From a375f97108f0031b2c6be796b06f90bb4c58b372 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 5 Aug 2018 16:44:22 +0200
Subject: [PATCH] netlink pending patches

---
 ...not-subscribe-to-non-existent-groups.patch | 35 +++++++++++++++++++
 ...not-subscribe-to-non-existent-groups.patch | 35 +++++++++++++++++++
 2 files changed, 70 insertions(+)
 create mode 100644 pending/4.4/netlink-do-not-subscribe-to-non-existent-groups.patch
 create mode 100644 pending/4.9/netlink-do-not-subscribe-to-non-existent-groups.patch

diff --git a/pending/4.4/netlink-do-not-subscribe-to-non-existent-groups.patch b/pending/4.4/netlink-do-not-subscribe-to-non-existent-groups.patch
new file mode 100644
index 00000000000..de809d2eac0
--- /dev/null
+++ b/pending/4.4/netlink-do-not-subscribe-to-non-existent-groups.patch
@@ -0,0 +1,35 @@
+From foo@baz Fri Aug  3 21:25:07 CEST 2018
+From: Dmitry Safonov <dima@arista.com>
+Date: Fri, 27 Jul 2018 16:54:44 +0100
+Subject: netlink: Do not subscribe to non-existent groups
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 7acf9d4237c46894e0fa0492dd96314a41742e84 ]
+
+Make ABI more strict about subscribing to group > ngroups.
+Code doesn't check for that and it looks bogus.
+(one can subscribe to non-existing group)
+Still, it's possible to bind() to all possible groups with (-1)
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: netdev@vger.kernel.org
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlink/af_netlink.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -983,6 +983,7 @@ static int netlink_bind(struct socket *s
+ 		if (err)
+ 			return err;
+ 	}
++	groups &= (1UL << nlk->ngroups) - 1;
+ 
+ 	bound = nlk->bound;
+ 	if (bound) {
diff --git a/pending/4.9/netlink-do-not-subscribe-to-non-existent-groups.patch b/pending/4.9/netlink-do-not-subscribe-to-non-existent-groups.patch
new file mode 100644
index 00000000000..84160fb03d2
--- /dev/null
+++ b/pending/4.9/netlink-do-not-subscribe-to-non-existent-groups.patch
@@ -0,0 +1,35 @@
+From foo@baz Fri Aug  3 21:22:28 CEST 2018
+From: Dmitry Safonov <dima@arista.com>
+Date: Fri, 27 Jul 2018 16:54:44 +0100
+Subject: netlink: Do not subscribe to non-existent groups
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 7acf9d4237c46894e0fa0492dd96314a41742e84 ]
+
+Make ABI more strict about subscribing to group > ngroups.
+Code doesn't check for that and it looks bogus.
+(one can subscribe to non-existing group)
+Still, it's possible to bind() to all possible groups with (-1)
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: netdev@vger.kernel.org
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlink/af_netlink.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -983,6 +983,7 @@ static int netlink_bind(struct socket *s
+ 		if (err)
+ 			return err;
+ 	}
++	groups &= (1UL << nlk->ngroups) - 1;
+ 
+ 	bound = nlk->bound;
+ 	if (bound) {
-- 
2.47.3