> -----Original Message-----
> From: Cong Wang <xiyou.wangc...@gmail.com>
> Sent: 10-Dec-18 18:24
> To: netdev@vger.kernel.org
> Cc: Cong Wang <xiyou.wangc...@gmail.com>; Ying Xue
> <ying....@windriver.com>; Jon Maloy <jon.ma...@ericsson.com>
> Subject: [Patch net] tipc: compare remote and local protocols in
> tipc_udp_enable()
>
> When TIPC_NLA_UDP_REMOTE is an IPv6 mcast address but
> TIPC_NLA_UDP_LOCAL is an IPv4 address, a NULL-ptr deref is triggered as
> the UDP tunnel sock is initialized to IPv4 or IPv6 sock merely based on the
> protocol in local address.
>
> We should just error out when the remote address and local address have
> different protocols.
Acked-by: Jon Maloy <jon.ma...@ericsson.com>
Thank you for your help, Cong.
>
> Reported-by: syzbot+eb4da3a20fad2e525...@syzkaller.appspotmail.com
> Cc: Ying Xue <ying....@windriver.com>
> Cc: Jon Maloy <jon.ma...@ericsson.com>
> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
> ---
> net/tipc/udp_media.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index
> 1b1ba1310ea7..4d85d71f16e2 100644
> --- a/net/tipc/udp_media.c
> +++ b/net/tipc/udp_media.c
> @@ -679,6 +679,11 @@ static int tipc_udp_enable(struct net *net, struct
> tipc_bearer *b,
> if (err)
> goto err;
>
> + if (remote.proto != local.proto) {
> + err = -EINVAL;
> + goto err;
> + }
> +
> /* Checking remote ip address */
> rmcast = tipc_udp_is_mcast_addr(&remote);
>
> --
> 2.19.2
