From 6430fb7f1cc4e329e386521b7b208df443de92f2 Mon Sep 17 00:00:00 2001 From: Henry Martin Date: Mon, 26 Oct 2026 11:09:28 +0800 Subject: [PATCH] netlink: fix out-of-bounds bitmap access clearing stale mc groups netlink_realloc_groups() sizes nlk->groups to the number of groups that exist at bind/ADD_MEMBERSHIP time. When more multicast groups are registered later (e.g. a new genl family), existing sockets keep their smaller bitmap. When clearing a multicast group of a departing family, __netlink_clear_multicast_users() runs netlink_update_socket_mc() on each socket on mc_list, which does test_bit()/__assign_bit() on group - 1 with no regard to nlk->ngroups. Skip sockets whose bitmap predates the group: such a socket can never have joined it. The overflow windows differ per architecture, both needing privileged module (un)loading. On 32-bit kernels the ~54 dynamically allocated genl groups already exceed the initial 32-bit bitmap, so the table can grow there directly. On 64-bit kernels the same in-tree set fits the initial 64-bit bitmap only while allocation stays contiguous: genl_allocate_reserve_groups() takes the first free contiguous range and unregister does not compact, so an unload/reload sequence can fragment the ~59 free IDs until no fitting range remains, forcing the table past 64 bits and reaching the same stale-bitmap overflow on the next family teardown. This issue was discovered by Tencent CodeBuddy Security. Fixes: 84659eb529b3 ("[NETLIKN]: Allow removing multicast groups.") Signed-off-by: Henry Martin Signed-off-by: Dave Miller --- net/netlink/af_netlink.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index a904dc3bcad6..fec2879c497d 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -2157,8 +2157,12 @@ void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group) struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; struct hlist_node *tmp; - sk_for_each_bound_safe(sk, tmp, &tbl->mc_list) + sk_for_each_bound_safe(sk, tmp, &tbl->mc_list) { + /* bitmap predates the group, can't be a member */ + if (group - 1 >= nlk_sk(sk)->ngroups) + continue; netlink_update_socket_mc(nlk_sk(sk), group, 0); + } } struct nlmsghdr *