Mon, 7 Jan 2019 08:08:51 -0500 Received: from mail.kernel.org ([198.145.29.99]:55906 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731204AbfAGNIu (ORCPT ); Mon, 7 Jan 2019 08:08:50 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D07F8218A3; Mon, 7 Jan 2019 13:08:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1546866529; bh=IEVSNX9tgVaqqhZMmwuHULrWU+d+8HgHgaPWJt4BHuc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mM1cTTiW7f2BqQxS3ipdelqk6Rm7lW/Lx2fXomT86eHUwFfelrwwo9r6XZ3rM/BFu 0zZ3Jld0yMLyknVfx8fVsOyK/nwt387g8GvmTCSLV0drYdDvciQcM5pF2vFWC01jWI Y+ATNeUmT82cJqt2M/S0AzqPJS0sZBcBhHMY+xVQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+eb4da3a20fad2e52555d@syzkaller.appspotmail.com, Ying Xue , Jon Maloy , Cong Wang , "David S. Miller" Subject: [PATCH 4.9 24/71] tipc: compare remote and local protocols in tipc_udp_enable() Date: Mon, 7 Jan 2019 13:32:53 +0100 Message-Id: <20190107105334.179236891@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190107105330.280153213@linuxfoundation.org> References: <20190107105330.280153213@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Cong Wang [ Upstream commit fb83ed496b9a654f60cd1d58a0e1e79ec5694808 ] When TIPC_NLA_UDP_REMOTE is an IPv6 mcast address but TIPC_NLA_UDP_LOCAL is an IPv4 address, a NULL-ptr deref is triggered as the UDP tunnel sock is initialized to IPv4 or IPv6 sock merely based on the protocol in local address. We should just error out when the remote address and local address have different protocols. Reported-by: syzbot+eb4da3a20fad2e52555d@syzkaller.appspotmail.com Cc: Ying Xue Cc: Jon Maloy Signed-off-by: Cong Wang Acked-by: Jon Maloy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/tipc/udp_media.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/net/tipc/udp_media.c +++ b/net/tipc/udp_media.c @@ -674,6 +674,11 @@ static int tipc_udp_enable(struct net *n if (err) goto err; + if (remote.proto != local.proto) { + err = -EINVAL; + goto err; + } + b->bcast_addr.media_id = TIPC_MEDIA_TYPE_UDP; b->bcast_addr.broadcast = 1; rcu_assign_pointer(b->media_ptr, ub);