Eric Dumazet b83a5eff9a net_sched: ematch: reject invalid TCF_EM_SIMPLE ... [ Upstream commit 55cd9f67f1e45de8517cdaab985fb8e56c0bc1d8 ] It is possible for malicious userspace to set TCF_EM_SIMPLE bit even for matches that should not have this bit set. This can fool two places using tcf_em_is_simple() 1) tcf_em_tree_destroy() -> memory leak of em->data if ops->destroy() is NULL 2) tcf_em_tree_dump() wrongly report/leak 4 low-order bytes of a kernel pointer. BUG: memory leak unreferenced object 0xffff888121850a40 (size 32): comm "syz-executor927", pid 7193, jiffies 4294941655 (age 19.840s) hex dump (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000f67036ea>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<00000000f67036ea>] slab_post_alloc_hook mm/slab.h:586 [inline] [<00000000f67036ea>] slab_alloc mm/slab.c:3320 [inline] [<00000000f67036ea>] __do_kmalloc mm/slab.c:3654 [inline] [<00000000f67036ea>] __kmalloc_track_caller+0x165/0x300 mm/slab.c:3671 [<00000000fab0cc8e>] kmemdup+0x27/0x60 mm/util.c:127 [<00000000d9992e0a>] kmemdup include/linux/string.h:453 [inline] [<00000000d9992e0a>] em_nbyte_change+0x5b/0x90 net/sched/em_nbyte.c:32 [<000000007e04f711>] tcf_em_validate net/sched/ematch.c:241 [inline] [<000000007e04f711>] tcf_em_tree_validate net/sched/ematch.c:359 [inline] [<000000007e04f711>] tcf_em_tree_validate+0x332/0x46f net/sched/ematch.c:300 [<000000007a769204>] basic_set_parms net/sched/cls_basic.c:157 [inline] [<000000007a769204>] basic_change+0x1d7/0x5f0 net/sched/cls_basic.c:219 [<00000000e57a5997>] tc_new_tfilter+0x566/0xf70 net/sched/cls_api.c:2104 [<0000000074b68559>] rtnetlink_rcv_msg+0x3b2/0x4b0 net/core/rtnetlink.c:5415 [<00000000b7fe53fb>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477 [<00000000e83a40d0>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442 [<00000000d62ba933>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] [<00000000d62ba933>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328 [<0000000088070f72>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917 [<00000000f70b15ea>] sock_sendmsg_nosec net/socket.c:639 [inline] [<00000000f70b15ea>] sock_sendmsg+0x54/0x70 net/socket.c:659 [<00000000ef95a9be>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330 [<00000000b650f1ab>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384 [<0000000055bfa74a>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417 [<000000002abac183>] __do_sys_sendmsg net/socket.c:2426 [inline] [<000000002abac183>] __se_sys_sendmsg net/socket.c:2424 [inline] [<000000002abac183>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot+03c4738ed29d5d366ddf@syzkaller.appspotmail.com Cc: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-04-07 13:45:58 +02:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-04-07 13:41:33 +02:00
9p
802
8021q	vlan: fix memory leak in vlan_dev_set_egress_priority	2020-04-07 13:29:16 +02:00
appletalk	appletalk: Set error code if register_snap_client failed	2020-04-07 12:46:15 +02:00
atm
ax25	ax25: enforce CAP_NET_RAW for raw sockets	2020-04-07 07:37:32 +02:00
batman-adv	batman-adv: Fix DAT candidate selection on little endian systems	2020-04-07 13:38:35 +02:00
bluetooth	Bluetooth: delete a stray unlock	2020-04-07 13:24:53 +02:00
bridge	netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule	2020-04-07 13:41:52 +02:00
caif
can
ceph
core	net: neigh: use long type to store jiffies delta	2020-04-07 13:43:53 +02:00
dcb
dccp	dccp: Fix memleak in __feat_register_sp	2020-04-07 13:36:40 +02:00
decnet	decnet: fix DN_IFREQ_SIZE	2020-04-07 12:42:56 +02:00
dns_resolver
dsa
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-04-07 13:25:04 +02:00
hsr	hsr: reset network header when supervision frame is created	2020-04-07 13:36:48 +02:00
ieee802154	inet: frags: call inet_frags_fini() after unregister_pernet_subsys()	2020-04-07 13:42:09 +02:00
ipv4	net, ip_tunnel: fix namespaces move	2020-04-07 13:44:37 +02:00
ipv6	inet: frags: call inet_frags_fini() after unregister_pernet_subsys()	2020-04-07 13:42:09 +02:00
ipx
irda
iucv	net/af_iucv: always register net_device notifier	2020-04-07 13:42:16 +02:00
key
l2tp
l3mdev
lapb
llc	llc: fix sk_buff refcounting in llc_conn_state_process()	2020-04-07 13:43:36 +02:00
mac80211	mac80211: accept deauth frames in IBSS mode	2020-04-07 13:43:32 +02:00
mac802154
mpls
mptcp
ncm
netfilter	netfilter: ipset: use bitmap infrastructure completely	2020-04-07 13:45:11 +02:00
netlabel
netlink
netrom
nfc	net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()	2020-04-07 13:22:15 +02:00
openvswitch	openvswitch: remove another BUG_ON()	2020-04-07 12:43:36 +02:00
packet	packet: fix data-race in fanout_flow_is_huge()	2020-04-07 13:43:55 +02:00
phonet
rds	net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'	2020-04-07 13:43:22 +02:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-04-07 13:28:52 +02:00
rose
rxrpc
sched	net_sched: ematch: reject invalid TCF_EM_SIMPLE	2020-04-07 13:45:58 +02:00
sctp	sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY	2020-04-07 13:29:10 +02:00
sunrpc	sunrpc: fix crash when cache_head become valid before update	2020-04-07 13:08:11 +02:00
switchdev
tipc	tipc: set sysctl_tipc_rmem and named_timeout right range	2020-04-07 13:41:27 +02:00
unix	net: fix warning in af_unix	2020-04-07 12:34:56 +02:00
vmw_vsock	VSOCK: bind to random port for VMADDR_PORT_ANY	2020-04-07 12:41:40 +02:00
wimax
wireless	cfg80211: check for set_wiphy_params	2020-04-07 13:38:48 +02:00
x25	net/x25: fix nonblocking connect	2020-04-07 13:45:13 +02:00
xfrm
compat.c
Kconfig
Makefile
socket.c	compat_ioctl: handle SIOCOUTQNSD	2020-04-07 13:37:06 +02:00
sysctl_net.c