From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Sean Tranchetti <stranche@codeaurora.org>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 24/48] netlabel: check for IPV4MASK in addrinfo_get
Date: Thu, 18 Oct 2018 19:54:59 +0200 [thread overview]
Message-ID: <20181018175429.297640938@linuxfoundation.org> (raw)
In-Reply-To: <20181018175427.133690306@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Tranchetti <stranche@codeaurora.org>
[ Upstream commit f88b4c01b97e09535505cf3c327fdbce55c27f00 ]
netlbl_unlabel_addrinfo_get() assumes that if it finds the
NLBL_UNLABEL_A_IPV4ADDR attribute, it must also have the
NLBL_UNLABEL_A_IPV4MASK attribute as well. However, this is
not necessarily the case as the current checks in
netlbl_unlabel_staticadd() and friends are not sufficent to
enforce this.
If passed a netlink message with NLBL_UNLABEL_A_IPV4ADDR,
NLBL_UNLABEL_A_IPV6ADDR, and NLBL_UNLABEL_A_IPV6MASK attributes,
these functions will all call netlbl_unlabel_addrinfo_get() which
will then attempt dereference NULL when fetching the non-existent
NLBL_UNLABEL_A_IPV4MASK attribute:
Unable to handle kernel NULL pointer dereference at virtual address 0
Process unlab (pid: 31762, stack limit = 0xffffff80502d8000)
Call trace:
netlbl_unlabel_addrinfo_get+0x44/0xd8
netlbl_unlabel_staticremovedef+0x98/0xe0
genl_rcv_msg+0x354/0x388
netlink_rcv_skb+0xac/0x118
genl_rcv+0x34/0x48
netlink_unicast+0x158/0x1f0
netlink_sendmsg+0x32c/0x338
sock_sendmsg+0x44/0x60
___sys_sendmsg+0x1d0/0x2a8
__sys_sendmsg+0x64/0xb4
SyS_sendmsg+0x34/0x4c
el0_svc_naked+0x34/0x38
Code: 51001149 7100113f 540000a0 f9401508 (79400108)
---[ end trace f6438a488e737143 ]---
Kernel panic - not syncing: Fatal exception
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netlabel/netlabel_unlabeled.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -787,7 +787,8 @@ static int netlbl_unlabel_addrinfo_get(s
{
u32 addr_len;
- if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) {
+ if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] &&
+ info->attrs[NLBL_UNLABEL_A_IPV4MASK]) {
addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
if (addr_len != sizeof(struct in_addr) &&
addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
next prev parent reply other threads:[~2018-10-18 18:05 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-18 17:54 [PATCH 4.4 00/48] 4.4.162-stable review Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 01/48] ASoC: wm8804: Add ACPI support Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 02/48] ASoC: sigmadsp: safeload should not have lower byte limit Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 03/48] selftests/efivarfs: add required kernel configs Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 04/48] mfd: omap-usb-host: Fix dts probe of children Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 05/48] sound: enable interrupt after dma buffer initialization Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 06/48] stmmac: fix valid numbers of unicast filter entries Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 07/48] net: macb: disable scatter-gather for macb on sama5d3 Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 08/48] ARM: dts: at91: add new compatibility string " Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 09/48] drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7 Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 10/48] ext4: add corruption check in ext4_xattr_set_entry() Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 11/48] mm/vmstat.c: fix outdated vmstat_text Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 12/48] mach64: detect the dot clock divider correctly on sparc Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 13/48] perf script python: Fix export-to-postgresql.py occasional failure Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 14/48] i2c: i2c-scmi: fix for i2c_smbus_write_block_data Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 15/48] xhci: Dont print a warning when setting link state for disabled ports Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 16/48] jffs2: return -ERANGE when xattr buffer is too small Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 17/48] bnxt_en: Fix TX timeout during netpoll Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 18/48] bonding: avoid possible dead-lock Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 19/48] ip6_tunnel: be careful when accessing the inner header Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 20/48] ip_tunnel: " Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 21/48] ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 22/48] net: ipv4: update fnhe_pmtu when first hops MTU changes Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 23/48] net/ipv6: Display all addresses in output of /proc/net/if_inet6 Greg Kroah-Hartman
2018-10-18 17:54 ` Greg Kroah-Hartman [this message]
2018-10-18 17:55 ` [PATCH 4.4 25/48] net/usb: cancel pending work when unbinding smsc75xx Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 26/48] qlcnic: fix Tx descriptor corruption on 82xx devices Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 27/48] team: Forbid enslaving team device to itself Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 28/48] net: mvpp2: Extract the correct ethtype from the skb for tx csum offload Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 29/48] net: systemport: Fix wake-up interrupt race during resume Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 30/48] rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096 Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 31/48] KVM: x86: remove eager_fpu field of struct kvm_vcpu_arch Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 32/48] x86/fpu: Remove use_eager_fpu() Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 33/48] x86/fpu: Remove struct fpu::counter Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 34/48] x86/fpu: Finish excising eagerfpu Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 35/48] media: af9035: prevent buffer overflow on write Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 36/48] clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-am43 SoCs Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 37/48] Input: atakbd - fix Atari keymap Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 38/48] Input: atakbd - fix Atari CapsLock behaviour Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 39/48] net/mlx4: Use cpumask_available for eq->affinity_mask Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 40/48] RISC-V: include linux/ftrace.h in asm-prototypes.h Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 41/48] powerpc/tm: Fix userspace r13 corruption Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 42/48] powerpc/tm: Avoid possible userspace r1 corruption on reclaim Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 43/48] ARC: build: Get rid of toolchain check Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 44/48] usb: gadget: serial: fix oops when data rxd after close Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 45/48] Drivers: hv: utils: Invoke the poll function after handshake Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 46/48] Drivers: hv: util: Pass the channel information during the init call Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 47/48] Drivers: hv: kvp: fix IP Failover Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 48/48] HV: properly delay KVP packets when negotiation is in progress Greg Kroah-Hartman
2018-10-19 1:40 ` [PATCH 4.4 00/48] 4.4.162-stable review Nathan Chancellor
2018-10-19 8:40 ` Sebastian Gottschall
2018-10-19 9:15 ` Greg Kroah-Hartman
2018-10-19 13:58 ` Rafael David Tinoco
2018-10-19 19:50 ` Guenter Roeck
2018-10-19 20:47 ` Shuah Khan
2018-10-19 22:30 ` Shuah Khan
2018-10-22 13:05 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181018175429.297640938@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=stranche@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).