Ido Schimmel abd46fca02 rtnetlink: Disallow FDB configuration for non-Ethernet device ... [ Upstream commit da71577545a52be3e0e9225a946e5fd79cfab015 ] When an FDB entry is configured, the address is validated to have the length of an Ethernet address, but the device for which the address is configured can be of any type. The above can result in the use of uninitialized memory when the address is later compared against existing addresses since 'dev->addr_len' is used and it may be greater than ETH_ALEN, as with ip6tnl devices. Fix this by making sure that FDB entries are only configured for Ethernet devices. BUG: KMSAN: uninit-value in memcmp+0x11d/0x180 lib/string.c:863 CPU: 1 PID: 4318 Comm: syz-executor998 Not tainted 4.19.0-rc3+ #49 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x14b/0x190 lib/dump_stack.c:113 kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956 __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645 memcmp+0x11d/0x180 lib/string.c:863 dev_uc_add_excl+0x165/0x7b0 net/core/dev_addr_lists.c:464 ndo_dflt_fdb_add net/core/rtnetlink.c:3463 [inline] rtnl_fdb_add+0x1081/0x1270 net/core/rtnetlink.c:3558 rtnetlink_rcv_msg+0xa0b/0x1530 net/core/rtnetlink.c:4715 netlink_rcv_skb+0x36e/0x5f0 net/netlink/af_netlink.c:2454 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:4733 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x1638/0x1720 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x1205/0x1290 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe70/0x1290 net/socket.c:2114 __sys_sendmsg net/socket.c:2152 [inline] __do_sys_sendmsg net/socket.c:2161 [inline] __se_sys_sendmsg+0x2a3/0x3d0 net/socket.c:2159 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2159 do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x440ee9 Code: e8 cc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fff6a93b518 EFLAGS: 00000213 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440ee9 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8 R10: 00000000004002c8 R11: 0000000000000213 R12: 000000000000b4b0 R13: 0000000000401ec0 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181 kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan_hooks.c:100 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2718 [inline] __kmalloc_node_track_caller+0x9e7/0x1160 mm/slub.c:4351 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x2f5/0x9e0 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:996 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1189 [inline] netlink_sendmsg+0xb49/0x1290 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe70/0x1290 net/socket.c:2114 __sys_sendmsg net/socket.c:2152 [inline] __do_sys_sendmsg net/socket.c:2161 [inline] __se_sys_sendmsg+0x2a3/0x3d0 net/socket.c:2159 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2159 do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 v2: * Make error message more specific (David) Fixes: 090096bf3d ("net: generic fdb support for drivers without ndo_fdb_<op>") Signed-off-by: Ido Schimmel <idosch@mellanox.com> Reported-and-tested-by: syzbot+3a288d5f5530b901310e@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+d53ab4e92a1db04110ff@syzkaller.appspotmail.com Cc: Vlad Yasevich <vyasevich@gmail.com> Cc: David Ahern <dsahern@gmail.com> Reviewed-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-11-10 07:41:42 -08:00
..
6lowpan	6lowpan: iphc: reset mac_header after decompress to fix panic	2018-10-10 08:52:04 +02:00
9p	net/9p: fix error path of p9_virtio_probe	2018-09-15 09:40:39 +02:00
802
8021q	vlan: also check phy_driver ts_info for vlan's real device	2018-04-13 19:50:25 +02:00
appletalk
atm	net: atm: Fix potential Spectre v1	2018-05-16 10:06:51 +02:00
ax25
batman-adv	batman-adv: fix packet loss for broadcasted DHCP packets to a server	2018-05-30 07:49:06 +02:00
bluetooth	Bluetooth: SMP: fix crash in unpairing	2018-11-10 07:41:33 -08:00
bridge	net: bridge: remove ipv6 zero address check in mcast queries	2018-11-10 07:41:41 -08:00
caif	net: caif: Add a missing rcu_read_unlock() in caif_flow_cb	2018-09-05 09:18:34 +02:00
can
ceph	libceph: validate con->state at the top of try_write()	2018-05-02 07:53:42 -07:00
core	rtnetlink: Disallow FDB configuration for non-Ethernet device	2018-11-10 07:41:42 -08:00
dcb	net: dcb: For wild-card lookups, use priority -1, not 0	2018-09-19 22:48:58 +02:00
dccp	dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()	2018-08-22 07:48:35 +02:00
decnet
dns_resolver	KEYS: DNS: fix parsing multiple options	2018-07-22 14:25:54 +02:00
dsa	net: dsa: Do not suspend/resume closed slave_dev	2018-08-06 16:24:41 +02:00
ethernet
hsr
ieee802154	net: 6lowpan: fix reserved space for single frames	2018-09-09 20:04:32 +02:00
ipv4	net: drop skb on failure in ip_check_defrag()	2018-11-10 07:41:42 -08:00
ipv6	net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs	2018-11-10 07:41:41 -08:00
ipx
irda	irda: Only insert new objects into the global database via setsockopt	2018-09-15 09:40:40 +02:00
iucv	af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers	2018-11-10 07:41:35 -08:00
key	af_key: Always verify length of provided sadb_key	2018-06-16 09:54:25 +02:00
l2tp	l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()	2018-11-10 07:41:38 -08:00
l3mdev
lapb
llc	llc: use refcount_inc_not_zero() for llc_sap_find()	2018-08-22 07:48:35 +02:00
mac80211	mac80211: Always report TX status	2018-11-10 07:41:33 -08:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-09-09 20:04:32 +02:00
mpls
netfilter	netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user	2018-09-19 22:48:59 +02:00
netlabel	netlabel: check for IPV4MASK in addrinfo_get	2018-10-20 09:52:36 +02:00
netlink	netlink: Don't shift on 64 for ngroups	2018-08-09 12:19:28 +02:00
netrom
nfc	NFC: Fix possible memory corruption when handling SHDLC I-Frame commands	2018-09-29 03:08:51 -07:00
openvswitch	openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found	2018-05-26 08:48:47 +02:00
packet	packet: refine ring v3 block size test to hold one frame	2018-08-24 13:27:01 +02:00
phonet
rds	rds: avoid unenecessary cong_update in loop transport	2018-07-22 14:25:54 +02:00
rfkill	rfkill: gpio: fix memory leak in probe error path	2018-05-16 10:06:51 +02:00
rose
rxrpc	rxrpc: check return value of skb_to_sgvec always	2018-04-13 19:50:23 +02:00
sched	net: sched: gred: pass the right attribute to gred_change_table_def()	2018-11-10 07:41:41 -08:00
sctp	sctp: fix race on sctp_id2asoc	2018-11-10 07:41:42 -08:00
sunrpc	rpc_pipefs: fix double-dput()	2018-04-24 09:32:11 +02:00
switchdev
tipc	tipc: add policy for TIPC_NLA_NET_ADDR	2018-04-29 07:50:06 +02:00
unix	net: drop write-only stack variable	2018-11-10 07:41:34 -08:00
vmw_vsock	vsock: split dwork to avoid reinitializations	2018-08-22 07:48:35 +02:00
wimax
wireless	cfg80211: reg: Init wiphy_idx in regulatory_hint_core()	2018-11-10 07:41:33 -08:00
x25
xfrm	xfrm: Clear sk_dst_cache when applying per-socket policy.	2018-11-10 07:41:37 -08:00
compat.c	net: support compat 64-bit time in {s,g}etsockopt	2018-05-26 08:48:47 +02:00
Kconfig
Makefile
socket.c	net: socket: fix a missing-check bug	2018-11-10 07:41:41 -08:00
sysctl_net.c