Patch "rtnetlink: Reject negative ifindexes in RTM_NEWLINK" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    rtnetlink: Reject negative ifindexes in RTM_NEWLINK

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7d013e33341cce09c699638000c63de6f76892bb
Author: Ido Schimmel <idosch@xxxxxxxxxx>
Date:   Wed Aug 23 09:43:48 2023 +0300

    rtnetlink: Reject negative ifindexes in RTM_NEWLINK
    
    [ Upstream commit 30188bd7838c16a98a520db1fe9df01ffc6ed368 ]
    
    Negative ifindexes are illegal, but the kernel does not validate the
    ifindex in the ancillary header of RTM_NEWLINK messages, resulting in
    the kernel generating a warning [1] when such an ifindex is specified.
    
    Fix by rejecting negative ifindexes.
    
    [1]
    WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593
    [...]
    Call Trace:
     <TASK>
     register_netdevice+0x69a/0x1490 net/core/dev.c:10081
     br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552
     rtnl_newlink_create net/core/rtnetlink.c:3471 [inline]
     __rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688
     rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701
     rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427
     netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545
     netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
     netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368
     netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910
     sock_sendmsg_nosec net/socket.c:728 [inline]
     sock_sendmsg+0xd9/0x180 net/socket.c:751
     ____sys_sendmsg+0x6ac/0x940 net/socket.c:2538
     ___sys_sendmsg+0x135/0x1d0 net/socket.c:2592
     __sys_sendmsg+0x117/0x1e0 net/socket.c:2621
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    Fixes: 38f7b870d4a6 ("[RTNETLINK]: Link creation API")
    Reported-by: syzbot+5ba06978f34abb058571@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxx>
    Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
    Reviewed-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230823064348.2252280-1-idosch@xxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 7c1a2fd7d9532..1b71e5c582bbc 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3318,6 +3318,9 @@ static int __rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
 	if (ifm->ifi_index > 0) {
 		link_specified = true;
 		dev = __dev_get_by_index(net, ifm->ifi_index);
+	} else if (ifm->ifi_index < 0) {
+		NL_SET_ERR_MSG(extack, "ifindex can't be negative");
+		return -EINVAL;
 	} else if (tb[IFLA_IFNAME] || tb[IFLA_ALT_IFNAME]) {
 		link_specified = true;
 		dev = rtnl_dev_get(net, NULL, tb[IFLA_ALT_IFNAME], ifname);