Nikolay Aleksandrov 5306d0c419 net: netlink: cap max groups which will be considered in netlink_bind() ... commit 3a20773bee upstream. Since nl_groups is a u32 we can't bind more groups via ->bind (netlink_bind) call, but netlink has supported more groups via setsockopt() for a long time and thus nlk->ngroups could be over 32. Recently I added support for per-vlan notifications and increased the groups to 33 for NETLINK_ROUTE which exposed an old bug in the netlink_bind() code causing out-of-bounds access on archs where unsigned long is 32 bits via test_bit() on a local variable. Fix this by capping the maximum groups in netlink_bind() to BITS_PER_TYPE(u32), effectively capping them at 32 which is the minimum of allocated groups and the maximum groups which can be bound via netlink_bind(). CC: Christophe Leroy <christophe.leroy@c-s.fr> CC: Richard Guy Briggs <rgb@redhat.com> Fixes: 4f52090052 ("netlink: have netlink per-protocol bind function return an error code.") Reported-by: Erhard F. <erhard_f@mailbox.org> Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-03-05 16:43:46 +01:00
..
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
af_netlink.c	net: netlink: cap max groups which will be considered in netlink_bind()	2020-03-05 16:43:46 +01:00
af_netlink.h	netlink: Add new socket option to enable strict checking on dumps	2018-10-08 10:39:04 -07:00
diag.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
genetlink.c	genetlink: do not validate dump requests if there is no policy	2019-05-04 01:27:10 -04:00