From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26957C433F5 for ; Fri, 12 Nov 2021 07:23:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 090BC60C40 for ; Fri, 12 Nov 2021 07:23:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233737AbhKLHZz (ORCPT ); Fri, 12 Nov 2021 02:25:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230510AbhKLHZx (ORCPT ); Fri, 12 Nov 2021 02:25:53 -0500 Received: from mail-ed1-x533.google.com (mail-ed1-x533.google.com [IPv6:2a00:1450:4864:20::533]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 58851C061766; Thu, 11 Nov 2021 23:23:03 -0800 (PST) Received: by mail-ed1-x533.google.com with SMTP id o8so33927663edc.3; Thu, 11 Nov 2021 23:23:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GML/j0biHkMPIhr228qPRBmmjkAdp6WUxiI0Aqk8uDw=; b=LP70yhUbcWoPkhFEpzd5rLCtJCOYN5XyCgWXBV9HBT+mFUoDXRSJXOWBQFfmm+dupJ iF/HxQmpvRF+BL6sRCQnXwGif6iZc/27sfGrZ+uFLncyrEjIkre93D1XCzN4wqBoJpm1 9JNONC0Fu+Xfg6c7mMgPyda3QLuA3NM7MN9U/4suJ7bUU/OdIYltWwXjOQ7eWRHvpoHh nczXT/L+wqItELNaTfmLo5sZwqsrVrz+i1SBQMCZ1WIsNRwkH/gUiVKx6ZMbdnOYuoQV NQwJAp11DfT4diJQfRyYKXnW9TogqeRFkTCvKnfS/OjTTwouH6r3t7Ok2nYTyBWeUAIP UxWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GML/j0biHkMPIhr228qPRBmmjkAdp6WUxiI0Aqk8uDw=; b=douibayaPaNfCfRarSsp/z4jBGwo7jzlVehVXLRcvNV2W1hdywwdgwLf82bLiUYNVM Up7L0aZX+T11vnhhA1170bNTyOr3p6gMoINSD6UbV0gGaHsvlA6AGndCUb6EQnaPfRgG Jsb5S+bGKHihOjBWnne9UVsc/2lXrXJJnipTe60HxVPUSjFVSJA6wgC+4uYK27kly3DJ yaNhop4eYl3ItPGDuWYmVKu1CrT3mGIZ4T3VvfkKsufyxF306BosRAZX1nsKkwn9/JfS DQGsFoZuhEteRbdzSfwmx1B+he/xyqvOuWW3GnVlrxTLWVwIsZSmuN/zJbrR69oGL294 ES/g== X-Gm-Message-State: AOAM530MNDBEMIzAx0KtfmpUu4Q+z+PEH0f20DLe9N/TxFQGsf7Axp52 DjBVFNTEUPgNn2Xd7gndbvh4sc+ChRwd01p6GTwvU1kPFIeHmg== X-Google-Smtp-Source: ABdhPJynhb9mYpfzM9A94RqJvz8FDvRRgaUS4Ulmw+R+ZRq0QB8qtFTRAhmcTryxsu+LnLyUDuxsZ12bwU6bYhq7b7M= X-Received: by 2002:a50:cd16:: with SMTP id z22mr2347658edi.128.1636701781806; Thu, 11 Nov 2021 23:23:01 -0800 (PST) MIME-Version: 1.0 References: <20211111145847.1487241-1-mudongliangabcd@gmail.com> In-Reply-To: From: Dongliang Mu Date: Fri, 12 Nov 2021 15:22:35 +0800 Message-ID: Subject: Re: [PATCH v2] net: ieee802154: fix shift-out-of-bound in nl802154_new_interface To: Alexander Aring Cc: Stefan Schmidt , "David S. Miller" , Jakub Kicinski , Marcel Holtmann , linux-wpan - ML , "open list:NETWORKING [GENERAL]" , kernel list Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Nov 12, 2021 at 11:12 AM Alexander Aring wrote: > > Hi, > > On Thu, 11 Nov 2021 at 09:59, Dongliang Mu wrote: > > > > In nl802154_new_interface, if type retrieved from info->attr is > > NL802154_IFTYPE_UNSPEC(-1), i.e., less than NL802154_IFTYPE_MAX, > > it will trigger a shift-out-of-bound bug in BIT(type) [1]. > > > > Fix this by adding a condition to check if the variable type is > > larger than NL802154_IFTYPE_UNSPEC(-1). > > > > Thanks. > > I just sent another patch to fix this issue. The real problem here is > that the enum type doesn't fit into the u32 netlink range as I > mentioned some months ago. [0] Sorry for the delayed fix. It's fine. This fix hits the core of the underlying bug. > > - Alex > > [0] https://lore.kernel.org/linux-wpan/CAB_54W62WZCcPintGnu-kqzCmgAH7EsJxP9oaeD2NVZ03e_2Wg@mail.gmail.com/T/#t