| Message ID | 20230823064348.2252280-1-idosch@nvidia.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 30188bd7838c16a98a520db1fe9df01ffc6ed368 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] rtnetlink: Reject negative ifindexes in RTM_NEWLINK | expand |
On Wed, 23 Aug 2023 09:43:48 +0300 Ido Schimmel wrote: > Negative ifindexes are illegal, but the kernel does not validate the > ifindex in the ancillary header of RTM_NEWLINK messages, resulting in > the kernel generating a warning [1] when such an ifindex is specified. Reviewed-by: Jakub Kicinski <kuba@kernel.org> Thanks!
Hello: This patch was applied to netdev/net.git (main) by Paolo Abeni <pabeni@redhat.com>: On Wed, 23 Aug 2023 09:43:48 +0300 you wrote: > Negative ifindexes are illegal, but the kernel does not validate the > ifindex in the ancillary header of RTM_NEWLINK messages, resulting in > the kernel generating a warning [1] when such an ifindex is specified. > > Fix by rejecting negative ifindexes. > > [1] > WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593 > [...] > Call Trace: > <TASK> > register_netdevice+0x69a/0x1490 net/core/dev.c:10081 > br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552 > rtnl_newlink_create net/core/rtnetlink.c:3471 [inline] > __rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688 > rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701 > rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427 > netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 > netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] > netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368 > netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 > sock_sendmsg_nosec net/socket.c:728 [inline] > sock_sendmsg+0xd9/0x180 net/socket.c:751 > ____sys_sendmsg+0x6ac/0x940 net/socket.c:2538 > ___sys_sendmsg+0x135/0x1d0 net/socket.c:2592 > __sys_sendmsg+0x117/0x1e0 net/socket.c:2621 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > > [...] Here is the summary with links: - [net] rtnetlink: Reject negative ifindexes in RTM_NEWLINK https://git.kernel.org/netdev/net/c/30188bd7838c You are awesome, thank you!
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index bcebdeb59163..00c94d9622b4 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -3561,6 +3561,9 @@ static int __rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh, if (ifm->ifi_index > 0) { link_specified = true; dev = __dev_get_by_index(net, ifm->ifi_index); + } else if (ifm->ifi_index < 0) { + NL_SET_ERR_MSG(extack, "ifindex can't be negative"); + return -EINVAL; } else if (tb[IFLA_IFNAME] || tb[IFLA_ALT_IFNAME]) { link_specified = true; dev = rtnl_dev_get(net, tb);
Negative ifindexes are illegal, but the kernel does not validate the ifindex in the ancillary header of RTM_NEWLINK messages, resulting in the kernel generating a warning [1] when such an ifindex is specified. Fix by rejecting negative ifindexes. [1] WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593 [...] Call Trace: <TASK> register_netdevice+0x69a/0x1490 net/core/dev.c:10081 br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552 rtnl_newlink_create net/core/rtnetlink.c:3471 [inline] __rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701 rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:728 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:751 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2538 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2592 __sys_sendmsg+0x117/0x1e0 net/socket.c:2621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 38f7b870d4a6 ("[RTNETLINK]: Link creation API") Reported-by: syzbot+5ba06978f34abb058571@syzkaller.appspotmail.com Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> --- net/core/rtnetlink.c | 3 +++ 1 file changed, 3 insertions(+)