android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
android_kernel_asus_sm8350/net
History
Ying Xue edf5ff04a4 tipc: fix uninit-value in tipc_nl_compat_link_set 
syzbot reports following splat:

BUG: KMSAN: uninit-value in strlen+0x3b/0xa0 lib/string.c:486
CPU: 1 PID: 9306 Comm: syz-executor172 Not tainted 4.20.0-rc7+ #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x173/0x1d0 lib/dump_stack.c:113
  kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
  __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313
  strlen+0x3b/0xa0 lib/string.c:486
  nla_put_string include/net/netlink.h:1154 [inline]
  __tipc_nl_compat_link_set net/tipc/netlink_compat.c:708 [inline]
  tipc_nl_compat_link_set+0x929/0x1220 net/tipc/netlink_compat.c:744
  __tipc_nl_compat_doit net/tipc/netlink_compat.c:311 [inline]
  tipc_nl_compat_doit+0x3aa/0xaf0 net/tipc/netlink_compat.c:344
  tipc_nl_compat_handle net/tipc/netlink_compat.c:1107 [inline]
  tipc_nl_compat_recv+0x14d7/0x2760 net/tipc/netlink_compat.c:1210
  genl_family_rcv_msg net/netlink/genetlink.c:601 [inline]
  genl_rcv_msg+0x185f/0x1a60 net/netlink/genetlink.c:626
  netlink_rcv_skb+0x444/0x640 net/netlink/af_netlink.c:2477
  genl_rcv+0x63/0x80 net/netlink/genetlink.c:637
  netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
  netlink_unicast+0xf40/0x1020 net/netlink/af_netlink.c:1336
  netlink_sendmsg+0x127f/0x1300 net/netlink/af_netlink.c:1917
  sock_sendmsg_nosec net/socket.c:621 [inline]
  sock_sendmsg net/socket.c:631 [inline]
  ___sys_sendmsg+0xdb9/0x11b0 net/socket.c:2116
  __sys_sendmsg net/socket.c:2154 [inline]
  __do_sys_sendmsg net/socket.c:2163 [inline]
  __se_sys_sendmsg+0x305/0x460 net/socket.c:2161
  __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161
  do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
  entry_SYSCALL_64_after_hwframe+0x63/0xe7

The uninitialised access happened in
    nla_put_string(skb, TIPC_NLA_LINK_NAME, lc->name)

This is because lc->name string is not validated before it's used.

Reported-by: syzbot+d78b8a29241a195aefb8@syzkaller.appspotmail.com
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-01-15 20:29:20 -08:00
..
6lowpan
6lowpan: convert to DEFINE_SHOW_ATTRIBUTE
2018-12-19 00:28:05 +01:00
9p
9p/net: put a lower bound on msize
2018-12-25 17:07:49 +09:00
802
…
8021q
net: core: dev: Add extack argument to dev_change_flags()
2018-12-06 13:26:07 -08:00
appletalk
Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL
2018-06-28 10:40:47 -07:00
atm
Revert "net: simplify sock_poll_wait"
2018-10-23 10:57:06 -07:00
ax25
ax25: fix a use-after-free in ax25_fillin_cb()
2018-12-30 14:07:54 -08:00
batman-adv
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
bluetooth
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2018-12-27 13:53:32 -08:00
bpf
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2018-12-10 18:00:43 -08:00
bpfilter
net: bpfilter: disallow to remove bpfilter module while being used
2019-01-11 18:05:41 -08:00
bridge
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
2019-01-15 13:31:46 -08:00
caif
Revert "net: simplify sock_poll_wait"
2018-10-23 10:57:06 -07:00
can
can: gw: ensure DLC boundaries after CAN frame modification
2019-01-07 05:17:51 -08:00
ceph
libceph: allow setting abort_on_full for rbd
2019-01-07 22:47:48 +01:00
core
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-01-16 05:13:36 +12:00
dcb
net: dcb: Add priority-to-DSCP map getters
2018-07-27 13:17:50 -07:00
dccp
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
decnet
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
dns_resolver
dns: Allow the dns resolver to retrieve a server set
2018-10-04 09:40:52 -07:00
dsa
net: dsa: ksz: Add STP multicast handling
2018-12-16 14:23:33 -08:00
ethernet
net: ethernet: provide nvmem_get_mac_address()
2018-12-03 15:40:30 -08:00
hsr
…
ieee802154
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-12-24 16:19:56 -08:00
ife
net: sched: ife: check on metadata length
2018-04-22 21:12:00 -04:00
ipv4
net: ipv4: Fix memory leak in network namespace dismantle
2019-01-15 13:33:44 -08:00
ipv6
ip6_gre: update version related info when changing link
2019-01-15 13:33:44 -08:00
iucv
iucv: Remove SKB list assumptions.
2018-11-10 16:55:11 -08:00
kcm
Revert "kcm: remove any offset before parsing messages"
2018-09-17 18:43:42 -07:00
key
af_key: fix indentation on declaration statement
2018-11-15 18:09:32 +01:00
l2tp
ppp: Move PFC decompression to PPP generic layer
2018-12-20 16:49:30 -08:00
l3mdev
l3mdev: add function to retreive upper master
2018-12-03 14:15:26 -08:00
lapb
…
llc
llc: do not use sk_eat_skb()
2018-10-22 19:59:20 -07:00
mac80211
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2018-12-27 13:53:32 -08:00
mac802154
mac802154: Remove VLA usage of skcipher
2018-09-28 12:46:07 +08:00
mpls
net/mpls: Handle kernel side filtering of route dumps
2018-10-16 00:14:07 -07:00
ncsi
net/ncsi: Add NCSI Mellanox OEM command
2018-11-27 16:37:20 -08:00
netfilter
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
2019-01-15 13:31:46 -08:00
netlabel
netlabel: check for IPV4MASK in addrinfo_get
2018-09-21 18:58:34 -07:00
netlink
net: netlink: rename NETLINK_DUMP_STRICT_CHK -> NETLINK_GET_STRICT_CHK
2018-12-14 11:44:31 -08:00
netrom
netrom: fix locking in nr_find_socket()
2018-12-30 20:24:16 -08:00
nfc
net: Revert recent Spectre-v1 patches.
2018-12-23 16:01:35 -08:00
nsh
nsh: set mac len based on inner packet
2018-07-12 16:55:29 -07:00
openvswitch
openvswitch: Fix IPv6 later frags parsing
2019-01-04 13:00:02 -08:00
packet
packet: Do not leak dev refcounts on error exit
2019-01-08 21:41:40 -05:00
phonet
net: Revert recent Spectre-v1 patches.
2018-12-23 16:01:35 -08:00
psample
…
qrtr
net: qrtr: Reset the node and port ID of broadcast messages
2018-07-05 20:20:03 +09:00
rds
rds: use DIV_ROUND_UP instead of ceil
2019-01-07 07:22:36 -08:00
rfkill
rfkill: gpio: Remove unused include
2018-12-18 13:13:56 +01:00
rose
Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL
2018-06-28 10:40:47 -07:00
rxrpc
rxrpc: Fix life check
2018-11-15 11:35:40 -08:00
sched
sch_cake: Correctly update parent qlen when splitting GSO packets
2019-01-15 20:12:01 -08:00
sctp
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
smc
smc: move unhash as early as possible in smc_release()
2019-01-07 14:40:27 -05:00
strparser
bpf, sockmap: convert to generic sk_msg interface
2018-10-15 12:23:19 -07:00
sunrpc
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
switchdev
net: switchdev: Add extack to switchdev_handle_port_obj_add() callback
2018-12-12 16:34:22 -08:00
tipc
tipc: fix uninit-value in tipc_nl_compat_link_set
2019-01-15 20:29:20 -08:00
tls
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-12-21 15:06:20 -08:00
unix
Revert "net: simplify sock_poll_wait"
2018-10-23 10:57:06 -07:00
vmw_vsock
VSOCK: Send reset control packet when socket is partially bound
2018-12-18 11:53:42 -08:00
wimax
wimax: remove blank lines at EOF
2018-07-24 14:10:42 -07:00
wireless
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2018-12-27 13:53:32 -08:00
x25
net/x25: handle call collisions
2018-11-29 14:25:36 -08:00
xdp
xsk: simplify AF_XDP socket teardown
2018-12-19 21:45:17 +01:00
xfrm
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-12-20 11:53:36 -08:00
compat.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
Kconfig
net: convert bridge_nf to use skb extension infrastructure
2018-12-19 11:21:37 -08:00
Makefile
bpfilter: check compiler capability in Kconfig
2018-06-28 13:36:39 +09:00
socket.c
y2038: more syscalls and cleanups
2018-12-28 12:45:04 -08:00
sysctl_net.c
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00