kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
WANG Cong 05a59bc2f3 ipv6: reorder icmpv6_init() and ip6_mr_init() 
[ Upstream commit 15e668070a ]

Andrey reported the following kernel crash:

kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 14446 Comm: syz-executor6 Not tainted 4.10.0+ #82
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88001f311700 task.stack: ffff88001f6e8000
RIP: 0010:ip6mr_sk_done+0x15a/0x3d0 net/ipv6/ip6mr.c:1618
RSP: 0018:ffff88001f6ef418 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 1ffff10003edde8c RCX: ffffc900043ee000
RDX: 0000000000000004 RSI: ffffffff83e3b3f8 RDI: 0000000000000020
RBP: ffff88001f6ef508 R08: fffffbfff0dcc5d8 R09: 0000000000000000
R10: ffffffff86e62ec0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88001f6ef4e0 R15: ffff8800380a0040
FS:  00007f7a52cec700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000061c500 CR3: 000000001f1ae000 CR4: 00000000000006f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 rawv6_close+0x4c/0x80 net/ipv6/raw.c:1217
 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
 inet6_release+0x50/0x70 net/ipv6/af_inet6.c:432
 sock_release+0x8d/0x1e0 net/socket.c:597
 __sock_create+0x39d/0x880 net/socket.c:1226
 sock_create_kern+0x3f/0x50 net/socket.c:1243
 inet_ctl_sock_create+0xbb/0x280 net/ipv4/af_inet.c:1526
 icmpv6_sk_init+0x163/0x500 net/ipv6/icmp.c:954
 ops_init+0x10a/0x550 net/core/net_namespace.c:115
 setup_net+0x261/0x660 net/core/net_namespace.c:291
 copy_net_ns+0x27e/0x540 net/core/net_namespace.c:396
9pnet_virtio: no channels available for device ./file1
 create_new_namespaces+0x437/0x9b0 kernel/nsproxy.c:106
 unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205
 SYSC_unshare kernel/fork.c:2281 [inline]
 SyS_unshare+0x64e/0x1000 kernel/fork.c:2231
 entry_SYSCALL_64_fastpath+0x1f/0xc2

This is because net->ipv6.mr6_tables is not initialized at that point,
ip6mr_rules_init() is not called yet, therefore on the error path when
we iterator the list, we trigger this oops. Fix this by reordering
ip6mr_rules_init() before icmpv6_sk_init().

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-12-14 09:28:21 +01:00
..
6lowpan 6lowpan: ndisc: no overreact if no short address is available 2016-09-19 20:19:34 +02:00
9p net/9p: Switch to wait_event_killable() 2017-11-30 08:39:09 +00:00
802 net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
8021q vlan: fix a use-after-free in vlan_device_event() 2017-11-24 08:33:41 +01:00
appletalk appletalk: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
atm lec: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
ax25 ax25: Fix segfault after sock connection timeout 2017-02-04 09:47:09 +01:00
batman-adv batman-adv: Check for alloc errors when preparing TT local data 2016-12-02 10:46:59 +01:00
bluetooth Bluetooth: Properly check L2CAP config option output buffer length 2017-09-13 14:13:36 -07:00
bridge bridge: netlink: register netdevice before executing changelink 2017-10-08 10:26:08 +02:00
caif net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx 2017-07-05 14:40:14 +02:00
can can: Fix kernel panic at security_sock_rcv_skb 2017-02-18 15:11:40 +01:00
ceph libceph: don't WARN() if user tries to add invalid key 2017-11-30 08:39:03 +00:00
core netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed 2017-11-24 08:33:40 +01:00
dcb net: dcb: set error code on failures 2016-12-03 23:54:25 -05:00
dccp tcp/dccp: fix other lockdep splats accessing ireq_opt 2017-11-18 11:22:22 +01:00
decnet decnet: always not take dst->__refcnt when inserting dst into hash table 2017-07-05 14:40:16 +02:00
dns_resolver KEYS: Fix race between updating and finding a negative key 2017-10-27 10:38:11 +02:00
dsa net: dsa: select NET_SWITCHDEV 2017-11-15 15:53:17 +01:00
ethernet net: introduce device min_header_len 2017-02-18 15:11:43 +01:00
hsr net/hsr: Remove unused but set variable 2016-10-18 10:28:18 -04:00
ieee802154 Revert "net: fix percpu memory leaks" 2017-09-20 08:19:55 +02:00
ipv4 tcp: correct memory barrier usage in tcp_check_space() 2017-12-09 22:01:53 +01:00
ipv6 ipv6: reorder icmpv6_init() and ip6_mr_init() 2017-12-14 09:28:21 +01:00
ipx ipx: call ipxitf_put() in ioctl error path 2017-05-25 15:44:41 +02:00
irda irda: do not leak initialized list.dev to userspace 2017-08-30 10:21:42 +02:00
iucv net/af_iucv: don't use paged skbs for TX on HiperSockets 2017-01-19 20:18:04 +01:00
kcm kcm: do not attach PF_KCM sockets to avoid deadlock 2017-09-20 08:19:55 +02:00
key af_key: do not use GFP_KERNEL in atomic contexts 2017-08-30 10:21:38 +02:00
l2tp l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups 2017-12-09 22:01:50 +01:00
l3mdev net: ipv6: Remove l3mdev_get_saddr6 2016-09-10 23:12:53 -07:00
lapb net/lapb: tuse %*ph to dump buffers 2016-05-29 22:33:25 -07:00
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-02-26 11:10:50 +01:00
mac80211 mac80211: don't try to sleep in rate_control_rate_init() 2017-12-09 22:01:53 +01:00
mac802154 mac802154: use rate limited warnings for malformed frames 2016-09-19 20:19:34 +02:00
mpls mpls: Do not decrement alive counter for unregister events 2017-03-22 12:43:34 +01:00
ncsi net/ncsi: Improve HNCDSC AEN handler 2016-10-20 11:23:08 -04:00
netfilter netfilter: nf_tables: fix oob access 2017-11-30 08:39:14 +00:00
netlabel netlabel: Implement CALIPSO config functions for SMACK. 2016-06-27 15:06:18 -04:00
netlink af_netlink: ensure that NLMSG_DONE never fails in dumps 2017-11-24 08:33:41 +01:00
netrom netfilter: Remove spurios included of netfilter.h 2015-06-18 21:14:32 +02:00
nfc NFC: fix device-allocation error return 2017-11-30 08:39:07 +00:00
openvswitch openvswitch: fix skb_panic due to the incorrect actions attrlen 2017-08-30 10:21:40 +02:00
packet packet: avoid panic in packet_getsockopt() 2017-11-18 11:22:22 +01:00
phonet sock: struct proto hash function may error 2016-02-11 03:54:14 -05:00
qrtr net: qrtr: Mark 'buf' as little endian 2017-12-09 22:01:51 +01:00
rds rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races 2017-12-14 09:28:20 +01:00
rfkill rfkill: Use switch to demux userspace operations 2016-04-05 10:48:53 +02:00
rose rose: limit sk_filter trim to payload 2016-07-13 11:53:40 -07:00
rxrpc rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2017-06-29 13:00:31 +02:00
sched net_sched: avoid matching qdisc with zero handle 2017-11-18 11:22:23 +01:00
sctp net: sctp: fix array overrun read on sctp_timer_tbl 2017-12-09 22:01:53 +01:00
strparser strparser: destroy workqueue on module exit 2017-03-22 12:43:33 +01:00
sunrpc NFSv4: Fix callback server shutdown 2017-09-27 14:39:18 +02:00
switchdev switchdev: Execute bridge ndos only for bridge ports 2016-10-19 10:58:04 -04:00
tipc tipc: fix cleanup at module unload 2017-12-09 22:01:53 +01:00
unix net/unix: don't show information about sockets from other namespaces 2017-11-18 11:22:22 +01:00
vmw_vsock vsock: use new wait API for vsock_stream_sendmsg() 2017-11-30 08:39:01 +00:00
wimax net:wimax: Fix doucble word "the the" in networking.xml 2015-08-09 22:43:52 -07:00
wireless cfg80211: fix connect/disconnect edge cases 2017-11-02 09:49:15 +01:00
x25 net: x25: remove null checks on arrays calling_ae and called_ae 2016-09-09 18:13:30 -07:00
xfrm ipsec: Fix aborted xfrm policy dump crash 2017-11-02 09:49:15 +01:00
compat.c audit: log 32-bit socketcalls 2017-10-08 10:26:06 +02:00
Kconfig strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
Makefile strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
socket.c net: socket: fix recvmmsg not returning error from sock_error 2017-02-26 11:10:51 +01:00
sysctl_net.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2016-10-06 09:52:23 -07:00