From 9a8b20596cd2f50fae7aa388fb49af86d59d864a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 9 Oct 2023 20:38:54 +0200 Subject: [PATCH] 4.14-stable patches added patches: rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch --- ...ct-negative-ifindexes-in-rtm_newlink.patch | 69 +++++++++++++++++++ queue-4.14/series | 1 + 2 files changed, 70 insertions(+) create mode 100644 queue-4.14/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch diff --git a/queue-4.14/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch b/queue-4.14/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch new file mode 100644 index 00000000000..73b95821994 --- /dev/null +++ b/queue-4.14/rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch @@ -0,0 +1,69 @@ +From 30188bd7838c16a98a520db1fe9df01ffc6ed368 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Wed, 23 Aug 2023 09:43:48 +0300 +Subject: rtnetlink: Reject negative ifindexes in RTM_NEWLINK + +From: Ido Schimmel + +commit 30188bd7838c16a98a520db1fe9df01ffc6ed368 upstream. + +Negative ifindexes are illegal, but the kernel does not validate the +ifindex in the ancillary header of RTM_NEWLINK messages, resulting in +the kernel generating a warning [1] when such an ifindex is specified. + +Fix by rejecting negative ifindexes. + +[1] +WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593 +[...] +Call Trace: + + register_netdevice+0x69a/0x1490 net/core/dev.c:10081 + br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552 + rtnl_newlink_create net/core/rtnetlink.c:3471 [inline] + __rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688 + rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701 + rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427 + netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 + netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] + netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368 + netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 + sock_sendmsg_nosec net/socket.c:728 [inline] + sock_sendmsg+0xd9/0x180 net/socket.c:751 + ____sys_sendmsg+0x6ac/0x940 net/socket.c:2538 + ___sys_sendmsg+0x135/0x1d0 net/socket.c:2592 + __sys_sendmsg+0x117/0x1e0 net/socket.c:2621 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: 38f7b870d4a6 ("[RTNETLINK]: Link creation API") +Reported-by: syzbot+5ba06978f34abb058571@syzkaller.appspotmail.com +Signed-off-by: Ido Schimmel +Reviewed-by: Jiri Pirko +Reviewed-by: Jakub Kicinski +Link: https://lore.kernel.org/r/20230823064348.2252280-1-idosch@nvidia.com +Signed-off-by: Paolo Abeni +Cc: Boris Ostrovsky +Signed-off-by: Greg Kroah-Hartman +--- + net/core/rtnetlink.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2547,9 +2547,12 @@ replay: + ifname[0] = '\0'; + + ifm = nlmsg_data(nlh); +- if (ifm->ifi_index > 0) ++ if (ifm->ifi_index > 0) { + dev = __dev_get_by_index(net, ifm->ifi_index); +- else { ++ } else if (ifm->ifi_index < 0) { ++ NL_SET_ERR_MSG(extack, "ifindex can't be negative"); ++ return -EINVAL; ++ } else { + if (ifname[0]) + dev = __dev_get_by_name(net, ifname); + else diff --git a/queue-4.14/series b/queue-4.14/series index adac1353bb5..f3a623dd15b 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -54,3 +54,4 @@ rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch rdma-mlx5-fix-null-string-error.patch parisc-restore-__ldcw_align-for-pa-risc-2.0-processors.patch revert-rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch +rtnetlink-reject-negative-ifindexes-in-rtm_newlink.patch -- 2.47.3