Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Minjoong Kim 0ef6e49881 atm: Fix NULL pointer dereference ... commit bf2986fcf8 upstream. When MPOA_cache_impos_rcvd() receives the msg, it can trigger Null Pointer Dereference Vulnerability if both entry and holding_time are NULL. Because there is only for the situation where entry is NULL and holding_time exists, it can be passed when both entry and holding_time are NULL. If these are NULL, the entry will be passd to eg_cache_put() as parameter and it is referenced by entry->use code in it. kasan log: [ 3.316691] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006:I [ 3.317568] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 3.318188] CPU: 3 UID: 0 PID: 79 Comm: ex Not tainted 6.14.0-rc2 #102 [ 3.318601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 3.319298] RIP: 0010:eg_cache_remove_entry+0xa5/0x470 [ 3.319677] Code: c1 f7 6e fd 48 c7 c7 00 7e 38 b2 e8 95 64 54 fd 48 c7 c7 40 7e 38 b2 48 89 ee e80 [ 3.321220] RSP: 0018:ffff88800583f8a8 EFLAGS: 00010006 [ 3.321596] RAX: 0000000000000006 RBX: ffff888005989000 RCX: ffffffffaecc2d8e [ 3.322112] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000030 [ 3.322643] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6558b88 [ 3.323181] R10: 0000000000000003 R11: 203a207972746e65 R12: 1ffff11000b07f15 [ 3.323707] R13: dffffc0000000000 R14: ffff888005989000 R15: ffff888005989068 [ 3.324185] FS: 000000001b6313c0(0000) GS:ffff88806d380000(0000) knlGS:0000000000000000 [ 3.325042] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.325545] CR2: 00000000004b4b40 CR3: 000000000248e000 CR4: 00000000000006f0 [ 3.326430] Call Trace: [ 3.326725] <TASK> [ 3.326927] ? die_addr+0x3c/0xa0 [ 3.327330] ? exc_general_protection+0x161/0x2a0 [ 3.327662] ? asm_exc_general_protection+0x26/0x30 [ 3.328214] ? vprintk_emit+0x15e/0x420 [ 3.328543] ? eg_cache_remove_entry+0xa5/0x470 [ 3.328910] ? eg_cache_remove_entry+0x9a/0x470 [ 3.329294] ? __pfx_eg_cache_remove_entry+0x10/0x10 [ 3.329664] ? console_unlock+0x107/0x1d0 [ 3.329946] ? __pfx_console_unlock+0x10/0x10 [ 3.330283] ? do_syscall_64+0xa6/0x1a0 [ 3.330584] ? entry_SYSCALL_64_after_hwframe+0x47/0x7f [ 3.331090] ? __pfx_prb_read_valid+0x10/0x10 [ 3.331395] ? down_trylock+0x52/0x80 [ 3.331703] ? vprintk_emit+0x15e/0x420 [ 3.331986] ? __pfx_vprintk_emit+0x10/0x10 [ 3.332279] ? down_trylock+0x52/0x80 [ 3.332527] ? _printk+0xbf/0x100 [ 3.332762] ? __pfx__printk+0x10/0x10 [ 3.333007] ? _raw_write_lock_irq+0x81/0xe0 [ 3.333284] ? __pfx__raw_write_lock_irq+0x10/0x10 [ 3.333614] msg_from_mpoad+0x1185/0x2750 [ 3.333893] ? __build_skb_around+0x27b/0x3a0 [ 3.334183] ? __pfx_msg_from_mpoad+0x10/0x10 [ 3.334501] ? __alloc_skb+0x1c0/0x310 [ 3.334809] ? __pfx___alloc_skb+0x10/0x10 [ 3.335283] ? _raw_spin_lock+0xe0/0xe0 [ 3.335632] ? finish_wait+0x8d/0x1e0 [ 3.335975] vcc_sendmsg+0x684/0xba0 [ 3.336250] ? __pfx_vcc_sendmsg+0x10/0x10 [ 3.336587] ? __pfx_autoremove_wake_function+0x10/0x10 [ 3.337056] ? fdget+0x176/0x3e0 [ 3.337348] __sys_sendto+0x4a2/0x510 [ 3.337663] ? __pfx___sys_sendto+0x10/0x10 [ 3.337969] ? ioctl_has_perm.constprop.0.isra.0+0x284/0x400 [ 3.338364] ? sock_ioctl+0x1bb/0x5a0 [ 3.338653] ? __rseq_handle_notify_resume+0x825/0xd20 [ 3.339017] ? __pfx_sock_ioctl+0x10/0x10 [ 3.339316] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 3.339727] ? selinux_file_ioctl+0xa4/0x260 [ 3.340166] __x64_sys_sendto+0xe0/0x1c0 [ 3.340526] ? syscall_exit_to_user_mode+0x123/0x140 [ 3.340898] do_syscall_64+0xa6/0x1a0 [ 3.341170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3.341533] RIP: 0033:0x44a380 [ 3.341757] Code: 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c00 [ 3.343078] RSP: 002b:00007ffc1d404098 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 3.343631] RAX: ffffffffffffffda RBX: 00007ffc1d404458 RCX: 000000000044a380 [ 3.344306] RDX: 000000000000019c RSI: 00007ffc1d4040b0 RDI: 0000000000000003 [ 3.344833] RBP: 00007ffc1d404260 R08: 0000000000000000 R09: 0000000000000000 [ 3.345381] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3.346015] R13: 00007ffc1d404448 R14: 00000000004c17d0 R15: 0000000000000001 [ 3.346503] </TASK> [ 3.346679] Modules linked in: [ 3.346956] ---[ end trace 0000000000000000 ]--- [ 3.347315] RIP: 0010:eg_cache_remove_entry+0xa5/0x470 [ 3.347737] Code: c1 f7 6e fd 48 c7 c7 00 7e 38 b2 e8 95 64 54 fd 48 c7 c7 40 7e 38 b2 48 89 ee e80 [ 3.349157] RSP: 0018:ffff88800583f8a8 EFLAGS: 00010006 [ 3.349517] RAX: 0000000000000006 RBX: ffff888005989000 RCX: ffffffffaecc2d8e [ 3.350103] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000030 [ 3.350610] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6558b88 [ 3.351246] R10: 0000000000000003 R11: 203a207972746e65 R12: 1ffff11000b07f15 [ 3.351785] R13: dffffc0000000000 R14: ffff888005989000 R15: ffff888005989068 [ 3.352404] FS: 000000001b6313c0(0000) GS:ffff88806d380000(0000) knlGS:0000000000000000 [ 3.353099] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.353544] CR2: 00000000004b4b40 CR3: 000000000248e000 CR4: 00000000000006f0 [ 3.354072] note: ex[79] exited with irqs disabled [ 3.354458] note: ex[79] exited with preempt_count 1 Signed-off-by: Minjoong Kim <pwn9uin@gmail.com> Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250322105200.14981-1-pwn9uin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2025-04-07 10:05:45 +02:00
..
6lowpan	net: 6lowpan: constify lowpan_nhc structures	2022-06-09 21:53:28 +02:00
9p	9p/xen: fix release of IRQ	2024-12-14 19:54:08 +01:00
802	net: 802: LLC+SNAP OID:PID lookup on start of skb data	2025-01-17 13:34:38 +01:00
8021q	vlan: enforce underlying device type	2025-03-13 12:53:18 +01:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:00:19 +01:00
atm	atm: Fix NULL pointer dereference	2025-04-07 10:05:45 +02:00
ax25	ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt	2025-02-21 13:49:56 +01:00
batman-adv	batman-adv: Ignore own maximum aggregation size during RX	2025-03-28 21:59:01 +01:00
bluetooth	Bluetooth: Fix error code in chan_alloc_skb_cb()	2025-03-28 21:59:00 +01:00
bpf	bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()	2025-03-07 16:56:37 +01:00
bpfilter	uaccess: remove CONFIG_SET_FS	2022-02-25 09:36:06 +01:00
bridge	ipv4: Convert ip_route_input() to dscp_t.	2025-03-07 16:56:44 +01:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:50:24 +01:00
can	can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero	2025-02-21 13:50:04 +01:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-07-18 13:18:41 +02:00
core	net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES	2025-03-28 21:59:00 +01:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 12:08:17 +02:00
dccp	net: fix data-races around sk->sk_forward_alloc	2025-01-23 17:17:17 +01:00
devlink	devlink: bump the instance index directly when iterating	2024-10-22 15:56:43 +02:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:27:38 -08:00
dsa	net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events	2025-02-21 13:50:11 +01:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:29:29 +02:00
ethtool	net: avoid race between device unregistration and ethnl ops	2025-02-21 13:49:06 +01:00
hsr	net: hsr: fix fill_frame_info() regression vs VLAN packets	2025-02-21 13:49:23 +01:00
ieee802154	net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()	2024-12-14 19:54:41 +01:00
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:38:56 +00:00
ipv4	tcp: fix forever orphan socket caused by tcp_abort	2025-03-28 21:58:57 +01:00
ipv6	Revert "gre: Fix IPv6 link-local address generation."	2025-03-28 21:59:00 +01:00
iucv	s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()	2024-12-14 19:53:50 +01:00
kcm	kcm: Serialise kcm_sendmsg() for the same socket.	2024-08-29 17:30:44 +02:00
key	net: af_key: fix sadb_x_filter validation	2023-08-23 17:52:32 +02:00
l2tp	genetlink: hold RCU in genlmsg_mcast()	2024-11-01 01:56:00 +01:00
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-15 14:27:24 -07:00
lapb	net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c	2021-06-08 16:31:25 -07:00
llc	llc: do not use skb_get() before dev_queue_xmit()	2025-03-13 12:53:17 +01:00
mac80211	wifi: mac80211: prohibit deactivating all links	2025-02-21 13:49:03 +01:00
mac802154	mac802154: check local interfaces before deleting sdata list	2025-01-23 17:17:11 +01:00
mctp	net: mctp: handle skb cleanup on sock_queue failures	2025-01-09 13:29:57 +01:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:05:27 +02:00
mptcp	mptcp: Fix data stream corruption in the address announcement	2025-03-28 21:59:01 +01:00
ncsi	net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling	2025-02-21 13:49:54 +01:00
netfilter	netfilter: nft_counter: Use u64_stats_t for statistic.	2025-03-28 21:59:01 +01:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:27:20 -08:00
netlink	sock_diag: add module pointer to "struct sock_diag_handler"	2024-12-14 19:53:32 +01:00
netrom	netrom: check buffer length before accessing it	2025-01-09 13:30:01 +01:00
nfc	NFC: nci: Add bounds checking in nci_hci_create_pipe()	2025-02-21 13:49:51 +01:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:55:59 +02:00
openvswitch	net: openvswitch: remove misbehaving actions length check	2025-03-28 21:58:50 +01:00
packet	af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK	2025-01-09 13:30:02 +01:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 11:56:12 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:39:11 +01:00
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-10-17 15:21:13 +02:00
rds	net:rds: Fix possible deadlock in rds_message_put	2024-08-29 17:30:20 +02:00
rfkill	net: rfkill: gpio: Add check for clk_enable()	2024-12-14 19:53:33 +01:00
rose	net: rose: lock the socket in rose_bind()	2025-02-21 13:49:37 +01:00
rxrpc	rxrpc: Improve setsockopt() handling of malformed user input	2024-12-14 19:53:52 +01:00
sched	net_sched: Prevent creation of classes with TC_H_ROOT	2025-03-28 21:58:49 +01:00
sctp	sctp: Fix undefined behavior in left shift operation	2025-03-28 21:58:52 +01:00
smc	net/smc: fix data error when recvmsg with MSG_PEEK flag	2025-02-21 13:49:03 +01:00
strparser	strparser: Add read_sock callback	2025-03-07 16:56:37 +01:00
sunrpc	sunrpc: suppress warnings for unused procfs functions	2025-03-07 16:56:42 +01:00
switchdev	net: switchdev: Convert blocking notification chain to a raw one	2025-03-28 21:58:49 +01:00
tipc	tipc: re-order conditions in tipc_crypto_key_rcv()	2025-02-21 13:49:33 +01:00
tls	tls: Fix tls_sw_sendmsg error handling	2025-01-17 13:34:39 +01:00
unix	sock_diag: add module pointer to "struct sock_diag_handler"	2024-12-14 19:53:32 +01:00
vmw_vsock	vsock: Orphan socket after transport release	2025-03-13 12:53:25 +01:00
wireless	wifi: cfg80211: cancel wiphy_work before freeing wiphy	2025-03-28 21:58:48 +01:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:20:42 -04:00
xdp	xsk: fix an integer overflow in xp_create_and_assign_umem()	2025-03-28 21:59:01 +01:00
xfrm	xfrm_output: Force software GSO only in tunnel mode	2025-03-28 21:58:59 +01:00
compat.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
devres.c	net: devres: Correct a grammatical error	2021-06-11 12:55:28 -07:00
Kconfig	Remove DECnet support from kernel	2022-08-22 14:26:30 +01:00
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile	devlink: move code to a dedicated directory	2023-08-30 16:11:00 +02:00
socket.c	net: explicitly clear the sk pointer, when pf->create fails	2024-10-17 15:22:27 +02:00
sysctl_net.c	sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)	2024-08-11 12:35:51 +02:00