Shigeru Yoshida 3871aa01e1 tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() ... syzbot reported the following general protection fault [1]: general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087] ... RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291 ... Call Trace: <TASK> tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646 tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline] genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367 netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b The cause of this issue is that when tipc_nl_bearer_add() is called with the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called even if the bearer is not UDP. tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that the media_ptr field of the tipc_bearer has an udp_bearer type object, so the function goes crazy for non-UDP bearers. This patch fixes the issue by checking the bearer type before calling tipc_udp_nl_bearer_add() in tipc_nl_bearer_add(). Fixes: ef20cd4dd1 ("tipc: introduce UDP replicast") Reported-and-tested-by: syzbot+5142b87a9abc510e14fa@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5142b87a9abc510e14fa [1] Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Reviewed-by: Tung Nguyen <tung.q.nguyen@dektech.com.au> Link: https://lore.kernel.org/r/20240131152310.4089541-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2024-02-06 08:49:26 +01:00
..
addr.c
addr.h	tipc: Remove unused function declarations	2023-08-03 12:51:45 +02:00
bcast.c
bcast.h
bearer.c	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()	2024-02-06 08:49:26 +01:00
bearer.h	tipc: Remove unused function declarations	2023-08-03 12:51:45 +02:00
core.c	tipc: fix use-after-free Read in tipc_named_reinit	2022-06-17 11:39:10 +01:00
core.h	minmax: add in_range() macro	2023-08-24 16:20:18 -07:00
crypto.c	tipc: fix a potential deadlock on &tx->lock	2023-10-04 13:24:12 -07:00
crypto.h
diag.c	net: fill in MODULE_DESCRIPTION()s for SOCK_DIAG modules	2023-11-19 20:09:13 +00:00
discover.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
discover.h
eth_media.c	tipc: constify dev_addr passing	2021-10-13 09:40:46 -07:00
group.c
group.h
ib_media.c	tipc: constify dev_addr passing	2021-10-13 09:40:46 -07:00
Kconfig
link.c	tipc: Remove some excess struct member documentation	2023-12-22 23:14:43 +00:00
link.h	tipc: Remove unused declaration tipc_link_build_bc_sync_msg()	2023-08-09 13:03:14 -07:00
Makefile
monitor.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
monitor.h
msg.c
msg.h	net: tipc: remove unused static inlines	2022-01-27 13:53:27 +00:00
name_distr.c	net/tipc: Remove unused struct distr_queue_item	2022-09-29 18:48:32 -07:00
name_distr.h	tipc: Remove unused function declarations	2023-08-03 12:51:45 +02:00
name_table.c	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
name_table.h	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
net.c
net.h	tipc: Remove unused function declarations	2023-08-03 12:51:45 +02:00
netlink.c	tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING	2023-11-01 22:26:37 -07:00
netlink.h
netlink_compat.c	tipc: Remove redundant call to TLV_SPACE()	2023-11-17 02:27:27 +00:00
node.c	genetlink: use attrs from struct genl_info	2023-08-15 15:00:45 -07:00
node.h
socket.c	genetlink: use attrs from struct genl_info	2023-08-15 15:00:45 -07:00
socket.h
subscr.c
subscr.h
sysctl.c
topsrv.c	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
topsrv.h
trace.c
trace.h
udp_media.c	genetlink: use attrs from struct genl_info	2023-08-15 15:00:45 -07:00
udp_media.h