Dmitry Safonov 09901e570c netlink: Don't shift on 64 for ngroups ...

commit 91874ecf32 upstream.

It's legal to have 64 groups for netlink_sock.

As user-supplied nladdr->nl_groups is __u32, it's possible to subscribe
only to first 32 groups.

The check for correctness of .bind() userspace supplied parameter
is done by applying mask made from ngroups shift. Which broke Android
as they have 64 groups and the shift for mask resulted in an overflow.

Fixes: 61f4b23769 ("netlink: Don't shift with UB on nlk->ngroups")
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org
Reported-and-Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-08-09 12:16:38 +02:00

..

6lowpan

…

9p

…

802

…

8021q

net: fix use-after-free in GRO with ESP

2018-07-22 14:28:44 +02:00

appletalk

…

atm

atm: Preserve value of skb->truesize when accounting to vcc

2018-07-22 14:28:43 +02:00

ax25

…

batman-adv

batman-adv: fix packet loss for broadcasted DHCP packets to a server

2018-05-30 07:52:19 +02:00

bluetooth

Bluetooth: Fix connection if directed advertising and privacy is used

2018-04-19 08:56:19 +02:00

bpf

…

bridge

netfilter: ebtables: reject non-bridge targets

2018-07-22 14:28:49 +02:00

caif

…

can

…

ceph

libceph, ceph: avoid memory leak when specifying same option several times

2018-05-30 07:52:04 +02:00

core

rtnetlink: add rtnl_link_state check in rtnl_configure_link

2018-07-28 07:55:42 +02:00

dcb

…

dccp

net: dccp: switch rx_tstamp_last_feedback to monotonic clock

2018-07-22 14:28:44 +02:00

decnet

…

dns_resolver

KEYS: DNS: fix parsing multiple options

2018-07-22 14:28:49 +02:00

dsa

net: dsa: Do not suspend/resume closed slave_dev

2018-08-06 16:20:48 +02:00

ethernet

…

hsr

…

ieee802154

ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()

2018-03-31 18:10:40 +02:00

ife

net: sched: ife: check on metadata length

2018-04-29 11:33:13 +02:00

ipv4

ipv4: frags: handle possible skb truesize change

2018-08-06 16:20:47 +02:00

ipv6

multicast: do not restore deleted record source filter mode to new one

2018-07-28 07:55:42 +02:00

ipx

…

iucv

net/iucv: Free memory obtained by kzalloc

2018-03-31 18:10:41 +02:00

kcm

kcm: Fix use-after-free caused by clonned sockets

2018-06-11 22:49:19 +02:00

key

af_key: Always verify length of provided sadb_key

2018-06-16 09:45:14 +02:00

l2tp

l2tp: revert "l2tp: fix missing print session offset info"

2018-05-19 10:20:27 +02:00

l3mdev

…

lapb

…

llc

llc: properly handle dev_queue_xmit() return value

2018-05-30 07:52:20 +02:00

mac80211

mac80211: use timeout from the AddBA response instead of the request

2018-06-21 04:02:55 +09:00

mac802154

…

mpls

…

ncsi

…

netfilter

netfilter: nf_tables: check msg_type before nft_trans_set(trans)

2018-08-03 07:50:25 +02:00

netlabel

netlabel: If PF_INET6, check sk_buff ip header version

2018-05-30 07:52:40 +02:00

netlink

netlink: Don't shift on 64 for ngroups

2018-08-09 12:16:38 +02:00

netrom

…

nfc

net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL.

2018-07-22 14:28:49 +02:00

nsh

nsh: set mac len based on inner packet

2018-07-22 14:28:49 +02:00

openvswitch

openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found

2018-05-19 10:20:24 +02:00

packet

net/packet: fix use-after-free

2018-07-22 14:28:46 +02:00

phonet

…

psample

…

qrtr

qrtr: add MODULE_ALIAS macro to smd

2018-05-30 07:52:05 +02:00

rds

rds: avoid unenecessary cong_update in loop transport

2018-07-22 14:28:49 +02:00

rfkill

rfkill: gpio: fix memory leak in probe error path

2018-05-16 10:10:26 +02:00

rose

…

rxrpc

rxrpc: Fix user call ID check in rxrpc_service_prealloc_one

2018-08-06 16:20:48 +02:00

sched

net_sched: blackhole: tell upper qdisc about dropped packets

2018-07-22 14:28:46 +02:00

sctp

sctp: not allow transport timeout value less than HZ/5 for hb_timer

2018-06-11 22:49:20 +02:00

smc

smc: fix sendpage() call

2018-06-21 04:02:53 +09:00

strparser

strparser: Remove early eaten to fix full tcp receive buffer stall

2018-07-22 14:28:47 +02:00

sunrpc

xprtrdma: Fix corner cases when handling device removal

2018-07-22 14:28:42 +02:00

switchdev

…

tipc

tipc: eliminate KMSAN uninit-value in strcmp complaint

2018-06-21 04:02:56 +09:00

tls

sock: fix sg page frag coalescing in sk_alloc_sg

2018-07-28 07:55:42 +02:00

unix

…

vmw_vsock

VSOCK: fix loopback on big-endian systems

2018-07-22 14:28:47 +02:00

wimax

…

wireless

cfg80211: clear wep keys after disconnection

2018-05-30 07:51:58 +02:00

x25

…

xfrm

xfrm: Fix transport mode skb control buffer usage.

2018-05-30 07:52:19 +02:00

compat.c

net: support compat 64-bit time in {s,g}etsockopt

2018-05-19 10:20:24 +02:00

Kconfig

…

Makefile

…

socket.c

net: socket: fix potential spectre v1 gadget in socketcall

2018-08-06 16:20:48 +02:00

sysctl_net.c

…