Eric Dumazet d80cbf9f5f rtnetlink: validate attributes in do_setlink() ... [ Upstream commit 644c7eebbfd59e72982d11ec6cc7d39af12450ae ] It seems that rtnl_group_changelink() can call do_setlink while a prior call to validate_linkmsg(dev = NULL, ...) could not validate IFLA_ADDRESS / IFLA_BROADCAST Make sure do_setlink() calls validate_linkmsg() instead of letting its callers having this responsibility. With help from Dmitry Vyukov, thanks a lot ! BUG: KMSAN: uninit-value in is_valid_ether_addr include/linux/etherdevice.h:199 [inline] BUG: KMSAN: uninit-value in eth_prepare_mac_addr_change net/ethernet/eth.c:275 [inline] BUG: KMSAN: uninit-value in eth_mac_addr+0x203/0x2b0 net/ethernet/eth.c:308 CPU: 1 PID: 8695 Comm: syz-executor3 Not tainted 4.17.0-rc5+ #103 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:113 kmsan_report+0x149/0x260 mm/kmsan/kmsan.c:1084 __msan_warning_32+0x6e/0xc0 mm/kmsan/kmsan_instr.c:686 is_valid_ether_addr include/linux/etherdevice.h:199 [inline] eth_prepare_mac_addr_change net/ethernet/eth.c:275 [inline] eth_mac_addr+0x203/0x2b0 net/ethernet/eth.c:308 dev_set_mac_address+0x261/0x530 net/core/dev.c:7157 do_setlink+0xbc3/0x5fc0 net/core/rtnetlink.c:2317 rtnl_group_changelink net/core/rtnetlink.c:2824 [inline] rtnl_newlink+0x1fe9/0x37a0 net/core/rtnetlink.c:2976 rtnetlink_rcv_msg+0xa32/0x1560 net/core/rtnetlink.c:4646 netlink_rcv_skb+0x378/0x600 net/netlink/af_netlink.c:2448 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:4664 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x1678/0x1750 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg net/socket.c:639 [inline] ___sys_sendmsg+0xec0/0x1310 net/socket.c:2117 __sys_sendmsg net/socket.c:2155 [inline] __do_sys_sendmsg net/socket.c:2164 [inline] __se_sys_sendmsg net/socket.c:2162 [inline] __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162 do_syscall_64+0x152/0x230 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x455a09 RSP: 002b:00007fc07480ec68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fc07480f6d4 RCX: 0000000000455a09 RDX: 0000000000000000 RSI: 00000000200003c0 RDI: 0000000000000014 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000005d0 R14: 00000000006fdc20 R15: 0000000000000000 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline] kmsan_save_stack mm/kmsan/kmsan.c:294 [inline] kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685 kmsan_memcpy_origins+0x11d/0x170 mm/kmsan/kmsan.c:527 __msan_memcpy+0x109/0x160 mm/kmsan/kmsan_instr.c:478 do_setlink+0xb84/0x5fc0 net/core/rtnetlink.c:2315 rtnl_group_changelink net/core/rtnetlink.c:2824 [inline] rtnl_newlink+0x1fe9/0x37a0 net/core/rtnetlink.c:2976 rtnetlink_rcv_msg+0xa32/0x1560 net/core/rtnetlink.c:4646 netlink_rcv_skb+0x378/0x600 net/netlink/af_netlink.c:2448 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:4664 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x1678/0x1750 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg net/socket.c:639 [inline] ___sys_sendmsg+0xec0/0x1310 net/socket.c:2117 __sys_sendmsg net/socket.c:2155 [inline] __do_sys_sendmsg net/socket.c:2164 [inline] __se_sys_sendmsg net/socket.c:2162 [inline] __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162 do_syscall_64+0x152/0x230 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:189 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:315 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan.c:322 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2753 [inline] __kmalloc_node_track_caller+0xb32/0x11b0 mm/slub.c:4395 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x2cb/0x9e0 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:988 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline] netlink_sendmsg+0x76e/0x1350 net/netlink/af_netlink.c:1876 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg net/socket.c:639 [inline] ___sys_sendmsg+0xec0/0x1310 net/socket.c:2117 __sys_sendmsg net/socket.c:2155 [inline] __do_sys_sendmsg net/socket.c:2164 [inline] __se_sys_sendmsg net/socket.c:2162 [inline] __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162 do_syscall_64+0x152/0x230 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: e7ed828f10 ("netlink: support setting devgroup parameters") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-06-13 16:15:29 +02:00
..
datagram.c	net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA	2015-12-01 15:45:05 -05:00
dev.c	vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi	2018-04-29 07:50:05 +02:00
dev_addr_lists.c	net: fix uninit-value in __hw_addr_add_ex()	2018-05-16 10:06:50 +02:00
dev_ioctl.c	net: Zero terminate ifr_name in dev_ifname().	2017-08-11 09:08:52 -07:00
drop_monitor.c	drop_monitor: consider inserted data in genlmsg_end	2017-01-15 13:41:35 +01:00
dst.c	Fix an intermittent pr_emerg warning about lo becoming free.	2017-07-05 14:37:13 +02:00
dst_cache.c	net: dst_cache_per_cpu_dst_set() can be static	2018-02-25 11:03:55 +01:00
ethtool.c	ethtool: do not vzalloc(0) on registers dump	2017-06-17 06:39:36 +02:00
fib_rules.c	fib_rules: fix fib rule dumps across multiple skbs	2015-09-24 15:21:54 -07:00
filter.c	bpf: fix 32-bit divide by zero	2018-02-03 17:04:25 +01:00
flow.c	flow: Move __get_hash_from_flowi{4,6} into flow_dissector.c	2015-09-01 17:00:24 -07:00
flow_dissector.c	flow_dissector: properly cap thoff field	2018-01-31 12:06:14 +01:00
gen_estimator.c	net_sched: gen_estimator: extend pps limit	2015-07-08 13:59:20 -07:00
gen_stats.c	gen_stats.c: Duplicate xstats buffer for later use	2015-02-19 15:45:53 -05:00
link_watch.c	dev: introduce dev_get_iflink()	2015-04-02 14:04:59 -04:00
lwtunnel.c	dst: Pass net into dst->output	2015-10-08 04:27:03 -07:00
Makefile	net: add dst_cache support	2018-02-25 11:03:34 +01:00
neighbour.c	net: fix deadlock while clearing neighbor proxy table	2018-04-29 07:50:06 +02:00
net-procfs.c	rps: selective flow shedding during softnet overflow	2013-05-20 13:48:04 -07:00
net-sysfs.c	switchdev: rename SWITCHDEV_ATTR_* enum values to SWITCHDEV_ATTR_ID_*	2015-10-03 04:49:37 -07:00
net-sysfs.h	net: netdev_kobject_init: annotate with __init	2014-01-05 20:27:54 -05:00
net-traces.c	net: FIB tracepoints	2015-08-29 13:05:16 -07:00
net_namespace.c	net: move somaxconn init from sysctl code	2018-04-13 19:50:11 +02:00
netclassid_cgroup.c	Merge branch 'master' into for-4.4-fixes	2015-12-07 10:09:03 -05:00
netevent.c	netevent: remove automatic variable in register_netevent_notifier()	2015-05-31 00:03:21 -07:00
netpoll.c	netpoll: Check for skb->queue_mapping	2017-05-02 21:19:53 -07:00
netprio_cgroup.c	cgroup: fix handling of multi-destination migration from subtree_control enabling	2015-12-03 10:18:21 -05:00
pktgen.c	net: pktgen: remove rcu locking in pktgen_change_name()	2016-11-15 07:46:38 +01:00
ptp_classifier.c	ptp: Change ptp_class to a proper bitmask	2015-11-03 11:08:22 -05:00
request_sock.c	tcp: restore fastopen operations	2015-10-05 03:19:06 -07:00
rtnetlink.c	rtnetlink: validate attributes in do_setlink()	2018-06-13 16:15:29 +02:00
scm.c	unix: correctly track in-flight fds in sending process user_struct	2016-03-03 15:07:05 -08:00
secure_seq.c	net: remove a sparse error in secure_dccpv6_sequence_number()	2015-05-25 22:55:37 -04:00
skbuff.c	net: Fix untag for vlan packets without ethernet header	2018-05-30 07:49:07 +02:00
sock.c	sock_diag: fix use-after-free read in __sk_free	2018-05-26 08:48:58 +02:00
sock_diag.c	net: core: fix module type in sock_diag_bind	2018-01-17 09:35:29 +01:00
stream.c	net: fix sock_wake_async() rcu protection	2015-12-01 15:45:05 -05:00
sysctl_net_core.c	net: move somaxconn init from sysctl code	2018-04-13 19:50:11 +02:00
timestamping.c	net: skb_defer_rx_timestamp should check for phydev before setting up classify	2015-07-09 14:17:15 -07:00
tso.c	net: tso: add support for IPv6	2015-10-26 22:24:22 -07:00
utils.c	net: move net_get_random_once to lib	2015-10-08 05:26:35 -07:00