netlink_realloc_groups() sizes nlk->groups to the number of groups that exist at bind/ADD_MEMBERSHIP time. When more multicast groups are registered later (e.g. a new genl family), existing sockets keep their smaller bitmap. When clearing a multicast group of a departing family, __netlink_clear_multicast_users() runs netlink_update_socket_mc() on each socket on mc_list, which does test_bit()/__assign_bit() on group - 1 with no regard to nlk->ngroups. Skip groups that lie beyond the socket's bitmap: such a socket could never have joined them. This is the same guard do_one_broadcast() already applies. With in-tree families the overflow is only reachable on 32-bit kernels: the ~54 dynamically allocated genl groups fit the initial 64-bit bitmap on 64-bit kernels but exceed the 32-bit one, so the table can grow there, and a later module unload then touches bits past the bitmap of stale sockets. This issue was discovered by Tencent CodeBuddy Security. Fixes: 84659eb529b3 ("[NETLIKN]: Allow removing multicast groups.") Signed-off-by: Henry Martin --- v2: Correct the Fixes tag (the clear path was added by 84659eb529b3, not by the dynamic bitmap commit), drop Cc: stable and describe the actual reachability (32-bit kernels with in-tree families) instead of implying generic heap corruption. net/netlink/af_netlink.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 9fdf964224ab4..8cc655aa927f1 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -1657,6 +1657,12 @@ static void netlink_update_socket_mc(struct netlink_sock *nlk, { int old, new = !!is_new, subscriptions; + /* A socket whose bitmap predates this group can never be a member; + * don't touch bits beyond its allocation. + */ + if (group - 1 >= nlk->ngroups) + return; + old = test_bit(group - 1, nlk->groups); subscriptions = nlk->subscriptions - old + new; __assign_bit(group - 1, nlk->groups, new); -- 2.43.7