Roman Mashak 8690075430 net sched actions: fix invalid pointer dereferencing if skbedit flags missing ... [ Upstream commit af5d01842f ] When application fails to pass flags in netlink TLV for a new skbedit action, the kernel results in the following oops: [ 8.307732] BUG: unable to handle kernel paging request at 0000000000021130 [ 8.309167] PGD 80000000193d1067 P4D 80000000193d1067 PUD 180e0067 PMD 0 [ 8.310595] Oops: 0000 [#1] SMP PTI [ 8.311334] Modules linked in: kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd cryptd glue_helper serio_raw [ 8.314190] CPU: 1 PID: 397 Comm: tc Not tainted 4.17.0-rc3+ #357 [ 8.315252] RIP: 0010:__tcf_idr_release+0x33/0x140 [ 8.316203] RSP: 0018:ffffa0718038f840 EFLAGS: 00010246 [ 8.317123] RAX: 0000000000000001 RBX: 0000000000021100 RCX: 0000000000000000 [ 8.319831] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000021100 [ 8.321181] RBP: 0000000000000000 R08: 000000000004adf8 R09: 0000000000000122 [ 8.322645] R10: 0000000000000000 R11: ffffffff9e5b01ed R12: 0000000000000000 [ 8.324157] R13: ffffffff9e0d3cc0 R14: 0000000000000000 R15: 0000000000000000 [ 8.325590] FS: 00007f591292e700(0000) GS:ffff8fcf5bc40000(0000) knlGS:0000000000000000 [ 8.327001] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.327987] CR2: 0000000000021130 CR3: 00000000180e6004 CR4: 00000000001606a0 [ 8.329289] Call Trace: [ 8.329735] tcf_skbedit_init+0xa7/0xb0 [ 8.330423] tcf_action_init_1+0x362/0x410 [ 8.331139] ? try_to_wake_up+0x44/0x430 [ 8.331817] tcf_action_init+0x103/0x190 [ 8.332511] tc_ctl_action+0x11a/0x220 [ 8.333174] rtnetlink_rcv_msg+0x23d/0x2e0 [ 8.333902] ? _cond_resched+0x16/0x40 [ 8.334569] ? __kmalloc_node_track_caller+0x5b/0x2c0 [ 8.335440] ? rtnl_calcit.isra.31+0xf0/0xf0 [ 8.336178] netlink_rcv_skb+0xdb/0x110 [ 8.336855] netlink_unicast+0x167/0x220 [ 8.337550] netlink_sendmsg+0x2a7/0x390 [ 8.338258] sock_sendmsg+0x30/0x40 [ 8.338865] ___sys_sendmsg+0x2c5/0x2e0 [ 8.339531] ? pagecache_get_page+0x27/0x210 [ 8.340271] ? filemap_fault+0xa2/0x630 [ 8.340943] ? page_add_file_rmap+0x108/0x200 [ 8.341732] ? alloc_set_pte+0x2aa/0x530 [ 8.342573] ? finish_fault+0x4e/0x70 [ 8.343332] ? __handle_mm_fault+0xbc1/0x10d0 [ 8.344337] ? __sys_sendmsg+0x53/0x80 [ 8.345040] __sys_sendmsg+0x53/0x80 [ 8.345678] do_syscall_64+0x4f/0x100 [ 8.346339] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 8.347206] RIP: 0033:0x7f591191da67 [ 8.347831] RSP: 002b:00007fff745abd48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 8.349179] RAX: ffffffffffffffda RBX: 00007fff745abe70 RCX: 00007f591191da67 [ 8.350431] RDX: 0000000000000000 RSI: 00007fff745abdc0 RDI: 0000000000000003 [ 8.351659] RBP: 000000005af35251 R08: 0000000000000001 R09: 0000000000000000 [ 8.352922] R10: 00000000000005f1 R11: 0000000000000246 R12: 0000000000000000 [ 8.354183] R13: 00007fff745afed0 R14: 0000000000000001 R15: 00000000006767c0 [ 8.355400] Code: 41 89 d4 53 89 f5 48 89 fb e8 aa 20 fd ff 85 c0 0f 84 ed 00 00 00 48 85 db 0f 84 cf 00 00 00 40 84 ed 0f 85 cd 00 00 00 45 84 e4 <8b> 53 30 74 0d 85 d2 b8 ff ff ff ff 0f 8f b3 00 00 00 8b 43 2c [ 8.358699] RIP: __tcf_idr_release+0x33/0x140 RSP: ffffa0718038f840 [ 8.359770] CR2: 0000000000021130 [ 8.360438] ---[ end trace 60c66be45dfc14f0 ]--- The caller calls action's ->init() and passes pointer to "struct tc_action *a", which later may be initialized to point at the existing action, otherwise "struct tc_action *a" is still invalid, and therefore dereferencing it is an error as happens in tcf_idr_release, where refcnt is decremented. So in case of missing flags tcf_idr_release must be called only for existing actions. v2: - prepare patch for net tree Fixes: 5e1567aeb7 ("net sched: skbedit action fix late binding") Signed-off-by: Roman Mashak <mrv@mojatatu.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-06-21 04:02:57 +09:00
..
6lowpan	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
9p	9p/trans_virtio: discard zero-length reply	2018-02-22 15:42:30 +01:00
802	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
8021q	vlan: Fix out of order vlan headers with reorder header off	2018-05-30 07:52:16 +02:00
appletalk	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
atm	net: atm: Fix potential Spectre v1	2018-05-16 10:10:29 +02:00
ax25	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
batman-adv	batman-adv: fix packet loss for broadcasted DHCP packets to a server	2018-05-30 07:52:19 +02:00
bluetooth	Bluetooth: Fix connection if directed advertising and privacy is used	2018-04-19 08:56:19 +02:00
bpf
bridge	netfilter: ebtables: fix erroneous reject of last rule	2018-05-30 07:52:14 +02:00
caif	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
can	can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once	2018-01-23 19:58:17 +01:00
ceph	libceph, ceph: avoid memory leak when specifying same option several times	2018-05-30 07:52:04 +02:00
core	rtnetlink: validate attributes in do_setlink()	2018-06-11 22:49:22 +02:00
dcb	rtnetlink: make rtnl_register accept a flags parameter	2017-08-09 16:57:38 -07:00
dccp	dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()	2018-06-11 22:49:18 +02:00
decnet	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock	2018-02-25 11:07:52 +01:00
dns_resolver	KEYS: DNS: limit the length of option strings	2018-04-29 11:33:10 +02:00
dsa	net: dsa: Discard frames from unused ports	2018-04-24 09:36:39 +02:00
ethernet
hsr	net/hsr: Check skb_put_padto() return value	2017-08-22 13:40:23 -07:00
ieee802154	ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()	2018-03-31 18:10:40 +02:00
ife	net: sched: ife: check on metadata length	2018-04-29 11:33:13 +02:00
ipv4	net: metrics: add proper netlink validation	2018-06-11 22:49:19 +02:00
ipv6	netfilter: nf_tables: NAT chain and extensions require NF_TABLES	2018-06-21 04:02:43 +09:00
ipx	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
iucv	net/iucv: Free memory obtained by kzalloc	2018-03-31 18:10:41 +02:00
kcm	kcm: Fix use-after-free caused by clonned sockets	2018-06-11 22:49:19 +02:00
key	af_key: Always verify length of provided sadb_key	2018-06-16 09:45:14 +02:00
l2tp	l2tp: revert "l2tp: fix missing print session offset info"	2018-05-19 10:20:27 +02:00
l3mdev
lapb
llc	llc: properly handle dev_queue_xmit() return value	2018-05-30 07:52:20 +02:00
mac80211	mac80211: use timeout from the AddBA response instead of the request	2018-06-21 04:02:55 +09:00
mac802154	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mpls	mpls, nospec: Sanitize array index in mpls_label_ok()	2018-02-22 15:42:28 +01:00
ncsi	net/ncsi: Fix length of GVI response packet	2017-10-21 01:56:38 +01:00
netfilter	netfilter: nf_tables: fix out-of-bounds in nft_chain_commit_update	2018-06-21 04:02:44 +09:00
netlabel	netlabel: If PF_INET6, check sk_buff ip header version	2018-05-30 07:52:40 +02:00
netlink	netlink: fix uninit-value in netlink_sendmsg	2018-05-16 10:10:23 +02:00
netrom
nfc	NFC: llcp: Limit size of SDP URI	2018-05-30 07:51:57 +02:00
nsh	nsh: fix infinite loop	2018-05-19 10:20:26 +02:00
openvswitch	openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found	2018-05-19 10:20:24 +02:00
packet	packet: fix reserve calculation	2018-06-11 22:49:20 +02:00
phonet	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
psample	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
qrtr	qrtr: add MODULE_ALIAS macro to smd	2018-05-30 07:52:05 +02:00
rds	rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp	2018-06-21 04:02:48 +09:00
rfkill	rfkill: gpio: fix memory leak in probe error path	2018-05-16 10:10:26 +02:00
rose
rxrpc	rxrpc: Fix the min security level for kernel calls	2018-06-21 04:02:56 +09:00
sched	net sched actions: fix invalid pointer dereferencing if skbedit flags missing	2018-06-21 04:02:57 +09:00
sctp	sctp: not allow transport timeout value less than HZ/5 for hb_timer	2018-06-11 22:49:20 +02:00
smc	smc: fix sendpage() call	2018-06-21 04:02:53 +09:00
strparser	strparser: Fix incorrect strp->need_bytes value.	2018-04-29 11:33:13 +02:00
sunrpc	SUNRPC: Don't call __UDPX_INC_STATS() from a preemptible context	2018-04-26 11:02:19 +02:00
switchdev	net: switchdev: Remove bridge bypass support from switchdev	2017-08-07 14:48:48 -07:00
tipc	tipc: eliminate KMSAN uninit-value in strcmp complaint	2018-06-21 04:02:56 +09:00
tls	tls: retrun the correct IV in getsockopt	2018-05-30 07:51:56 +02:00
unix	License cleanup: add SPDX license identifiers to some files	2017-11-02 10:04:46 -07:00
vmw_vsock	VSOCK: fix outdated sk_state value in hvs_release()	2018-02-25 11:07:59 +01:00
wimax	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
wireless	cfg80211: clear wep keys after disconnection	2018-05-30 07:51:58 +02:00
x25	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm	xfrm: Fix transport mode skb control buffer usage.	2018-05-30 07:52:19 +02:00
compat.c	net: support compat 64-bit time in {s,g}etsockopt	2018-05-19 10:20:24 +02:00
Kconfig	net: Remove CONFIG_NETFILTER_DEBUG and _ASSERT() macros.	2017-09-04 13:25:20 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
socket.c	kmemcheck: remove annotations	2018-02-22 15:42:23 +01:00
sysctl_net.c