NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
TencentOS-kernel/net
History
Pavel Tikhomirov fbb32aec3f net: sched: sch_teql: fix null-pointer dereference 
commit 1ffbc7ea91606e4abd10eb60de5367f1c86daf5e upstream.

Reproduce:

  modprobe sch_teql
  tc qdisc add dev teql0 root teql0

This leads to (for instance in Centos 7 VM) OOPS:

[  532.366633] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8
[  532.366733] IP: [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[  532.366825] PGD 80000001376d5067 PUD 137e37067 PMD 0
[  532.366906] Oops: 0000 [#1] SMP
[  532.366987] Modules linked in: sch_teql ...
[  532.367945] CPU: 1 PID: 3026 Comm: tc Kdump: loaded Tainted: G               ------------ T 3.10.0-1062.7.1.el7.x86_64 #1
[  532.368041] Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.2 04/01/2014
[  532.368125] task: ffff8b7d37d31070 ti: ffff8b7c9fdbc000 task.ti: ffff8b7c9fdbc000
[  532.368224] RIP: 0010:[<ffffffffc06124a8>]  [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[  532.368320] RSP: 0018:ffff8b7c9fdbf8e0  EFLAGS: 00010286
[  532.368394] RAX: ffffffffc0612490 RBX: ffff8b7cb1565e00 RCX: ffff8b7d35ba2000
[  532.368476] RDX: ffff8b7d35ba2000 RSI: 0000000000000000 RDI: ffff8b7cb1565e00
[  532.368557] RBP: ffff8b7c9fdbf8f8 R08: ffff8b7d3fd1f140 R09: ffff8b7d3b001600
[  532.368638] R10: ffff8b7d3b001600 R11: ffffffff84c7d65b R12: 00000000ffffffd8
[  532.368719] R13: 0000000000008000 R14: ffff8b7d35ba2000 R15: ffff8b7c9fdbf9a8
[  532.368800] FS:  00007f6a4e872740(0000) GS:ffff8b7d3fd00000(0000) knlGS:0000000000000000
[  532.368885] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  532.368961] CR2: 00000000000000a8 CR3: 00000001396ee000 CR4: 00000000000206e0
[  532.369046] Call Trace:
[  532.369159]  [<ffffffff84c8192e>] qdisc_create+0x36e/0x450
[  532.369268]  [<ffffffff846a9b49>] ? ns_capable+0x29/0x50
[  532.369366]  [<ffffffff849afde2>] ? nla_parse+0x32/0x120
[  532.369442]  [<ffffffff84c81b4c>] tc_modify_qdisc+0x13c/0x610
[  532.371508]  [<ffffffff84c693e7>] rtnetlink_rcv_msg+0xa7/0x260
[  532.372668]  [<ffffffff84907b65>] ? sock_has_perm+0x75/0x90
[  532.373790]  [<ffffffff84c69340>] ? rtnl_newlink+0x890/0x890
[  532.374914]  [<ffffffff84c8da7b>] netlink_rcv_skb+0xab/0xc0
[  532.376055]  [<ffffffff84c63708>] rtnetlink_rcv+0x28/0x30
[  532.377204]  [<ffffffff84c8d400>] netlink_unicast+0x170/0x210
[  532.378333]  [<ffffffff84c8d7a8>] netlink_sendmsg+0x308/0x420
[  532.379465]  [<ffffffff84c2f3a6>] sock_sendmsg+0xb6/0xf0
[  532.380710]  [<ffffffffc034a56e>] ? __xfs_filemap_fault+0x8e/0x1d0 [xfs]
[  532.381868]  [<ffffffffc034a75c>] ? xfs_filemap_fault+0x2c/0x30 [xfs]
[  532.383037]  [<ffffffff847ec23a>] ? __do_fault.isra.61+0x8a/0x100
[  532.384144]  [<ffffffff84c30269>] ___sys_sendmsg+0x3e9/0x400
[  532.385268]  [<ffffffff847f3fad>] ? handle_mm_fault+0x39d/0x9b0
[  532.386387]  [<ffffffff84d88678>] ? __do_page_fault+0x238/0x500
[  532.387472]  [<ffffffff84c31921>] __sys_sendmsg+0x51/0x90
[  532.388560]  [<ffffffff84c31972>] SyS_sendmsg+0x12/0x20
[  532.389636]  [<ffffffff84d8dede>] system_call_fastpath+0x25/0x2a
[  532.390704]  [<ffffffff84d8de21>] ? system_call_after_swapgs+0xae/0x146
[  532.391753] Code: 00 00 00 00 00 00 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 53 48 8b b7 48 01 00 00 48 89 fb <48> 8b 8e a8 00 00 00 48 85 c9 74 43 48 89 ca eb 0f 0f 1f 80 00
[  532.394036] RIP  [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[  532.395127]  RSP <ffff8b7c9fdbf8e0>
[  532.396179] CR2: 00000000000000a8

Null pointer dereference happens on master->slaves dereference in
teql_destroy() as master is null-pointer.

When qdisc_create() calls teql_qdisc_init() it imediately fails after
check "if (m->dev == dev)" because both devices are teql0, and it does
not set qdisc_priv(sch)->m leaving it zero on error path, then
qdisc_create() imediately calls teql_destroy() which does not expect
zero master pointer and we get OOPS.

Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-05-20 16:06:57 +08:00
..
6lowpan Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
9p net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid 2021-03-16 16:39:51 +08:00
802 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
8021q net: vlan: avoid leaks on register_vlan_dev() failures 2021-04-12 12:51:15 +08:00
appletalk appletalk: Fix skb allocation size in loopback case 2021-05-20 16:06:48 +08:00
atm atm: fix a memory leak of vcc->user_back 2021-03-16 16:37:15 +08:00
ax25 AX.25: Prevent integer overflows in connect and sendmsg 2021-03-16 16:32:42 +08:00
batman-adv batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field 2021-05-20 16:06:56 +08:00
bluetooth Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data 2021-04-12 12:52:46 +08:00
bpf Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
bpfilter net/bpfilter: remove superfluous testing message 2021-03-16 16:26:23 +08:00
bridge net: bridge: use switchdev for port flags set through sysfs too 2021-04-12 12:52:45 +08:00
caif Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
can net: introduce CAN specific pointer in the struct net_device 2021-05-20 16:06:48 +08:00
ceph libceph: clear con->out_msg on Policy::stateful_server faults 2021-03-16 16:40:11 +08:00
core bpf: Remove MTU check in __bpf_skb_max_len 2021-05-20 16:06:48 +08:00
dcb net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands 2021-04-12 12:51:30 +08:00
dccp ipv6: weaken the v4mapped source check 2021-05-20 16:06:29 +08:00
decnet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dns_resolver KEYS: Don't write out to userspace while holding key semaphore 2021-03-16 16:26:42 +08:00
dsa net: dsa: tag_mtk: fix 802.1ad VLAN egress 2021-04-12 12:53:14 +08:00
ethernet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hsr hsr: check protocol version in hsr_newlink() 2021-03-16 16:26:20 +08:00
ieee802154 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ife Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ipv4 Revert "netfilter: x_tables: Update remaining dereference to RCU" 2021-04-12 12:53:31 +08:00
ipv6 net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh 2021-05-20 16:06:55 +08:00
iucv net/af_iucv: remove WARN_ONCE on malformed RX packets 2021-04-12 12:52:44 +08:00
kcm Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
key af_key: relax availability checks for skb size calculation 2021-04-12 12:51:58 +08:00
l2tp l2tp: remove skb_dst_set() from l2tp_xmit_skb() 2021-03-16 16:31:43 +08:00
l3mdev Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
lapb net: lapb: Copy the skb before sending a packet 2021-04-12 12:51:53 +08:00
llc net: silence data-races on sk_backlog.tail 2021-03-16 16:36:36 +08:00
mac80211 mac80211: choose first enabled channel for monitor 2021-05-20 16:06:53 +08:00
mac802154 mac802154: tx: fix use-after-free 2021-03-16 16:37:33 +08:00
mpls net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 2021-04-12 12:52:56 +08:00
ncsi net/ncsi: Use real net-device for response handler 2021-04-12 12:51:08 +08:00
netfilter netfilter: conntrack: Fix gre tunneling over ipv6 2021-05-20 16:06:53 +08:00
netlabel cipso,calipso: resolve a number of problems with the DOI refcounts 2021-04-12 12:52:59 +08:00
netlink genetlink: remove genl_bind 2021-03-16 16:31:42 +08:00
netrom net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node 2021-03-16 16:26:51 +08:00
nfc nfc: Avoid endless loops caused by repeated llcp_sock_connect() 2021-05-20 16:06:55 +08:00
nsh Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
openvswitch net: openvswitch: ensure LSE is pullable before reading it 2021-03-16 16:41:57 +08:00
packet af_packet: TPACKET_V3: fix fill status rwlock imbalance 2021-03-16 16:33:48 +08:00
phonet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
psample Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
qrtr net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() 2021-04-12 12:53:32 +08:00
rds net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS 2021-04-12 12:52:06 +08:00
rfkill rfkill: Fix use-after-free in rfkill_resume() 2021-03-16 16:41:16 +08:00
rose rose: Fix Null pointer dereference in rose_send_frame() 2021-03-16 16:41:52 +08:00
rxrpc rxrpc: Fix clearance of Tx/Rx ring when releasing a call 2021-04-12 12:52:05 +08:00
sched net: sched: sch_teql: fix null-pointer dereference 2021-05-20 16:06:57 +08:00
sctp net: fix iteration for sctp transport seq_files 2021-04-12 12:52:06 +08:00
smc net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid() 2021-03-16 16:41:07 +08:00
strparser Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sunrpc rpc: fix NULL dereference on kmalloc failure 2021-05-20 16:06:45 +08:00
switchdev net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP 2021-04-12 12:51:48 +08:00
tipc tipc: fix NULL deref in tipc_link_xmit() 2021-04-12 12:51:31 +08:00
tls net/tls: Protect from calling tls_dev_del for TLS RX twice 2021-03-16 16:41:52 +08:00
toa Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
unix skbuff: fix a data race in skb_queue_len() 2021-03-16 16:36:50 +08:00
vmw_vsock selinux: vsock: Set SID for socket returned by accept() 2021-05-20 16:05:31 +08:00
wimax Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
wireless wext: fix NULL-ptr-dereference with cfg80211's lack of commit() 2021-04-12 12:51:43 +08:00
x25 net/x25: prevent a couple of overflows 2021-03-16 16:41:56 +08:00
xdp xsk: Replace datagram_poll by sock_poll_wait 2021-03-16 16:42:25 +08:00
xfrm xfrm: interface: use icmp_ndo_send helper 2021-04-12 12:52:42 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
compat.c net/compat: Add missing sock updates for SCM_RIGHTS 2021-03-16 16:34:05 +08:00
socket.c net: Set fput_needed iff FDPUT_FPUT is set 2021-03-16 16:33:49 +08:00
sysctl_net.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00