Xin Long 4f07b80c97 tipc: check msg->req data len in tipc_nl_compat_bearer_disable ... This patch is to fix an uninit-value issue, reported by syzbot: BUG: KMSAN: uninit-value in memchr+0xce/0x110 lib/string.c:981 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622 __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310 memchr+0xce/0x110 lib/string.c:981 string_is_valid net/tipc/netlink_compat.c:176 [inline] tipc_nl_compat_bearer_disable+0x2a1/0x480 net/tipc/netlink_compat.c:449 __tipc_nl_compat_doit net/tipc/netlink_compat.c:327 [inline] tipc_nl_compat_doit+0x3ac/0xb00 net/tipc/netlink_compat.c:360 tipc_nl_compat_handle net/tipc/netlink_compat.c:1178 [inline] tipc_nl_compat_recv+0x1b1b/0x27b0 net/tipc/netlink_compat.c:1281 TLV_GET_DATA_LEN() may return a negtive int value, which will be used as size_t (becoming a big unsigned long) passed into memchr, cause this issue. Similar to what it does in tipc_nl_compat_bearer_enable(), this fix is to return -EINVAL when TLV_GET_DATA_LEN() is negtive in tipc_nl_compat_bearer_disable(), as well as in tipc_nl_compat_link_stat_dump() and tipc_nl_compat_link_reset_stats(). v1->v2: - add the missing Fixes tags per Eric's request. Fixes: 0762216c0a ("tipc: fix uninit-value in tipc_nl_compat_bearer_enable") Fixes: 8b66fee7f8 ("tipc: fix uninit-value in tipc_nl_compat_link_reset_stats") Reported-by: syzbot+30eaa8bf392f7fafffaf@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-06-24 10:03:59 -07:00
..
addr.c
addr.h
bcast.c	tipc: add NULL pointer check	2019-04-04 17:34:11 -07:00
bcast.h	tipc: fix a null pointer deref	2019-03-21 09:56:55 -07:00
bearer.c	netlink: make validation more configurable for future strictness	2019-04-27 17:07:21 -04:00
bearer.h
core.c	tipc: change to use register_pernet_device	2019-06-22 16:51:47 -07:00
core.h	tipc: introduce new capability flag for cluster	2019-03-19 13:56:17 -07:00
diag.c
discover.c
discover.h
eth_media.c
group.c	tipc: purge deferredq list for each grp member in tipc_group_delete	2019-06-16 20:42:05 -07:00
group.h
ib_media.c
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
link.c	tipc: fix issues with early FAILOVER_MSG from peer	2019-06-18 10:03:37 -07:00
link.h	tipc: fix missing Name entries due to half-failover	2019-05-04 00:59:51 -04:00
Makefile
monitor.c	netlink: make nla_nest_start() add NLA_F_NESTED flag	2019-04-27 17:03:44 -04:00
monitor.h
msg.c
msg.h	tipc: reduce duplicate packets for unicast traffic	2019-04-04 18:29:25 -07:00
name_distr.c
name_distr.h
name_table.c	netlink: make nla_nest_start() add NLA_F_NESTED flag	2019-04-27 17:03:44 -04:00
name_table.h
net.c	netlink: make validation more configurable for future strictness	2019-04-27 17:07:21 -04:00
net.h
netlink_compat.c	tipc: check msg->req data len in tipc_nl_compat_bearer_disable	2019-06-24 10:03:59 -07:00
netlink.c	genetlink: optionally validate strictly/dumps	2019-04-27 17:07:22 -04:00
netlink.h
node.c	tipc: fix issues with early FAILOVER_MSG from peer	2019-06-18 10:03:37 -07:00
node.h	tipc: improve TIPC throughput by Gap ACK blocks	2019-04-04 18:29:25 -07:00
socket.c	tipc: fix hanging clients using poll with EPOLLOUT flag	2019-05-09 09:26:09 -07:00
socket.h
subscr.c
subscr.h	tipc: fix modprobe tipc failed after switch order of device registration	2019-05-20 10:45:43 -07:00
sysctl.c	tipc: set sysctl_tipc_rmem and named_timeout right range	2019-04-16 21:32:02 -07:00
topsrv.c	tipc: fix modprobe tipc failed after switch order of device registration	2019-05-20 10:45:43 -07:00
topsrv.h
trace.c
trace.h
udp_media.c	tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb	2019-06-18 20:48:45 -04:00
udp_media.h