leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
4fb0534fb7
linux/drivers/net
History
Paolo Abeni 4fb0534fb7 team: avoid adding twice the same option to the event list 
When parsing the options provided by the user space,
team_nl_cmd_options_set() insert them in a temporary list to send
multiple events with a single message.
While each option's attribute is correctly validated, the code does
not check for duplicate entries before inserting into the event
list.

Exploiting the above, the syzbot was able to trigger the following
splat:

kernel BUG at lib/list_debug.c:31!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
    (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4466 Comm: syzkaller556835 Not tainted 4.16.0+ #17
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__list_add_valid+0xaa/0xb0 lib/list_debug.c:29
RSP: 0018:ffff8801b04bf248 EFLAGS: 00010286
RAX: 0000000000000058 RBX: ffff8801c8fc7a90 RCX: 0000000000000000
RDX: 0000000000000058 RSI: ffffffff815fbf41 RDI: ffffed0036097e3f
RBP: ffff8801b04bf260 R08: ffff8801b0b2a700 R09: ffffed003b604f90
R10: ffffed003b604f90 R11: ffff8801db027c87 R12: ffff8801c8fc7a90
R13: ffff8801c8fc7a90 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000b98880(0000) GS:ffff8801db000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000043fc30 CR3: 00000001afe8e000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  __list_add include/linux/list.h:60 [inline]
  list_add include/linux/list.h:79 [inline]
  team_nl_cmd_options_set+0x9ff/0x12b0 drivers/net/team/team.c:2571
  genl_family_rcv_msg+0x889/0x1120 net/netlink/genetlink.c:599
  genl_rcv_msg+0xc6/0x170 net/netlink/genetlink.c:624
  netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448
  genl_rcv+0x28/0x40 net/netlink/genetlink.c:635
  netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
  netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336
  netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901
  sock_sendmsg_nosec net/socket.c:629 [inline]
  sock_sendmsg+0xd5/0x120 net/socket.c:639
  ___sys_sendmsg+0x805/0x940 net/socket.c:2117
  __sys_sendmsg+0x115/0x270 net/socket.c:2155
  SYSC_sendmsg net/socket.c:2164 [inline]
  SyS_sendmsg+0x29/0x30 net/socket.c:2162
  do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4458b9
RSP: 002b:00007ffd1d4a7278 EFLAGS: 00000213 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000000001b RCX: 00000000004458b9
RDX: 0000000000000010 RSI: 0000000020000d00 RDI: 0000000000000004
RBP: 00000000004a74ed R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000213 R12: 00007ffd1d4a7348
R13: 0000000000402a60 R14: 0000000000000000 R15: 0000000000000000
Code: 75 e8 eb a9 48 89 f7 48 89 75 e8 e8 d1 85 7b fe 48 8b 75 e8 eb bb 48
89 f2 48 89 d9 4c 89 e6 48 c7 c7 a0 84 d8 87 e8 ea 67 28 fe <0f> 0b 0f 1f
40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41
RIP: __list_add_valid+0xaa/0xb0 lib/list_debug.c:29 RSP: ffff8801b04bf248

This changeset addresses the avoiding list_add() if the current
option is already present in the event list.

Reported-and-tested-by: syzbot+4d4af685432dc0e56c91@syzkaller.appspotmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Fixes: 2fcdb2c9e6 ("team: allow to send multiple set events in one message")
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-04-16 11:03:05 -04:00
..
appletalk
arcnet
bonding Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-04-01 19:49:34 -04:00
caif drivers/net: Use octal not symbolic permissions 2018-03-26 12:07:49 -04:00
can Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-04-03 14:04:18 -07:00
dsa net: dsa: mv88e6xxx: Fix receive time stamp race condition. 2018-04-12 22:05:58 -04:00
ethernet net: mvpp2: Fix TCAM filter reserved range 2018-04-16 10:03:25 -04:00
fddi
fjes
hamradio drivers/net: Use octal not symbolic permissions 2018-03-26 12:07:49 -04:00
hippi
hyperv hv_netvsc: Pass net_device parameter to revoke and teardown functions 2018-04-05 22:21:00 -04:00
ieee802154 Merge branch 'ieee802154-for-davem-2018-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next 2018-03-30 13:00:11 -04:00
ipvlan net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
netdevsim devlink: convert occ_get op to separate registration 2018-04-08 12:45:57 -04:00
phy lan78xx: PHY DSP registers initialization to address EEE link drop issues with long cables 2018-04-12 21:46:10 -04:00
plip
ppp pptp: remove a buggy dst release in pptp_connect() 2018-04-04 11:17:55 -04:00
slip slip: Check if rstate is initialized before uncompressing 2018-04-11 10:33:46 -04:00
team team: avoid adding twice the same option to the event list 2018-04-16 11:03:05 -04:00
usb lan78xx: Don't reset the interface on open 2018-04-11 14:44:45 -04:00
vmxnet3 vmxnet3: remove unused flag "rxcsum" from struct vmxnet3_adapter 2018-03-20 10:56:25 -04:00
wan
wimax net: drivers/net: Remove unnecessary skb_copy_expand OOM messages 2018-03-15 14:28:03 -04:00
wireless mac80211_hwsim: use DEFINE_IDA 2018-04-11 10:28:39 -07:00
xen-netback drivers/net: Use octal not symbolic permissions 2018-03-26 12:07:49 -04:00
dummy.c net: Do not take net_rwsem in __rtnl_link_unregister() 2018-03-31 22:24:58 -04:00
eql.c
geneve.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
gtp.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
ifb.c net: Do not take net_rwsem in __rtnl_link_unregister() 2018-03-31 22:24:58 -04:00
Kconfig netdevsim: Add simple FIB resource controller via devlink 2018-03-29 14:10:31 -04:00
LICENSE.SRC
loopback.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
macsec.c Revert "macsec: missing dev_put() on error in macsec_newlink()" 2018-04-16 10:01:12 -04:00
macvlan.c macvlan: filter out unsupported feature flags 2018-03-11 22:46:16 -04:00
macvtap.c
Makefile net: remove cris etrax ethernet driver 2018-03-26 15:56:24 +02:00
mdio.c
mii.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c
tun.c tun: send netlink notification when the device is modified 2018-04-11 14:48:05 -04:00
veth.c
virtio_net.c virtio-net: add missing virtqueue kick when flushing packets 2018-04-13 11:26:40 -04:00
vrf.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-04-01 19:49:34 -04:00
vsockmon.c
vxlan.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
xen-netfront.c drivers/net: Use octal not symbolic permissions 2018-03-26 12:07:49 -04:00