• Eric Biggers's avatar
    net/smc: check for missing nlattrs in SMC_PNETID messages · d49baa7e
    Eric Biggers authored
    It's possible to crash the kernel in several different ways by sending
    messages to the SMC_PNETID generic netlink family that are missing the
    expected attributes:
    
    - Missing SMC_PNETID_NAME => null pointer dereference when comparing
      names.
    - Missing SMC_PNETID_ETHNAME => null pointer dereference accessing
      smc_pnetentry::ndev.
    - Missing SMC_PNETID_IBNAME => null pointer dereference accessing
      smc_pnetentry::smcibdev.
    - Missing SMC_PNETID_IBPORT => out of bounds array access to
      smc_ib_device::pattr[-1].
    
    Fix it by validating that all expected attributes are present and that
    SMC_PNETID_IBPORT is nonzero.
    
    Reported-by: syzbot+5cd61039dc9b8bfa6e47@syzkaller.appspotmail.com
    Fixes: 6812baab ("smc: establish pnet table management")
    Cc: <stable@vger.kernel.org> # v4.11+
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d49baa7e
smc_pnet.c 12.7 KB