LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Paolo Abeni <pabeni@redhat.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.14 19/80] team: avoid adding twice the same option to the event list
Date: Fri, 27 Apr 2018 15:58:12 +0200	[thread overview]
Message-ID: <20180427135733.887299401@linuxfoundation.org> (raw)
In-Reply-To: <20180427135732.928644313@linuxfoundation.org>

4.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Abeni <pabeni@redhat.com>


[ Upstream commit 4fb0534fb7bbc2346ba7d3a072b538007f4135a5 ]

When parsing the options provided by the user space,
team_nl_cmd_options_set() insert them in a temporary list to send
multiple events with a single message.
While each option's attribute is correctly validated, the code does
not check for duplicate entries before inserting into the event
list.

Exploiting the above, the syzbot was able to trigger the following
splat:

kernel BUG at lib/list_debug.c:31!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
    (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4466 Comm: syzkaller556835 Not tainted 4.16.0+ #17
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__list_add_valid+0xaa/0xb0 lib/list_debug.c:29
RSP: 0018:ffff8801b04bf248 EFLAGS: 00010286
RAX: 0000000000000058 RBX: ffff8801c8fc7a90 RCX: 0000000000000000
RDX: 0000000000000058 RSI: ffffffff815fbf41 RDI: ffffed0036097e3f
RBP: ffff8801b04bf260 R08: ffff8801b0b2a700 R09: ffffed003b604f90
R10: ffffed003b604f90 R11: ffff8801db027c87 R12: ffff8801c8fc7a90
R13: ffff8801c8fc7a90 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000b98880(0000) GS:ffff8801db000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000043fc30 CR3: 00000001afe8e000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  __list_add include/linux/list.h:60 [inline]
  list_add include/linux/list.h:79 [inline]
  team_nl_cmd_options_set+0x9ff/0x12b0 drivers/net/team/team.c:2571
  genl_family_rcv_msg+0x889/0x1120 net/netlink/genetlink.c:599
  genl_rcv_msg+0xc6/0x170 net/netlink/genetlink.c:624
  netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448
  genl_rcv+0x28/0x40 net/netlink/genetlink.c:635
  netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
  netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336
  netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901
  sock_sendmsg_nosec net/socket.c:629 [inline]
  sock_sendmsg+0xd5/0x120 net/socket.c:639
  ___sys_sendmsg+0x805/0x940 net/socket.c:2117
  __sys_sendmsg+0x115/0x270 net/socket.c:2155
  SYSC_sendmsg net/socket.c:2164 [inline]
  SyS_sendmsg+0x29/0x30 net/socket.c:2162
  do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4458b9
RSP: 002b:00007ffd1d4a7278 EFLAGS: 00000213 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000000001b RCX: 00000000004458b9
RDX: 0000000000000010 RSI: 0000000020000d00 RDI: 0000000000000004
RBP: 00000000004a74ed R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000213 R12: 00007ffd1d4a7348
R13: 0000000000402a60 R14: 0000000000000000 R15: 0000000000000000
Code: 75 e8 eb a9 48 89 f7 48 89 75 e8 e8 d1 85 7b fe 48 8b 75 e8 eb bb 48
89 f2 48 89 d9 4c 89 e6 48 c7 c7 a0 84 d8 87 e8 ea 67 28 fe <0f> 0b 0f 1f
40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41
RIP: __list_add_valid+0xaa/0xb0 lib/list_debug.c:29 RSP: ffff8801b04bf248

This changeset addresses the avoiding list_add() if the current
option is already present in the event list.

Reported-and-tested-by: syzbot+4d4af685432dc0e56c91@syzkaller.appspotmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Fixes: 2fcdb2c9e659 ("team: allow to send multiple set events in one message")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/team/team.c |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -261,6 +261,17 @@ static void __team_option_inst_mark_remo
 	}
 }
 
+static bool __team_option_inst_tmp_find(const struct list_head *opts,
+					const struct team_option_inst *needle)
+{
+	struct team_option_inst *opt_inst;
+
+	list_for_each_entry(opt_inst, opts, tmp_list)
+		if (opt_inst == needle)
+			return true;
+	return false;
+}
+
 static int __team_options_register(struct team *team,
 				   const struct team_option *option,
 				   size_t option_count)
@@ -2561,6 +2572,14 @@ static int team_nl_cmd_options_set(struc
 			if (err)
 				goto team_put;
 			opt_inst->changed = true;
+
+			/* dumb/evil user-space can send us duplicate opt,
+			 * keep only the last one
+			 */
+			if (__team_option_inst_tmp_find(&opt_inst_list,
+							opt_inst))
+				continue;
+
 			list_add(&opt_inst->tmp_list, &opt_inst_list);
 		}
 		if (!opt_found) {

  parent reply	other threads:[~2018-04-27 13:58 UTC|newest]

Thread overview: 90+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-27 13:57 [PATCH 4.14 00/80] 4.14.38-stable review Greg Kroah-Hartman
2018-04-27 13:57 ` [PATCH 4.14 01/80] Revert "pinctrl: intel: Initialize GPIO properly when used through irqchip" Greg Kroah-Hartman
2018-04-27 13:57 ` [PATCH 4.14 02/80] drm: bridge: dw-hdmi: Fix overflow workaround for Amlogic Meson GX SoCs Greg Kroah-Hartman
2018-04-27 13:57 ` [PATCH 4.14 03/80] i40e: Fix attach VF to VM issue Greg Kroah-Hartman
2018-04-27 13:57 ` [PATCH 4.14 04/80] tpm: cmd_ready command can be issued only after granting locality Greg Kroah-Hartman
2018-04-27 13:57 ` [PATCH 4.14 05/80] tpm: tpm-interface: fix tpm_transmit/_cmd kdoc Greg Kroah-Hartman
2018-04-27 13:57 ` [PATCH 4.14 06/80] tpm: add retry logic Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 07/80] Revert "ath10k: send (re)assoc peer command when NSS changed" Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 08/80] bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 09/80] ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 10/80] ipv6: sr: fix NULL pointer dereference in seg6_do_srh_encap()- v4 pkts Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 11/80] KEYS: DNS: limit the length of option strings Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 12/80] l2tp: check sockaddr length in pppol2tp_connect() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 13/80] net: validate attribute sizes in neigh_dump_table() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 14/80] llc: delete timers synchronously in llc_sk_free() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 15/80] tcp: dont read out-of-bounds opsize Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 16/80] net: af_packet: fix race in PACKET_{R|T}X_RING Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 17/80] tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 18/80] net: fix deadlock while clearing neighbor proxy table Greg Kroah-Hartman
2018-04-27 13:58 ` Greg Kroah-Hartman [this message]
2018-04-27 13:58 ` [PATCH 4.14 20/80] net/smc: fix shutdown in state SMC_LISTEN Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 21/80] team: fix netconsole setup over team Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 22/80] packet: fix bitfield update race Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 23/80] tipc: add policy for TIPC_NLA_NET_ADDR Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 24/80] pppoe: check sockaddr length in pppoe_connect() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 25/80] vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 26/80] amd-xgbe: Add pre/post auto-negotiation phy hooks Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 27/80] sctp: do not check port in sctp_inet6_cmp_addr Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 28/80] amd-xgbe: Improve KR auto-negotiation and training Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 29/80] strparser: Do not call mod_delayed_work with a timeout of LONG_MAX Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 30/80] amd-xgbe: Only use the SFP supported transceiver signals Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 31/80] strparser: Fix incorrect strp->need_bytes value Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 32/80] net: sched: ife: signal not finding metaid Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 33/80] tcp: clear tp->packets_out when purging write queue Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 34/80] net: sched: ife: handle malformed tlv length Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 35/80] net: sched: ife: check on metadata length Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 36/80] llc: hold llc_sap before release_sock() Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 37/80] llc: fix NULL pointer deref for SOCK_ZAPPED Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 38/80] net: ethernet: ti: cpsw: fix tx vlan priority mapping Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 39/80] virtio_net: split out ctrl buffer Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 40/80] virtio_net: fix adding vids on big-endian Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 41/80] Revert "microblaze: fix endian handling" Greg Kroah-Hartman
2018-04-27 15:43   ` Guenter Roeck
2018-04-27 16:25   ` Guenter Roeck
2018-04-28  5:50     ` Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 42/80] s390: introduce CPU alternatives Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 43/80] s390: enable CPU alternatives unconditionally Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 44/80] KVM: s390: wire up bpb feature Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 45/80] s390: scrub registers on kernel entry and KVM exit Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 46/80] s390: add optimized array_index_mask_nospec Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 47/80] s390/alternative: use a copy of the facility bit mask Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 48/80] s390: add options to change branch prediction behaviour for the kernel Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 49/80] s390: run user space and KVM guests with modified branch prediction Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 50/80] s390: introduce execute-trampolines for branches Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 51/80] KVM: s390: force bp isolation for VSIE Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 52/80] s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 53/80] s390: do not bypass BPENTER for interrupt system calls Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 54/80] s390/entry.S: fix spurious zeroing of r0 Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 55/80] s390: move nobp parameter functions to nospec-branch.c Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 56/80] s390: add automatic detection of the spectre defense Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 57/80] s390: report spectre mitigation via syslog Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 58/80] s390: add sysfs attributes for spectre Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 59/80] s390: correct nospec auto detection init order Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 60/80] s390: correct module section names for expoline code revert Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 61/80] microblaze: Setup dependencies for ASM optimized lib functions Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 62/80] arm64: dts: rockchip: remove vdd_log from rk3399-puma Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 63/80] Revert "mm/hmm: fix header file if/else/endif maze" Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 64/80] commoncap: Handle memory allocation failure Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 65/80] scsi: mptsas: Disable WRITE SAME Greg Kroah-Hartman
2018-04-27 13:58 ` [PATCH 4.14 66/80] cdrom: information leak in cdrom_ioctl_media_changed() Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 67/80] fsnotify: Fix fsnotify_mark_connector race Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 68/80] m68k/mac: Dont remap SWIM MMIO region Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 69/80] block/swim: Check drive type Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 70/80] block/swim: Dont log an error message for an invalid ioctl Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 71/80] block/swim: Remove extra put_disk() call from error path Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 72/80] block/swim: Rename macros to avoid inconsistent inverted logic Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 73/80] block/swim: Select appropriate drive on device open Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 74/80] block/swim: Fix array bounds check Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 75/80] block/swim: Fix IO error at end of medium Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 76/80] tracing: Fix missing tab for hwlat_detector print format Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 77/80] s390/cio: update chpid descriptor after resource accessibility event Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 78/80] s390/dasd: fix IO error for newly defined devices Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 79/80] s390/uprobes: implement arch_uretprobe_is_alive() Greg Kroah-Hartman
2018-04-27 13:59 ` [PATCH 4.14 80/80] ACPI / video: Only default only_lcd to true on Win8-ready _desktops_ Greg Kroah-Hartman
2018-04-27 18:14 ` [PATCH 4.14 00/80] 4.14.38-stable review Shuah Khan
2018-04-27 19:24 ` kernelci.org bot
2018-04-27 19:33 ` Nathan Chancellor
2018-04-28  5:06   ` Greg Kroah-Hartman
2018-04-27 20:37 ` Dan Rue
2018-04-28 14:28 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180427135733.887299401@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH 4.14 19/80] team: avoid adding twice the same option to the event list' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).