linux/net
Håkon Bugge 3996120058 rds: Fix NULL pointer dereference in __rds_rdma_map
commit f3069c6d33 upstream.

This is a fix for syzkaller719569, where memory registration was
attempted without any underlying transport being loaded.

Analysis of the case reveals that it is the setsockopt() RDS_GET_MR
(2) and RDS_GET_MR_FOR_DEST (7) that are vulnerable.

Here is an example stack trace when the bug is hit:

BUG: unable to handle kernel NULL pointer dereference at 00000000000000c0
IP: __rds_rdma_map+0x36/0x440 [rds]
PGD 2f93d03067 P4D 2f93d03067 PUD 2f93d02067 PMD 0
Oops: 0000 [#1] SMP
Modules linked in: bridge stp llc tun rpcsec_gss_krb5 nfsv4
dns_resolver nfs fscache rds binfmt_misc sb_edac intel_powerclamp
coretemp kvm_intel kvm irqbypass crct10dif_pclmul c rc32_pclmul
ghash_clmulni_intel pcbc aesni_intel crypto_simd glue_helper cryptd
iTCO_wdt mei_me sg iTCO_vendor_support ipmi_si mei ipmi_devintf nfsd
shpchp pcspkr i2c_i801 ioatd ma ipmi_msghandler wmi lpc_ich mfd_core
auth_rpcgss nfs_acl lockd grace sunrpc ip_tables ext4 mbcache jbd2
mgag200 i2c_algo_bit drm_kms_helper ixgbe syscopyarea ahci sysfillrect
sysimgblt libahci mdio fb_sys_fops ttm ptp libata sd_mod mlx4_core drm
crc32c_intel pps_core megaraid_sas i2c_core dca dm_mirror
dm_region_hash dm_log dm_mod
CPU: 48 PID: 45787 Comm: repro_set2 Not tainted 4.14.2-3.el7uek.x86_64 #2
Hardware name: Oracle Corporation ORACLE SERVER X5-2L/ASM,MOBO TRAY,2U, BIOS 31110000 03/03/2017
task: ffff882f9190db00 task.stack: ffffc9002b994000
RIP: 0010:__rds_rdma_map+0x36/0x440 [rds]
RSP: 0018:ffffc9002b997df0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff882fa2182580 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffc9002b997e40 RDI: ffff882fa2182580
RBP: ffffc9002b997e30 R08: 0000000000000000 R09: 0000000000000002
R10: ffff885fb29e3838 R11: 0000000000000000 R12: ffff882fa2182580
R13: ffff882fa2182580 R14: 0000000000000002 R15: 0000000020000ffc
FS:  00007fbffa20b700(0000) GS:ffff882fbfb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000c0 CR3: 0000002f98a66006 CR4: 00000000001606e0
Call Trace:
 rds_get_mr+0x56/0x80 [rds]
 rds_setsockopt+0x172/0x340 [rds]
 ? __fget_light+0x25/0x60
 ? __fdget+0x13/0x20
 SyS_setsockopt+0x80/0xe0
 do_syscall_64+0x67/0x1b0
 entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7fbff9b117f9
RSP: 002b:00007fbffa20aed8 EFLAGS: 00000293 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00000000000c84a4 RCX: 00007fbff9b117f9
RDX: 0000000000000002 RSI: 0000400000000114 RDI: 000000000000109b
RBP: 00007fbffa20af10 R08: 0000000000000020 R09: 00007fbff9dd7860
R10: 0000000020000ffc R11: 0000000000000293 R12: 0000000000000000
R13: 00007fbffa20b9c0 R14: 00007fbffa20b700 R15: 0000000000000021

Code: 41 56 41 55 49 89 fd 41 54 53 48 83 ec 18 8b 87 f0 02 00 00 48
89 55 d0 48 89 4d c8 85 c0 0f 84 2d 03 00 00 48 8b 87 00 03 00 00 <48>
83 b8 c0 00 00 00 00 0f 84 25 03 00 0 0 48 8b 06 48 8b 56 08

The fix is to check the existence of an underlying transport in
__rds_rdma_map().

Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-03-03 15:52:35 +00:00
..
9p net/9p: Switch to wait_event_killable() 2018-02-13 18:42:09 +00:00
802 neigh: use NEIGH_VAR_INIT in ndo_neigh_setup functions. 2014-01-16 11:31:58 -08:00
8021q 8021q: fix a memory leak for VLAN 0 device 2018-03-03 15:52:21 +00:00
appletalk appletalk: Fix socket referencing in skb 2014-07-08 19:39:43 -07:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-06-12 14:27:40 -07:00
ax25 Revert "ax25: add link layer header validation function" 2016-06-15 21:29:20 +01:00
batman-adv batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq 2018-03-03 15:51:43 +00:00
bluetooth Bluetooth: Prevent stack info leak from the EFS element. 2018-02-13 18:42:31 +00:00
bridge net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks 2018-03-03 15:52:01 +00:00
caif net: caif: fix misleading indentation 2017-11-11 13:33:52 +00:00
can can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once 2018-03-03 15:52:26 +00:00
ceph libceph: potential NULL dereference in ceph_msg_data_create() 2017-11-11 13:32:58 +00:00
core netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed 2018-01-01 20:52:04 +00:00
dcb net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-04-24 13:44:54 -04:00
dccp dccp: don't restart ccid2_hc_tx_rto_expire() if sk in closed state 2018-03-03 15:52:28 +00:00
decnet decnet: Do not build routes to devices without decnet private data. 2017-03-16 02:27:15 +00:00
dns_resolver dns_resolver: Null-terminate the right string 2014-07-20 22:33:32 -07:00
dsa net: dsa: Fix off-by-one in switch address parsing 2015-08-10 17:10:19 +01:00
ethernet net: eth_type_trans() should use skb_header_pointer() 2014-01-16 15:30:31 -08:00
hsr hsr: replace del_timer by del_timer_sync 2014-03-27 15:28:06 -04:00
ieee802154 ieee802154: Fix sockaddr_ieee802154 implicit padding information leak. 2015-07-15 10:00:19 +01:00
ipv4 net: igmp: fix source address check for IGMPv3 reports 2018-03-03 15:52:27 +00:00
ipv6 xfrm: Return error on unknown encap_type in init_state 2018-03-03 15:52:15 +00:00
ipx ipx: call ipxitf_put() in ioctl error path 2017-06-05 21:17:23 +01:00
irda irda: Fix lockdep annotations in hashbin_delete(). 2017-03-16 02:27:15 +00:00
iucv af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers 2017-10-12 15:27:52 +01:00
key af_key: fix buffer overread in parse_exthdrs() 2018-03-03 15:52:08 +00:00
l2tp l2tp: initialise PPP sessions before registering them 2018-02-13 18:42:11 +00:00
lapb net/lapb: re-send packets on timeout 2013-09-23 16:52:45 -04:00
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-03-16 02:27:13 +00:00
mac80211 mac80211: don't compare TKIP TX MIC key in reinstall prevention 2017-11-26 13:50:39 +00:00
mac802154 mac802154: don't deliver packets to devices that are down 2014-06-11 12:10:19 -07:00
mpls net: gso: use feature flag argument in all protocol gso handlers 2015-08-27 14:27:14 +01:00
netfilter netfilter: xt_bpf: add overflow checks 2018-03-03 15:51:43 +00:00
netlabel netlabel: add address family checks to netlbl_{sock,req}_delattr() 2016-11-20 01:16:39 +00:00
netlink netlink: Add netns check on taps 2018-01-01 20:52:09 +00:00
netrom net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
nfc NFC: fix device-allocation error return 2018-02-13 18:42:15 +00:00
openvswitch ovs: do not allocate memory from offline numa node 2015-10-28 10:33:20 +00:00
packet net/packet: fix a race in packet_bind() and packet_notifier() 2018-03-03 15:51:38 +00:00
phonet phonet: properly unshare skbs in phonet_rcv() 2016-01-28 10:51:50 +00:00
rds rds: Fix NULL pointer dereference in __rds_rdma_map 2018-03-03 15:52:35 +00:00
rfkill rfkill: fix rfkill_fop_read wait_event usage 2016-02-25 00:18:36 +00:00
rose rose: limit sk_filter trim to payload 2017-02-23 03:54:46 +00:00
rxrpc rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2017-07-02 17:13:03 +01:00
sched net_sched: red: Avoid illegal values 2018-03-03 15:51:45 +00:00
sctp sctp: do not allow the v4 socket to bind a v4mapped v6 address 2018-03-03 15:52:24 +00:00
sunrpc kernel: make groups_sort calling a responsibility group_info allocators 2018-03-03 15:51:59 +00:00
tipc tipc: check minimum bearer MTU 2017-02-23 03:54:42 +00:00
unix net/unix: don't show information about sockets from other namespaces 2018-01-01 20:51:59 +00:00
vmw_vsock VSOCK: Detach QP check should filter out non matching QPs. 2017-11-26 13:50:40 +00:00
wimax wimax: remove dead code 2013-11-21 13:09:42 -05:00
wireless cfg80211: fix station info handling bugs 2018-03-03 15:52:26 +00:00
x25 net: fix a kernel infoleak in x25 module 2016-06-15 21:29:34 +01:00
xfrm xfrm: Use __skb_queue_tail in xfrm_trans_queue 2018-03-03 15:52:13 +00:00
compat.c net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour 2015-03-24 10:48:46 +00:00
Kconfig Merge branch 'for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup 2014-04-03 13:05:42 -07:00
Makefile net: move 6lowpan compression code to separate module 2014-01-15 15:36:38 -08:00
nonet.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
socket.c net: socket: fix recvmmsg not returning error from sock_error 2017-03-16 02:27:23 +00:00
sysctl_net.c net: Update the sysctl permissions handler to test effective uid/gid 2013-10-07 15:57:56 -04:00