| From foo@baz Fri Jan 4 20:01:52 CET 2019 |
| From: Cong Wang <xiyou.wangcong@gmail.com> |
| Date: Mon, 10 Dec 2018 15:23:30 -0800 |
| Subject: tipc: compare remote and local protocols in tipc_udp_enable() |
| |
| From: Cong Wang <xiyou.wangcong@gmail.com> |
| |
| [ Upstream commit fb83ed496b9a654f60cd1d58a0e1e79ec5694808 ] |
| |
| When TIPC_NLA_UDP_REMOTE is an IPv6 mcast address but |
| TIPC_NLA_UDP_LOCAL is an IPv4 address, a NULL-ptr deref is triggered |
| as the UDP tunnel sock is initialized to IPv4 or IPv6 sock merely |
| based on the protocol in local address. |
| |
| We should just error out when the remote address and local address |
| have different protocols. |
| |
| Reported-by: syzbot+eb4da3a20fad2e52555d@syzkaller.appspotmail.com |
| Cc: Ying Xue <ying.xue@windriver.com> |
| Cc: Jon Maloy <jon.maloy@ericsson.com> |
| Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> |
| Acked-by: Jon Maloy <jon.maloy@ericsson.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/tipc/udp_media.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| --- a/net/tipc/udp_media.c |
| +++ b/net/tipc/udp_media.c |
| @@ -674,6 +674,11 @@ static int tipc_udp_enable(struct net *n |
| if (err) |
| goto err; |
| |
| + if (remote.proto != local.proto) { |
| + err = -EINVAL; |
| + goto err; |
| + } |
| + |
| b->bcast_addr.media_id = TIPC_MEDIA_TYPE_UDP; |
| b->bcast_addr.broadcast = 1; |
| rcu_assign_pointer(b->media_ptr, ub); |