Subject: CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()

syzbot reported the following general protection fault [1]:

general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]
...
RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291
...
Call Trace:
 <TASK>
 tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646
 tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089
 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972
 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]
 genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
 netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367
 netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0xd5/0x180 net/socket.c:745
 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

The cause of this issue is that when tipc_nl_bearer_add() is called with
the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called
even if the bearer is not UDP.

tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that
the media_ptr field of the tipc_bearer has an udp_bearer type object, so
the function goes crazy for non-UDP bearers.

This patch fixes the issue by checking the bearer type before calling
tipc_udp_nl_bearer_add() in tipc_nl_bearer_add().

The Linux kernel CVE team has assigned CVE-2024-26663 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 4.9 with commit ef20cd4dd163 and fixed in 4.19.307 with commit 24ec8f0da93b
	Issue introduced in 4.9 with commit ef20cd4dd163 and fixed in 5.4.269 with commit 6f70f0b41245
	Issue introduced in 4.9 with commit ef20cd4dd163 and fixed in 5.10.210 with commit 19d7314f2fb9
	Issue introduced in 4.9 with commit ef20cd4dd163 and fixed in 5.15.149 with commit c1701ea85ef0
	Issue introduced in 4.9 with commit ef20cd4dd163 and fixed in 6.1.78 with commit 3d3a5b31b435
	Issue introduced in 4.9 with commit ef20cd4dd163 and fixed in 6.6.17 with commit 888e3524be87
	Issue introduced in 4.9 with commit ef20cd4dd163 and fixed in 6.7.5 with commit 0cd331dfd602
	Issue introduced in 4.9 with commit ef20cd4dd163 and fixed in 6.8 with commit 3871aa01e1a7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26663
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	net/tipc/bearer.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/24ec8f0da93b8a9fba11600be8a90f0d73fb46f1
	https://git.kernel.org/stable/c/6f70f0b412458c622a12d4292782c8e92e210c2f
	https://git.kernel.org/stable/c/19d7314f2fb9515bdaac9829d4d8eb34edd1fe95
	https://git.kernel.org/stable/c/c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12
	https://git.kernel.org/stable/c/3d3a5b31b43515b5752ff282702ca546ec3e48b6
	https://git.kernel.org/stable/c/888e3524be87f3df9fa3c083484e4b62b3e3bb59
	https://git.kernel.org/stable/c/0cd331dfd6023640c9669d0592bc0fd491205f87
	https://git.kernel.org/stable/c/3871aa01e1a779d866fa9dfdd5a836f342f4eb87