Commit 3a20773b authored Feb 20, 2020 by Nikolay Aleksandrov Committed by David S. Miller Feb 20, 2020

net: netlink: cap max groups which will be considered in netlink_bind()



Since nl_groups is a u32 we can't bind more groups via ->bind
(netlink_bind) call, but netlink has supported more groups via
setsockopt() for a long time and thus nlk->ngroups could be over 32.
Recently I added support for per-vlan notifications and increased the
groups to 33 for NETLINK_ROUTE which exposed an old bug in the
netlink_bind() code causing out-of-bounds access on archs where unsigned
long is 32 bits via test_bit() on a local variable. Fix this by capping the
maximum groups in netlink_bind() to BITS_PER_TYPE(u32), effectively
capping them at 32 which is the minimum of allocated groups and the
maximum groups which can be bound via netlink_bind().

CC: Christophe Leroy <christophe.leroy@c-s.fr>
CC: Richard Guy Briggs <rgb@redhat.com>
Fixes: 4f520900 ("netlink: have netlink per-protocol bind function return an error code.")
Reported-by: Erhard F. <erhard_f@mailbox.org>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 971617c3

net/netlink/af_netlink.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -1014,7 +1014,8 @@ static int netlink_bind(struct socket sock, struct sockaddr addr,
		if (nlk->netlink_bind && groups) {
		int group;

		for (group = 0; group < nlk->ngroups; group++) {
		/* nl_groups is a u32, so cap the maximum groups we can bind */
		for (group = 0; group < BITS_PER_TYPE(u32); group++) {
		if (!test_bit(group, &groups))
		continue;
		err = nlk->netlink_bind(net, group + 1);
		@@ -1033,7 +1034,7 @@ static int netlink_bind(struct socket sock, struct sockaddr addr,
		netlink_insert(sk, nladdr->nl_pid) :
		netlink_autobind(sock);
		if (err) {
		netlink_undo_bind(nlk->ngroups, groups, sk);
		netlink_undo_bind(BITS_PER_TYPE(u32), groups, sk);
		goto unlock;
		}
		}

Admin message