Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c9f0a94 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'tipc-Better-check-user-provided-attributes' 



Eric Dumazet says:

====================
tipc: Better check user provided attributes

syzbot reported a crash in __tipc_nl_net_set()

While fixing it, I also had to fix an old bug involving TIPC_NLA_NET_ADDR
====================

Acked-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 9783ccd0 c6404122

net/tipc/net.c

+2 −0
Original line number Diff line number Diff line
@@ -252,6 +252,8 @@ int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info) 
		u64 *w0 = (u64 *)&node_id[0];

		u64 *w1 = (u64 *)&node_id[8];



		if (!attrs[TIPC_NLA_NET_NODEID_W1])

			return -EINVAL;

		*w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]);

		*w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]);

		tipc_net_init(net, node_id, 0);

net/tipc/netlink.c

+4 −1
Original line number Diff line number Diff line
@@ -79,7 +79,10 @@ const struct nla_policy tipc_nl_sock_policy[TIPC_NLA_SOCK_MAX + 1] = { 


const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {

	[TIPC_NLA_NET_UNSPEC]		= { .type = NLA_UNSPEC },

	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 }

	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 },

	[TIPC_NLA_NET_ADDR]		= { .type = NLA_U32 },

	[TIPC_NLA_NET_NODEID]		= { .type = NLA_U64 },

	[TIPC_NLA_NET_NODEID_W1]	= { .type = NLA_U64 },

};



const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {