mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
netlink: Don't shift on 64 for ngroups
commit91874ecf32
upstream. It's legal to have 64 groups for netlink_sock. As user-supplied nladdr->nl_groups is __u32, it's possible to subscribe only to first 32 groups. The check for correctness of .bind() userspace supplied parameter is done by applying mask made from ngroups shift. Which broke Android as they have 64 groups and the shift for mask resulted in an overflow. Fixes:61f4b23769
("netlink: Don't shift with UB on nlk->ngroups") Cc: "David S. Miller" <davem@davemloft.net> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: Steffen Klassert <steffen.klassert@secunet.com> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Reported-and-Tested-by: Nathan Chancellor <natechancellor@gmail.com> Signed-off-by: Dmitry Safonov <dima@arista.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
2d898915cc
commit
09901e570c
1 changed files with 2 additions and 2 deletions
|
@ -981,8 +981,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
|
|||
|
||||
if (nlk->ngroups == 0)
|
||||
groups = 0;
|
||||
else
|
||||
groups &= (1ULL << nlk->ngroups) - 1;
|
||||
else if (nlk->ngroups < 8*sizeof(groups))
|
||||
groups &= (1UL << nlk->ngroups) - 1;
|
||||
|
||||
bound = nlk->bound;
|
||||
if (bound) {
|
||||
|
|
Loading…
Reference in a new issue