From 9210f3efe7833b82abbef8478085e7cc1c97670c Mon Sep 17 00:00:00 2001 From: Tetsuo Handa Date: Thu, 16 May 2019 16:43:43 +0000 Subject: [PATCH] net: netlink: Check address length before reading groups field mainline inclusion from mainline-5.1-rc6 commit d852be84770c category: bugfix bugzilla: 14091 CVE: NA ------------------------------------------------- KMSAN will complain if valid address length passed to bind() is shorter than sizeof(struct sockaddr_nl) bytes. Signed-off-by: Tetsuo Handa Signed-off-by: David S. Miller Signed-off-by: Zhiqiang Liu Reviewed-by: Wenan Mao Signed-off-by: Yang Yingliang --- net/netlink/af_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index b4a29bcc33b9..0ae6627aba39 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -993,7 +993,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, struct netlink_sock *nlk = nlk_sk(sk); struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; int err = 0; - unsigned long groups = nladdr->nl_groups; + unsigned long groups; bool bound; if (addr_len < sizeof(struct sockaddr_nl)) @@ -1001,6 +1001,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, if (nladdr->nl_family != AF_NETLINK) return -EINVAL; + groups = nladdr->nl_groups; /* Only superuser is allowed to listen multicasts */ if (groups) { -- GitLab