diff options
| author | David S. Miller <davem@davemloft.net> | 2018-04-16 18:08:18 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-04-16 18:08:18 -0400 |
| commit | 1c9f0a946d5c6d3d6a83cfee0e8bb4e886559a67 (patch) | |
| tree | 446adab675af1e507ab048a2efe35edd427fdd34 | |
| parent | 9783ccd0f2507cbe3c5ff1cb84bf6ae3a512d17d (diff) | |
| parent | c6404122cb18f1fbd2a6dc85ab687f6fa2e454cf (diff) | |
| download | linux-1c9f0a946d5c6d3d6a83cfee0e8bb4e886559a67.tar.bz2 | |
Merge branch 'tipc-Better-check-user-provided-attributes'
Eric Dumazet says:
====================
tipc: Better check user provided attributes
syzbot reported a crash in __tipc_nl_net_set()
While fixing it, I also had to fix an old bug involving TIPC_NLA_NET_ADDR
====================
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/tipc/net.c | 2 | ||||
| -rw-r--r-- | net/tipc/netlink.c | 5 |
2 files changed, 6 insertions, 1 deletions
diff --git a/net/tipc/net.c b/net/tipc/net.c index 856f9e97ea29..4fbaa0464405 100644 --- a/net/tipc/net.c +++ b/net/tipc/net.c @@ -252,6 +252,8 @@ int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info) u64 *w0 = (u64 *)&node_id[0]; u64 *w1 = (u64 *)&node_id[8]; + if (!attrs[TIPC_NLA_NET_NODEID_W1]) + return -EINVAL; *w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]); *w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]); tipc_net_init(net, node_id, 0); diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c index b76f13f6fea1..6ff2254088f6 100644 --- a/net/tipc/netlink.c +++ b/net/tipc/netlink.c @@ -79,7 +79,10 @@ const struct nla_policy tipc_nl_sock_policy[TIPC_NLA_SOCK_MAX + 1] = { const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = { [TIPC_NLA_NET_UNSPEC] = { .type = NLA_UNSPEC }, - [TIPC_NLA_NET_ID] = { .type = NLA_U32 } + [TIPC_NLA_NET_ID] = { .type = NLA_U32 }, + [TIPC_NLA_NET_ADDR] = { .type = NLA_U32 }, + [TIPC_NLA_NET_NODEID] = { .type = NLA_U64 }, + [TIPC_NLA_NET_NODEID_W1] = { .type = NLA_U64 }, }; const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = { |