This is a note to let you know that I've just added the patch titled
rtnetlink: Reject negative ifindexes in RTM_NEWLINK
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 0560ac660b042b6079d1e935a57dda2f99ce5494 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@xxxxxxxxxx>
Date: Wed, 23 Aug 2023 09:43:48 +0300
Subject: rtnetlink: Reject negative ifindexes in RTM_NEWLINK
From: Ido Schimmel <idosch@xxxxxxxxxx>
[ Upstream commit 30188bd7838c16a98a520db1fe9df01ffc6ed368 ]
Negative ifindexes are illegal, but the kernel does not validate the
ifindex in the ancillary header of RTM_NEWLINK messages, resulting in
the kernel generating a warning [1] when such an ifindex is specified.
Fix by rejecting negative ifindexes.
[1]
WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593
[...]
Call Trace:
<TASK>
register_netdevice+0x69a/0x1490 net/core/dev.c:10081
br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552
rtnl_newlink_create net/core/rtnetlink.c:3471 [inline]
__rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701
rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427
netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:728 [inline]
sock_sendmsg+0xd9/0x180 net/socket.c:751
____sys_sendmsg+0x6ac/0x940 net/socket.c:2538
___sys_sendmsg+0x135/0x1d0 net/socket.c:2592
__sys_sendmsg+0x117/0x1e0 net/socket.c:2621
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fixes: 38f7b870d4a6 ("[RTNETLINK]: Link creation API")
Reported-by: syzbot+5ba06978f34abb058571@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxx>
Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
Reviewed-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20230823064348.2252280-1-idosch@xxxxxxxxxx
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
net/core/rtnetlink.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2311,7 +2311,10 @@ static int rtnl_setlink(struct sk_buff *
ifm = nlmsg_data(nlh);
if (ifm->ifi_index > 0)
dev = __dev_get_by_index(net, ifm->ifi_index);
- else if (tb[IFLA_IFNAME])
+ else if (ifm->ifi_index < 0) {
+ NL_SET_ERR_MSG(extack, "ifindex can't be negative");
+ return -EINVAL;
+ } else if (tb[IFLA_IFNAME])
dev = __dev_get_by_name(net, ifname);
else
goto errout;
Patches currently in stable-queue which might be from sashal@xxxxxxxxxx are
queue-4.14/team-fix-incorrect-deletion-of-eth_p_8021ad-protocol.patch
queue-4.14/gfs2-fix-possible-data-races-in-gfs2_show_options.patch
queue-4.14/quota-properly-disable-quotas-when-add_dquot_ref-fai.patch
queue-4.14/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch
queue-4.14/bluetooth-l2cap-fix-use-after-free.patch
queue-4.14/sock-fix-misuse-of-sk_under_memory_pressure.patch
queue-4.14/tracing-fix-memleak-due-to-race-between-current_trac.patch
queue-4.14/igb-avoid-starting-unnecessary-workqueues.patch
queue-4.14/xfrm-add-null-check-in-xfrm_update_ae_params.patch
queue-4.14/fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch
queue-4.14/mips-dec-prom-address-warray-bounds-warning.patch
queue-4.14/alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch
queue-4.14/udf-fix-uninitialized-array-access-for-some-pathname.patch
queue-4.14/fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch
queue-4.14/drm-amdgpu-fix-potential-fence-use-after-free-v2.patch
queue-4.14/drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch
queue-4.14/sock-annotate-data-races-around-prot-memory_pressure.patch
queue-4.14/media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch
queue-4.14/i40e-fix-misleading-debug-logs.patch
queue-4.14/quota-fix-warning-in-dqgrab.patch
queue-4.14/media-platform-mediatek-vpu-fix-null-ptr-dereference.patch
queue-4.14/fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch
queue-4.14/ip6_vti-fix-slab-use-after-free-in-decode_session6.patch
queue-4.14/netfilter-nft_dynset-disallow-object-maps.patch
queue-4.14/net-do-not-allow-gso_size-to-be-set-to-gso_by_frags.patch
queue-4.14/net-xfrm-fix-xfrm_address_filter-oob-read.patch
queue-4.14/ip_vti-fix-potential-slab-use-after-free-in-decode_s.patch
queue-4.14/net-af_key-fix-sadb_x_filter-validation.patch
queue-4.14/pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch
