Etienne Noss 52491c7607 act_connmark: avoid crashing on malformed nlattrs with null parms ... tcf_connmark_init does not check in its configuration if TCA_CONNMARK_PARMS is set, resulting in a null pointer dereference when trying to access it. [501099.043007] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 [501099.043039] IP: [<ffffffffc10c60fb>] tcf_connmark_init+0x8b/0x180 [act_connmark] ... [501099.044334] Call Trace: [501099.044345] [<ffffffffa47270e8>] ? tcf_action_init_1+0x198/0x1b0 [501099.044363] [<ffffffffa47271b0>] ? tcf_action_init+0xb0/0x120 [501099.044380] [<ffffffffa47250a4>] ? tcf_exts_validate+0xc4/0x110 [501099.044398] [<ffffffffc0f5fa97>] ? u32_set_parms+0xa7/0x270 [cls_u32] [501099.044417] [<ffffffffc0f60bf0>] ? u32_change+0x680/0x87b [cls_u32] [501099.044436] [<ffffffffa4725d1d>] ? tc_ctl_tfilter+0x4dd/0x8a0 [501099.044454] [<ffffffffa44a23a1>] ? security_capable+0x41/0x60 [501099.044471] [<ffffffffa470ca01>] ? rtnetlink_rcv_msg+0xe1/0x220 [501099.044490] [<ffffffffa470c920>] ? rtnl_newlink+0x870/0x870 [501099.044507] [<ffffffffa472cc61>] ? netlink_rcv_skb+0xa1/0xc0 [501099.044524] [<ffffffffa47073f4>] ? rtnetlink_rcv+0x24/0x30 [501099.044541] [<ffffffffa472c634>] ? netlink_unicast+0x184/0x230 [501099.044558] [<ffffffffa472c9d8>] ? netlink_sendmsg+0x2f8/0x3b0 [501099.044576] [<ffffffffa46d8880>] ? sock_sendmsg+0x30/0x40 [501099.044592] [<ffffffffa46d8e03>] ? SYSC_sendto+0xd3/0x150 [501099.044608] [<ffffffffa425fda1>] ? __do_page_fault+0x2d1/0x510 [501099.044626] [<ffffffffa47fbd7b>] ? system_call_fast_compare_end+0xc/0x9b Fixes: 22a5dc0e5e ("net: sched: Introduce connmark action") Signed-off-by: Étienne Noss <etienne.noss@wifirst.fr> Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-03-12 23:32:41 -07:00
..
6lowpan
9p	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-03-03 21:44:35 -08:00
802
8021q	net: remove ndo_neigh_{construct, destroy} from stacked devices	2017-02-06 11:25:57 -05:00
appletalk	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
atm	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
ax25	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
batman-adv	This contains just the average.h change in order to get it	2017-03-02 14:39:17 -08:00
bluetooth	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
caif	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
can	can: bcm: fix hrtimer/tasklet termination in bcm op removal	2017-01-30 11:05:04 +01:00
ceph	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
core	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
dcb
dccp	dccp: fix use-after-free in dccp_feat_activate_values	2017-03-07 14:15:27 -08:00
decnet	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
dns_resolver	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
dsa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-11 02:31:11 -05:00
ethernet	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-02-16 21:25:49 -05:00
hsr	net/hsr: use eth_hw_addr_random()	2017-02-21 13:25:22 -05:00
ieee802154	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
ife	net: Introduce ife encapsulation module	2017-02-03 15:16:45 -05:00
ipv4	udp: avoid ufo handling on IP payload compression packets	2017-03-09 18:28:42 -08:00
ipv6	udp: avoid ufo handling on IP payload compression packets	2017-03-09 18:28:42 -08:00
ipx
irda	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
iucv	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
kcm	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
key
l2tp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-28 10:00:39 -08:00
l3mdev
lapb
llc	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
mac802154	sched/headers: Prepare to use <linux/rcuupdate.h> instead of <linux/rculist.h> in <linux/sched.h>	2017-03-02 08:42:38 +01:00
mpls	net: mpls: Add support for netconf	2017-02-20 11:13:37 -05:00
ncsi
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
netlabel
netlink	net: adjust skb->truesize in pskb_expand_head()	2017-01-27 12:03:29 -05:00
netrom	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
nfc	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
openvswitch	openvswitch: actions: fixed a brace coding style warning	2017-03-02 13:14:44 -08:00
packet	net: don't call strlen() on the user buffer in packet_bind_spkt()	2017-03-01 20:55:57 -08:00
phonet	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
psample
qrtr
rds	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
rfkill
rose	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
rxrpc	rxrpc: Wake up the transmitter if Rx window size increases on the peer	2017-03-10 09:34:23 -08:00
sched	act_connmark: avoid crashing on malformed nlattrs with null parms	2017-03-12 23:32:41 -07:00
sctp	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
smc	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
strparser	strparser: destroy workqueue on module exit	2017-03-03 20:43:26 -08:00
sunrpc	sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>	2017-03-02 08:42:31 +01:00
switchdev
tipc	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
unix	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
vmw_vsock	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
wimax
wireless	Some more updates:	2017-02-10 14:31:51 -05:00
x25	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2017-03-07 15:00:37 -08:00
compat.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-02-22 10:15:09 -08:00
Kconfig	bpf: make jited programs visible in traces	2017-02-17 13:40:05 -05:00
Makefile	net: Introduce ife encapsulation module	2017-02-03 15:16:45 -05:00
socket.c	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
sysctl_net.c