MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-22 23:13:01 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
f820034864
linux-yocto/net/tipc
History
Haixia Qu f82727adcf tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer 
The reproduction steps:
1. create a tun interface
2. enable l2 bearer
3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun

tipc: Started in network mode
tipc: Node identity 8af312d38a21, cluster identity 4711
tipc: Enabled bearer <eth:syz_tun>, priority 1
Oops: general protection fault
KASAN: null-ptr-deref in range
CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT
Hardware name: QEMU Ubuntu 24.04 PC
RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0

the ub was in fact a struct dev.

when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or
other media when other thread changes it.

fix this by checking media_id.

Fixes: 832629ca5c ("tipc: add UDP remoteip dump to netlink API")
Signed-off-by: Haixia Qu <hxqu@hillstonenet.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20250617055624.2680-1-hxqu@hillstonenet.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-18 14:19:50 -07:00
..
addr.c
addr.h
bcast.c net: tipc: avoid possible garbage value 2024-09-13 20:03:43 -07:00
bcast.h
bearer.c net/tipc: replace deprecated strcpy with strscpy 2024-08-29 12:33:14 -07:00
bearer.h
core.c
core.h tipc: Remove unused struct declaration 2024-07-12 03:41:32 +01:00
crypto.c net: tipc: fix refcount warning in tipc_aead_encrypt 2025-05-29 12:07:26 +02:00
crypto.h
diag.c sock_diag: add module pointer to "struct sock_diag_handler" 2024-01-23 15:13:54 +01:00
discover.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
discover.h
eth_media.c
group.c
group.h
ib_media.c
Kconfig net: tipc: remove redundant 'bool' from CONFIG_TIPC_{MEDIA_UDP,CRYPTO} 2024-02-07 13:18:43 +00:00
link.c tipc: Removing deprecated strncpy() 2025-04-15 13:37:14 +02:00
link.h
Makefile tipc: rename the module name diag to tipc_diag 2024-02-06 13:47:36 +01:00
monitor.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
monitor.h
msg.c tipc: fix a possible memleak in tipc_buf_append 2024-05-01 18:39:44 -07:00
msg.h
name_distr.c
name_distr.h
name_table.c net: tipc: remove one synchronize_net() from tipc_nametbl_stop() 2024-12-06 17:41:28 -08:00
name_table.h net: tipc: remove one synchronize_net() from tipc_nametbl_stop() 2024-12-06 17:41:28 -08:00
net.c
net.h
netlink_compat.c tipc: Remove redundant call to TLV_SPACE() 2023-11-17 02:27:27 +00:00
netlink.c
netlink.h
node.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
node.h
socket.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
socket.h
subscr.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
subscr.h
sysctl.c net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
topsrv.c
topsrv.h
trace.c
trace.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
udp_media.c tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer 2025-06-18 14:19:50 -07:00
udp_media.h