releases/4.4.180/tipc-handle-the-err-returned-from-cmd-header-function.patch

   1 From 2ac695d1d602ce00b12170242f58c3d3a8e36d04 Mon Sep 17 00:00:00 2001
   2 From: Xin Long <lucien.xin@gmail.com>
   3 Date: Sun, 31 Mar 2019 22:50:10 +0800
   4 Subject: tipc: handle the err returned from cmd header function
   5
   6 From: Xin Long <lucien.xin@gmail.com>
   7
   8 commit 2ac695d1d602ce00b12170242f58c3d3a8e36d04 upstream.
   9
  10 Syzbot found a crash:
  11
  12   BUG: KMSAN: uninit-value in tipc_nl_compat_name_table_dump+0x54f/0xcd0 net/tipc/netlink_compat.c:872
  13   Call Trace:
  14     tipc_nl_compat_name_table_dump+0x54f/0xcd0 net/tipc/netlink_compat.c:872
  15     __tipc_nl_compat_dumpit+0x59e/0xda0 net/tipc/netlink_compat.c:215
  16     tipc_nl_compat_dumpit+0x63a/0x820 net/tipc/netlink_compat.c:280
  17     tipc_nl_compat_handle net/tipc/netlink_compat.c:1226 [inline]
  18     tipc_nl_compat_recv+0x1b5f/0x2750 net/tipc/netlink_compat.c:1265
  19     genl_family_rcv_msg net/netlink/genetlink.c:601 [inline]
  20     genl_rcv_msg+0x185f/0x1a60 net/netlink/genetlink.c:626
  21     netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2477
  22     genl_rcv+0x63/0x80 net/netlink/genetlink.c:637
  23     netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
  24     netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1336
  25     netlink_sendmsg+0x127f/0x1300 net/netlink/af_netlink.c:1917
  26     sock_sendmsg_nosec net/socket.c:622 [inline]
  27     sock_sendmsg net/socket.c:632 [inline]
  28
  29   Uninit was created at:
  30     __alloc_skb+0x309/0xa20 net/core/skbuff.c:208
  31     alloc_skb include/linux/skbuff.h:1012 [inline]
  32     netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]
  33     netlink_sendmsg+0xb82/0x1300 net/netlink/af_netlink.c:1892
  34     sock_sendmsg_nosec net/socket.c:622 [inline]
  35     sock_sendmsg net/socket.c:632 [inline]
  36
  37 It was supposed to be fixed on commit 974cb0e3e7c9 ("tipc: fix uninit-value
  38 in tipc_nl_compat_name_table_dump") by checking TLV_GET_DATA_LEN(msg->req)
  39 in cmd->header()/tipc_nl_compat_name_table_dump_header(), which is called
  40 ahead of tipc_nl_compat_name_table_dump().
  41
  42 However, tipc_nl_compat_dumpit() doesn't handle the error returned from cmd
  43 header function. It means even when the check added in that fix fails, it
  44 won't stop calling tipc_nl_compat_name_table_dump(), and the issue will be
  45 triggered again.
  46
  47 So this patch is to add the process for the err returned from cmd header
  48 function in tipc_nl_compat_dumpit().
  49
  50 Reported-by: syzbot+3ce8520484b0d4e260a5@syzkaller.appspotmail.com
  51 Signed-off-by: Xin Long <lucien.xin@gmail.com>
  52 Signed-off-by: David S. Miller <davem@davemloft.net>
  53 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  54
  55 ---
  56  net/tipc/netlink_compat.c |   10 ++++++++--
  57  1 file changed, 8 insertions(+), 2 deletions(-)
  58
  59 --- a/net/tipc/netlink_compat.c
  60 +++ b/net/tipc/netlink_compat.c
  61 @@ -262,8 +262,14 @@ static int tipc_nl_compat_dumpit(struct
  62         if (msg->rep_type)
  63                 tipc_tlv_init(msg->rep, msg->rep_type);
  64
  65 -       if (cmd->header)
  66 -               (*cmd->header)(msg);
  67 +       if (cmd->header) {
  68 +               err = (*cmd->header)(msg);
  69 +               if (err) {
  70 +                       kfree_skb(msg->rep);
  71 +                       msg->rep = NULL;
  72 +                       return err;
  73 +               }
  74 +       }
  75
  76         arg = nlmsg_new(0, GFP_KERNEL);
  77         if (!arg) {