lkml.org 
[lkml]   [2019]   [Apr]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.0 60/89] tipc: check link name with right length in tipc_nl_compat_link_set
    Date
    From: Xin Long <lucien.xin@gmail.com>

    commit 8c63bf9ab4be8b83bd8c34aacfd2f1d2c8901c8a upstream.

    A similar issue as fixed by Patch "tipc: check bearer name with right
    length in tipc_nl_compat_bearer_enable" was also found by syzbot in
    tipc_nl_compat_link_set().

    The length to check with should be 'TLV_GET_DATA_LEN(msg->req) -
    offsetof(struct tipc_link_config, name)'.

    Reported-by: syzbot+de00a87b8644a582ae79@syzkaller.appspotmail.com
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/tipc/netlink_compat.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    --- a/net/tipc/netlink_compat.c
    +++ b/net/tipc/netlink_compat.c
    @@ -777,7 +777,12 @@ static int tipc_nl_compat_link_set(struc

    lc = (struct tipc_link_config *)TLV_DATA(msg->req);

    - len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
    + len = TLV_GET_DATA_LEN(msg->req);
    + len -= offsetof(struct tipc_link_config, name);
    + if (len <= 0)
    + return -EINVAL;
    +
    + len = min_t(int, len, TIPC_MAX_LINK_NAME);
    if (!string_is_valid(lc->name, len))
    return -EINVAL;


    \
     
     \ /
      Last update: 2019-04-30 13:55    [W:5.672 / U:0.196 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site