[PATCH net 2/2] tipc: fix possible crash in __tipc_nl_net_set()

[Eric Dumazet]

syzbot reported a crash in __tipc_nl_net_set() caused by NULL dereference.

We need to check that both TIPC_NLA_NET_NODEID and TIPC_NLA_NET_NODEID_W1
are present.

We also need to make sure userland provided u64 attributes.

Fixes: d50ccc2d3909 ("tipc: add 128-bit node identifier")
Signed-off-by: Eric Dumazet 
Cc: Jon Maloy 
Cc: Ying Xue 
Reported-by: syzbot 
---
 net/tipc/net.c | 2 ++
 net/tipc/netlink.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/net/tipc/net.c b/net/tipc/net.c
index 
856f9e97ea293210bea1d2003d2092482732ace9..4fbaa0464405370601cb2fd1dd3b03733836d342
 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -252,6 +252,8 @@ int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info 
*info)
u64 *w0 = (u64 *)&node_id[0];
u64 *w1 = (u64 *)&node_id[8];
 
+   if (!attrs[TIPC_NLA_NET_NODEID_W1])
+   return -EINVAL;
*w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]);
*w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]);
tipc_net_init(net, node_id, 0);
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 
d4e0bbeee72793a060befaf8a9d0239731c0d48c..6ff2254088f647d4f7410c3335ccdae2e68ec522
 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -81,6 +81,8 @@ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 
1] = {
[TIPC_NLA_NET_UNSPEC]   = { .type = NLA_UNSPEC },
[TIPC_NLA_NET_ID]   = { .type = NLA_U32 },
[TIPC_NLA_NET_ADDR] = { .type = NLA_U32 },
+   [TIPC_NLA_NET_NODEID]   = { .type = NLA_U64 },
+   [TIPC_NLA_NET_NODEID_W1]= { .type = NLA_U64 },
 };
 
 const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
-- 
2.17.0.484.g0c8726318c-goog

Re: [PATCH net 2/2] tipc: fix possible crash in __tipc_nl_net_set()

[Ying Xue]

On 04/16/2018 11:29 PM, Eric Dumazet wrote:
> syzbot reported a crash in __tipc_nl_net_set() caused by NULL dereference.
> 
> We need to check that both TIPC_NLA_NET_NODEID and TIPC_NLA_NET_NODEID_W1
> are present.
> 
> We also need to make sure userland provided u64 attributes.
> 
> Fixes: d50ccc2d3909 ("tipc: add 128-bit node identifier")
> Signed-off-by: Eric Dumazet 
> Cc: Jon Maloy 
> Cc: Ying Xue 
> Reported-by: syzbot 

Acked-by: Ying Xue 

> ---
>  net/tipc/net.c | 2 ++
>  net/tipc/netlink.c | 2 ++
>  2 files changed, 4 insertions(+)
> 
> diff --git a/net/tipc/net.c b/net/tipc/net.c
> index 
> 856f9e97ea293210bea1d2003d2092482732ace9..4fbaa0464405370601cb2fd1dd3b03733836d342
>  100644
> --- a/net/tipc/net.c
> +++ b/net/tipc/net.c
> @@ -252,6 +252,8 @@ int __tipc_nl_net_set(struct sk_buff *skb, struct 
> genl_info *info)
>   u64 *w0 = (u64 *)&node_id[0];
>   u64 *w1 = (u64 *)&node_id[8];
>  
> + if (!attrs[TIPC_NLA_NET_NODEID_W1])
> + return -EINVAL;
>   *w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]);
>   *w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]);
>   tipc_net_init(net, node_id, 0);
> diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
> index 
> d4e0bbeee72793a060befaf8a9d0239731c0d48c..6ff2254088f647d4f7410c3335ccdae2e68ec522
>  100644
> --- a/net/tipc/netlink.c
> +++ b/net/tipc/netlink.c
> @@ -81,6 +81,8 @@ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX 
> + 1] = {
>   [TIPC_NLA_NET_UNSPEC]   = { .type = NLA_UNSPEC },
>   [TIPC_NLA_NET_ID]   = { .type = NLA_U32 },
>   [TIPC_NLA_NET_ADDR] = { .type = NLA_U32 },
> + [TIPC_NLA_NET_NODEID]   = { .type = NLA_U64 },
> + [TIPC_NLA_NET_NODEID_W1]= { .type = NLA_U64 },
>  };
>  
>  const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
>