Re: [PATCH 4.4 106/124] netlink: Do not subscribe to non-existent groups

[Greg Kroah-Hartman]

On Sat, Aug 04, 2018 at 11:07:34AM -0700, Nathan Chancellor wrote:
> On Sat, Aug 04, 2018 at 11:01:35AM +0200, Greg Kroah-Hartman wrote:
> > 4.4-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Dmitry Safonov <dima@xxxxxxxxxx>
> > 
> > [ Upstream commit 7acf9d4237c46894e0fa0492dd96314a41742e84 ]
> > 
> > Make ABI more strict about subscribing to group > ngroups.
> > Code doesn't check for that and it looks bogus.
> > (one can subscribe to non-existing group)
> > Still, it's possible to bind() to all possible groups with (-1)
> > 
> > Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
> > Cc: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
> > Cc: Steffen Klassert <steffen.klassert@xxxxxxxxxxx>
> > Cc: netdev@xxxxxxxxxxxxxxx
> > Signed-off-by: Dmitry Safonov <dima@xxxxxxxxxx>
> > Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> > ---
> >  net/netlink/af_netlink.c |    1 +
> >  1 file changed, 1 insertion(+)
> > 
> > --- a/net/netlink/af_netlink.c
> > +++ b/net/netlink/af_netlink.c
> > @@ -983,6 +983,7 @@ static int netlink_bind(struct socket *s
> >  		if (err)
> >  			return err;
> >  	}
> > +	groups &= (1UL << nlk->ngroups) - 1;
> >  
> >  	bound = nlk->bound;
> >  	if (bound) {
> > 
> > 
> 
> Hi Greg,
> 
> I am so sorry I didn't catch this in my initial report but this commit
> along with ba7aaf93ef2f ("netlink: Don't shift with UB on nlk->ngroups")
> breaks mobile data on both the Pixel 2 XL and OnePlus 6. There is signal
> but it just never connects to 3G/LTE. Reverting those two commits fixes
> the issue.
> 
> Nothing stands out to me in dmesg unfortunately and iven neither device
> is running a vanilla kernel, I cannot say if this is a problem in mainline
> or not but I just wanted to make you aware of it.

Many thanks for catching this.  I'll go drop this patch from the trees
for now, and will queue it up later with the fixup patch when that lands
in Linus's tree.

thanks,

greg k-h