From e67a3269a016c9d4d792ffc3b0447919c3f5660d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 27 Aug 2023 12:10:38 +0200 Subject: [PATCH] 4.19-stable patches added patches: rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch --- ...ct-negative-ifindexes-in-rtm_newlink.patch | 65 +++++++++++++++++++ queue-4.19/series | 1 + 2 files changed, 66 insertions(+) create mode 100644 queue-4.19/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch diff --git a/queue-4.19/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch b/queue-4.19/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch new file mode 100644 index 00000000000..1e15c6bb149 --- /dev/null +++ b/queue-4.19/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch @@ -0,0 +1,65 @@ +From 0560ac660b042b6079d1e935a57dda2f99ce5494 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 09:43:48 +0300 +Subject: rtnetlink: Reject negative ifindexes in RTM_NEWLINK + +From: Ido Schimmel + +[ Upstream commit 30188bd7838c16a98a520db1fe9df01ffc6ed368 ] + +Negative ifindexes are illegal, but the kernel does not validate the +ifindex in the ancillary header of RTM_NEWLINK messages, resulting in +the kernel generating a warning [1] when such an ifindex is specified. + +Fix by rejecting negative ifindexes. + +[1] +WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593 +[...] +Call Trace: + + register_netdevice+0x69a/0x1490 net/core/dev.c:10081 + br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552 + rtnl_newlink_create net/core/rtnetlink.c:3471 [inline] + __rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688 + rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701 + rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427 + netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 + netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] + netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368 + netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 + sock_sendmsg_nosec net/socket.c:728 [inline] + sock_sendmsg+0xd9/0x180 net/socket.c:751 + ____sys_sendmsg+0x6ac/0x940 net/socket.c:2538 + ___sys_sendmsg+0x135/0x1d0 net/socket.c:2592 + __sys_sendmsg+0x117/0x1e0 net/socket.c:2621 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: 38f7b870d4a6 ("[RTNETLINK]: Link creation API") +Reported-by: syzbot+5ba06978f34abb058571@syzkaller.appspotmail.com +Signed-off-by: Ido Schimmel +Reviewed-by: Jiri Pirko +Reviewed-by: Jakub Kicinski +Link: https://lore.kernel.org/r/20230823064348.2252280-1-idosch@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2702,7 +2702,10 @@ static int rtnl_setlink(struct sk_buff * + ifm = nlmsg_data(nlh); + if (ifm->ifi_index > 0) + dev = __dev_get_by_index(net, ifm->ifi_index); +- else if (tb[IFLA_IFNAME]) ++ else if (ifm->ifi_index < 0) { ++ NL_SET_ERR_MSG(extack, "ifindex can't be negative"); ++ return -EINVAL; ++ } else if (tb[IFLA_IFNAME]) + dev = __dev_get_by_name(net, ifname); + else + goto errout; diff --git a/queue-4.19/series b/queue-4.19/series index f177d3ca118..db3630e39ea 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -131,3 +131,4 @@ x86-fpu-set-x86_feature_osxsave-feature-after-enabling-osxsave-in-cr4.patch mmc-block-fix-in_flight-value-error.patch sched-rt-pick_next_rt_entity-check-list_entry.patch netfilter-nf_queue-fix-socket-leak.patch +rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch -- 2.47.3