Fix two validation flaws in `net/tipc/netlink_compat.c`: 1. `tipc_nl_compat_net_set()` (`TIPC_CMD_SET_NETID` / `TIPC_CMD_SET_NODE_ADDR`) unconditionally dereferences `*(__be32 *)TLV_DATA(msg->req)` without verifying that `TLV_GET_DATA_LEN(msg->req) >= sizeof(__be32)` (4 bytes), reading 4 bytes past the end of a 0-byte TLV payload (`tlv_len == 4`). 2. In `tipc_nl_compat_name_table_dump_header()` and `tipc_nl_compat_name_table_dump()`, `ntq->depth` can contain the high flag bit `TIPC_NTQ_ALLTYPES` (`0x80000000`). `tipc_nl_compat_name_table_dump_header()` compares `depth > 4` without masking off `TIPC_NTQ_ALLTYPES` first (always clamping `depth` to 4 whenever `TIPC_NTQ_ALLTYPES` is set, even if the low depth bits are `1`), and `tipc_nl_compat_name_table_dump()` checks `depth > 1` and `depth > 2` with `TIPC_NTQ_ALLTYPES` still set in `depth`. Mask off `TIPC_NTQ_ALLTYPES` after testing it. Fixes: d7cc75d3cb6b ("tipc: convert legacy nl node addr set to nl compat") Fixes: 44a8ae94fd55 ("tipc: convert legacy nl name table dump to nl compat") Assisted-by: LLM Signed-off-by: Hui Peng --- net/tipc/netlink_compat.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index d9a4f94ea2d4..9b2d93704e23 100644 --- a/net/tipc/netlink_compat.c +++ b/net/tipc/netlink_compat.c @@ -881,7 +881,7 @@ static int tipc_nl_compat_name_table_dump_header(struct tipc_nl_compat_msg *msg) if (TLV_GET_DATA_LEN(msg->req) < (int)sizeof(struct tipc_name_table_query)) return -EINVAL; - depth = ntohl(ntq->depth); + depth = ntohl(ntq->depth) & ~TIPC_NTQ_ALLTYPES; if (depth > 4) depth = 4; @@ -932,6 +932,7 @@ static int tipc_nl_compat_name_table_dump(struct tipc_nl_compat_msg *msg, if (!(depth & TIPC_NTQ_ALLTYPES) && (type != nla_get_u32(publ[TIPC_NLA_PUBL_TYPE]))) return 0; + depth &= ~TIPC_NTQ_ALLTYPES; if (lowbound && (lowbound > nla_get_u32(publ[TIPC_NLA_PUBL_UPPER]))) return 0; if (upbound && (upbound < nla_get_u32(publ[TIPC_NLA_PUBL_LOWER]))) @@ -1139,6 +1140,9 @@ static int tipc_nl_compat_net_set(struct tipc_nl_compat_cmd_doit *cmd, u32 val; struct nlattr *net; + if (TLV_GET_DATA_LEN(msg->req) < (int)sizeof(__be32)) + return -EINVAL; + val = ntohl(*(__be32 *)TLV_DATA(msg->req)); net = nla_nest_start_noflag(skb, TIPC_NLA_NET); -- 2.55.0.1082.g2b9226bbc0-goog