tree 5021b8b0612eebdc7918757d82a7b870cbf89968
parent 9804a24b7ac34a1ce3cbb9914940853a59997055
author Thadeu Lima de Souza Cascardo <cascardo@igalia.com> 1714656006 -0300
committer Vegard Nossum <vegard.nossum@oracle.com> 1717418851 +0000

net: fix out-of-bounds access in ops_init

commit a26ff37e624d12e28077e5b24d2b264f62764ad6 upstream.

net_alloc_generic is called by net_alloc, which is called without any
locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It
is read twice, first to allocate an array, then to set s.len, which is
later used to limit the bounds of the array access.

It is possible that the array is allocated and another thread is
registering a new pernet ops, increments max_gen_ptrs, which is then used
to set s.len with a larger than allocated length for the variable array.

Fix it by reading max_gen_ptrs only once in net_alloc_generic. If
max_gen_ptrs is later incremented, it will be caught in net_assign_generic.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Fixes: 073862ba5d24 ("netns: fix net_alloc_generic()")
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240502132006.3430840-1-cascardo@igalia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 3cdc34d76c4f777579e28ad373979d36c030cfd3)
[Vegard: drop *ops->id assignment due to missing commit 6e77cc471090
 ("Convert net_namespace to new IDA API").]
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>