This is a note to let you know that I've just added the patch titled
rtnetlink: Reject negative ifindexes in RTM_NEWLINK
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 0560ac660b042b6079d1e935a57dda2f99ce5494 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@xxxxxxxxxx>
Date: Wed, 23 Aug 2023 09:43:48 +0300
Subject: rtnetlink: Reject negative ifindexes in RTM_NEWLINK
From: Ido Schimmel <idosch@xxxxxxxxxx>
[ Upstream commit 30188bd7838c16a98a520db1fe9df01ffc6ed368 ]
Negative ifindexes are illegal, but the kernel does not validate the
ifindex in the ancillary header of RTM_NEWLINK messages, resulting in
the kernel generating a warning [1] when such an ifindex is specified.
Fix by rejecting negative ifindexes.
[1]
WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593
[...]
Call Trace:
<TASK>
register_netdevice+0x69a/0x1490 net/core/dev.c:10081
br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552
rtnl_newlink_create net/core/rtnetlink.c:3471 [inline]
__rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701
rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427
netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:728 [inline]
sock_sendmsg+0xd9/0x180 net/socket.c:751
____sys_sendmsg+0x6ac/0x940 net/socket.c:2538
___sys_sendmsg+0x135/0x1d0 net/socket.c:2592
__sys_sendmsg+0x117/0x1e0 net/socket.c:2621
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fixes: 38f7b870d4a6 ("[RTNETLINK]: Link creation API")
Reported-by: syzbot+5ba06978f34abb058571@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxx>
Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
Reviewed-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20230823064348.2252280-1-idosch@xxxxxxxxxx
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
net/core/rtnetlink.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2702,7 +2702,10 @@ static int rtnl_setlink(struct sk_buff *
ifm = nlmsg_data(nlh);
if (ifm->ifi_index > 0)
dev = __dev_get_by_index(net, ifm->ifi_index);
- else if (tb[IFLA_IFNAME])
+ else if (ifm->ifi_index < 0) {
+ NL_SET_ERR_MSG(extack, "ifindex can't be negative");
+ return -EINVAL;
+ } else if (tb[IFLA_IFNAME])
dev = __dev_get_by_name(net, ifname);
else
goto errout;
Patches currently in stable-queue which might be from sashal@xxxxxxxxxx are
queue-4.19/team-fix-incorrect-deletion-of-eth_p_8021ad-protocol.patch
queue-4.19/mmc-remove-dev_err-usage-after-platform_get_irq.patch
queue-4.19/virtio-mmio-use-to_virtio_mmio_device-to-simply-code.patch
queue-4.19/gfs2-fix-possible-data-races-in-gfs2_show_options.patch
queue-4.19/irqchip-mips-gic-get-rid-of-the-reliance-on-irq_cpu_.patch
queue-4.19/quota-properly-disable-quotas-when-add_dquot_ref-fai.patch
queue-4.19/irqchip-mips-gic-use-raw-spinlock-for-gic_lock.patch
queue-4.19/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch
queue-4.19/net-sched-fix-a-qdisc-modification-with-ambiguous-co.patch
queue-4.19/sched-rt-pick_next_rt_entity-check-list_entry.patch
queue-4.19/powerpc-remove-leftover-code-of-old-gcc-version-chec.patch
queue-4.19/pci-endpoint-add-support-to-specify-alignment-for-bu.patch
queue-4.19/bluetooth-l2cap-fix-use-after-free.patch
queue-4.19/iio-adc-stx104-implement-and-utilize-register-struct.patch
queue-4.19/sock-fix-misuse-of-sk_under_memory_pressure.patch
queue-4.19/drm-amd-display-do-not-wait-for-mpc-idle-if-tg-is-di.patch
queue-4.19/tracing-fix-memleak-due-to-race-between-current_trac.patch
queue-4.19/pci-acpiphp-reassign-resources-on-bridge-if-necessar.patch
queue-4.19/serial-8250-fix-oops-for-port-pm-on-uart_change_pm.patch
queue-4.19/igb-avoid-starting-unnecessary-workqueues.patch
queue-4.19/selftests-mirror_gre_changes-tighten-up-the-ttl-test.patch
queue-4.19/dm-integrity-increase-recalc_sectors-to-improve-reca.patch
queue-4.19/xfrm-add-null-check-in-xfrm_update_ae_params.patch
queue-4.19/mmc-bcm2835-fix-deferred-probing.patch
queue-4.19/bonding-fix-macvlan-over-alb-bond-support.patch
queue-4.19/dlm-replace-usage-of-found-with-dedicated-list-itera.patch
queue-4.19/net-remove-bond_slave_has_mac_rcu.patch
queue-4.19/powerpc-mm-dump-segment-registers-on-book3s-32.patch
queue-4.19/virtio-mmio-don-t-break-lifecycle-of-vm_dev.patch
queue-4.19/fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch
queue-4.19/pci-endpoint-add-helper-to-get-first-unreserved-bar.patch
queue-4.19/nfsd4-kill-warnings-on-testing-stateids-with-mismatc.patch
queue-4.19/regmap-account-for-register-length-in-smbus-i-o-limi.patch
queue-4.19/selftests-forwarding-tc_flower-relax-success-criteri.patch
queue-4.19/fs-dlm-use-dlm_plock_info-for-do_unlock_close.patch
queue-4.19/revert-tty-serial-fsl_lpuart-drop-earlycon-entry-for.patch
queue-4.19/mips-dec-prom-address-warray-bounds-warning.patch
queue-4.19/powerpc-fail-build-if-using-recordmcount-with-binuti.patch
queue-4.19/mmc-uniphier-sd-add-uniphier-sd-emmc-controller-driv.patch
queue-4.19/usb-dwc3-qcom-add-helper-functions-to-enable-disable.patch
queue-4.19/pci-pci-epf-test-use-pci_epc_get_features-to-get-epc.patch
queue-4.19/mmc-meson-gx-remove-useless-lock.patch
queue-4.19/exfat-add-bitmap-operations.patch
queue-4.19/virtio-mmio-convert-to-devm_platform_ioremap_resourc.patch
queue-4.19/alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch
queue-4.19/dm-integrity-reduce-vmalloc-space-footprint-on-32-bi.patch
queue-4.19/fbdev-fix-potential-oob-read-in-fast_imageblit.patch
queue-4.19/udf-fix-uninitialized-array-access-for-some-pathname.patch
queue-4.19/fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch
queue-4.19/pci-endpoint-add-new-pci_epc_ops-to-get-epc-features.patch
queue-4.19/drm-amdgpu-fix-potential-fence-use-after-free-v2.patch
queue-4.19/fs-dlm-fix-mismatch-of-plock-results-from-userspace.patch
queue-4.19/powerpc-mm-dump-block-address-translation-on-book3s-.patch
queue-4.19/x86-topology-fix-erroneous-smp_num_siblings-on-intel.patch
queue-4.19/powerpc-move-page-table-dump-files-in-a-dedicated-su.patch
queue-4.19/mmc-sunxi-fix-deferred-probing.patch
queue-4.19/drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch
queue-4.19/powerpc-64s-radix-fix-soft-dirty-tracking.patch
queue-4.19/dccp-annotate-data-races-in-dccp_poll.patch
queue-4.19/iio-adc-stx104-utilize-iomap-interface.patch
queue-4.19/pci-rockchip-set-address-alignment-for-endpoint-mode.patch
queue-4.19/fbdev-improve-performance-of-sys_imageblit.patch
queue-4.19/sock-annotate-data-races-around-prot-memory_pressure.patch
queue-4.19/asoc-rt5665-add-missed-regulator_bulk_disable.patch
queue-4.19/media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch
queue-4.19/mips-cpu-features-use-boot_cpu_type-for-cpu-type-bas.patch
queue-4.19/i40e-fix-misleading-debug-logs.patch
queue-4.19/mmc-tmio-move-tmio_mmc_set_clock-to-platform-hook.patch
queue-4.19/iio-add-addac-subdirectory.patch
queue-4.19/xfrm-fix-slab-use-after-free-in-decode_session6.patch
queue-4.19/tty-serial-fsl_lpuart-add-earlycon-for-imx8ulp-platf.patch
queue-4.19/iio-addac-stx104-fix-race-condition-when-converting-.patch
queue-4.19/quota-fix-warning-in-dqgrab.patch
queue-4.19/media-platform-mediatek-vpu-fix-null-ptr-dereference.patch
queue-4.19/usb-dwc3-qcom-fix-null-deref-on-suspend.patch
queue-4.19/ima-allow-fix-uml-builds.patch
queue-4.19/fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch
queue-4.19/asoc-meson-axg-tdm-formatter-fix-channel-slot-alloca.patch
queue-4.19/iio-addac-stx104-fix-race-condition-for-stx104_write.patch
queue-4.19/ip6_vti-fix-slab-use-after-free-in-decode_session6.patch
queue-4.19/netfilter-nft_dynset-disallow-object-maps.patch
queue-4.19/mmc-meson-gx-remove-redundant-mmc_request_done-call-.patch
queue-4.19/powerpc-32-add-stack-protector-support.patch
queue-4.19/pci-pci-epf-test-remove-setting-epf_bar-flags-in-fun.patch
queue-4.19/block-fix-signed-int-overflow-in-amiga-partition-sup.patch
queue-4.19/mips-cpu-features-enable-octeon_cache-by-cpu_type.patch
queue-4.19/xfrm-interface-rename-xfrm_interface.c-to-xfrm_inter.patch
queue-4.19/exfat-use-kvmalloc_array-kvfree-instead-of-kmalloc_a.patch
queue-4.19/net-do-not-allow-gso_size-to-be-set-to-gso_by_frags.patch
queue-4.19/net-xfrm-fix-xfrm_address_filter-oob-read.patch
queue-4.19/drm-amd-display-check-tg-is-non-null-before-checking.patch
queue-4.19/hid-add-quirk-for-03f0-464a-hp-elite-presenter-mouse.patch
queue-4.19/dlm-improve-plock-logging-if-interrupted.patch
queue-4.19/pci-rockchip-populate-get_features-dw_pcie_ep_ops.patch
queue-4.19/fbdev-fix-sys_imageblit-for-arbitrary-image-widths.patch
queue-4.19/powerpc-mm-move-pgtable_t-into-platform-headers.patch
queue-4.19/fs-dlm-change-plock-interrupted-message-to-debug-aga.patch
queue-4.19/ip_vti-fix-potential-slab-use-after-free-in-decode_s.patch
queue-4.19/fs-dlm-add-pid-to-debug-log.patch
queue-4.19/nfsd-remove-incorrect-check-in-nfsd4_validate_statei.patch
queue-4.19/powerpc-mm-move-platform-specific-mmu-xxx.h-in-platf.patch
queue-4.19/net-af_key-fix-sadb_x_filter-validation.patch
queue-4.19/pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch
queue-4.19/mmc-tmio-replace-tmio_mmc_clk_stop-calls-with-tmio_m.patch
