linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-28 21:33:52 +00:00

No description

Find a file

Shigeru Yoshida 2426425d68 tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING [ Upstream commit `19b3f72a41` ] syzbot reported the following uninit-value access issue [1]: ===================================================== BUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline] BUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756 strlen lib/string.c:418 [inline] strstr+0xb8/0x2f0 lib/string.c:756 tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595 genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline] genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline] netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd TIPC bearer-related names including link names must be null-terminated strings. If a link name which is not null-terminated is passed through netlink, strstr() and similar functions can cause buffer overrun. This causes the above issue. This patch changes the nla_policy for bearer-related names from NLA_STRING to NLA_NUL_STRING. This resolves the issue by ensuring that only null-terminated strings are accepted as bearer-related names. syzbot reported similar uninit-value issue related to bearer names [2]. The root cause of this issue is that a non-null-terminated bearer name was passed. This patch also resolved this issue. Fixes: `7be57fc691` ("tipc: add link get/dump to new netlink api") Fixes: `0655f6a863` ("tipc: add bearer disable/enable to new netlink api") Reported-and-tested-by: syzbot+5138ca807af9d2b42574@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5138ca807af9d2b42574 [1] Reported-and-tested-by: syzbot+9425c47dccbcb4c17d51@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9425c47dccbcb4c17d51 [2] Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Link: https://lore.kernel.org/r/20231030075540.3784537-1-syoshida@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-11-20 10:29:21 +01:00
arch	sh: bios: Revive earlyprintk support	2023-11-20 10:29:19 +01:00
block	block: fix signed int overflow in Amiga partition support	2023-08-30 16:31:46 +02:00
certs
crypto	X.509: if signature is unsupported skip validation	2023-09-23 10:48:11 +02:00
Documentation	Documentation: security-bugs.rst: clarify CVE handling	2023-08-11 11:45:34 +02:00
drivers	Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()	2023-11-20 10:29:21 +01:00
firmware
fs	f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()	2023-11-20 10:29:20 +01:00
include	sched/rt: Provide migrate_disable/enable() inlines	2023-11-20 10:29:18 +01:00
init	init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()	2023-08-08 19:49:18 +02:00
ipc	ipc/sem: Fix dangling sem_array access in semtimedop race	2022-12-08 11:18:35 +01:00
kernel	genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()	2023-11-20 10:29:16 +01:00
lib	kobject: Fix slab-out-of-bounds in fill_kobj_path()	2023-11-08 11:22:17 +01:00
LICENSES
mm	vfs: fix readahead(2) on block devices	2023-11-20 10:29:16 +01:00
net	tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING	2023-11-20 10:29:21 +01:00
samples	samples/bpf: Fix buffer overflow in tcp_basertt	2023-08-11 11:45:03 +02:00
scripts	modpost: add missing else to the "of" check	2023-10-10 21:45:01 +02:00
security	smack: Record transmuting in smk_transmuted	2023-10-10 21:44:59 +02:00
sound	ASoC: ams-delta.c: use component after check	2023-11-20 10:29:19 +01:00
tools	tools: iio: iio_generic_buffer ensure alignment	2023-11-20 10:29:20 +01:00
usr
virt	KVM: arm64: vgic: Fix exit condition in scan_its_table()	2022-11-03 23:52:24 +09:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS	MAINTAINERS: r8169: Update path to the driver	2023-11-08 11:22:19 +01:00
Makefile	Linux 4.19.298	2023-11-08 11:22:22 +01:00
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.