Ahmed Abdelsalam a370d8a3aa ipv6: sr: fix NULL pointer dereference in seg6_do_srh_encap()- v4 pkts ... [ Upstream commit a957fa190a ] In case of seg6 in encap mode, seg6_do_srh_encap() calls set_tun_src() in order to set the src addr of outer IPv6 header. The net_device is required for set_tun_src(). However calling ip6_dst_idev() on dst_entry in case of IPv4 traffic results on the following bug. Using just dst->dev should fix this BUG. [ 196.242461] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 196.242975] PGD 800000010f076067 P4D 800000010f076067 PUD 10f060067 PMD 0 [ 196.243329] Oops: 0000 [#1] SMP PTI [ 196.243468] Modules linked in: nfsd auth_rpcgss nfs_acl nfs lockd grace fscache sunrpc crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd cryptd input_leds glue_helper led_class pcspkr serio_raw mac_hid video autofs4 hid_generic usbhid hid e1000 i2c_piix4 ahci pata_acpi libahci [ 196.244362] CPU: 2 PID: 1089 Comm: ping Not tainted 4.16.0+ #1 [ 196.244606] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 196.244968] RIP: 0010:seg6_do_srh_encap+0x1ac/0x300 [ 196.245236] RSP: 0018:ffffb2ce00b23a60 EFLAGS: 00010202 [ 196.245464] RAX: 0000000000000000 RBX: ffff8c7f53eea300 RCX: 0000000000000000 [ 196.245742] RDX: 0000f10000000000 RSI: ffff8c7f52085a6c RDI: ffff8c7f41166850 [ 196.246018] RBP: ffffb2ce00b23aa8 R08: 00000000000261e0 R09: ffff8c7f41166800 [ 196.246294] R10: ffffdce5040ac780 R11: ffff8c7f41166828 R12: ffff8c7f41166808 [ 196.246570] R13: ffff8c7f52085a44 R14: ffffffffb73211c0 R15: ffff8c7e69e44200 [ 196.246846] FS: 00007fc448789700(0000) GS:ffff8c7f59d00000(0000) knlGS:0000000000000000 [ 196.247286] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 196.247526] CR2: 0000000000000000 CR3: 000000010f05a000 CR4: 00000000000406e0 [ 196.247804] Call Trace: [ 196.247972] seg6_do_srh+0x15b/0x1c0 [ 196.248156] seg6_output+0x3c/0x220 [ 196.248341] ? prandom_u32+0x14/0x20 [ 196.248526] ? ip_idents_reserve+0x6c/0x80 [ 196.248723] ? __ip_select_ident+0x90/0x100 [ 196.248923] ? ip_append_data.part.50+0x6c/0xd0 [ 196.249133] lwtunnel_output+0x44/0x70 [ 196.249328] ip_send_skb+0x15/0x40 [ 196.249515] raw_sendmsg+0x8c3/0xac0 [ 196.249701] ? _copy_from_user+0x2e/0x60 [ 196.249897] ? rw_copy_check_uvector+0x53/0x110 [ 196.250106] ? _copy_from_user+0x2e/0x60 [ 196.250299] ? copy_msghdr_from_user+0xce/0x140 [ 196.250508] sock_sendmsg+0x36/0x40 [ 196.250690] ___sys_sendmsg+0x292/0x2a0 [ 196.250881] ? _cond_resched+0x15/0x30 [ 196.251074] ? copy_termios+0x1e/0x70 [ 196.251261] ? _copy_to_user+0x22/0x30 [ 196.251575] ? tty_mode_ioctl+0x1c3/0x4e0 [ 196.251782] ? _cond_resched+0x15/0x30 [ 196.251972] ? mutex_lock+0xe/0x30 [ 196.252152] ? vvar_fault+0xd2/0x110 [ 196.252337] ? __do_fault+0x1f/0xc0 [ 196.252521] ? __handle_mm_fault+0xc1f/0x12d0 [ 196.252727] ? __sys_sendmsg+0x63/0xa0 [ 196.252919] __sys_sendmsg+0x63/0xa0 [ 196.253107] do_syscall_64+0x72/0x200 [ 196.253305] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 196.253530] RIP: 0033:0x7fc4480b0690 [ 196.253715] RSP: 002b:00007ffde9f252f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 196.254053] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 00007fc4480b0690 [ 196.254331] RDX: 0000000000000000 RSI: 000000000060a360 RDI: 0000000000000003 [ 196.254608] RBP: 00007ffde9f253f0 R08: 00000000002d1e81 R09: 0000000000000002 [ 196.254884] R10: 00007ffde9f250c0 R11: 0000000000000246 R12: 0000000000b22070 [ 196.255205] R13: 20c49ba5e353f7cf R14: 431bde82d7b634db R15: 00007ffde9f278fe [ 196.255484] Code: a5 0f b6 45 c0 41 88 41 28 41 0f b6 41 2c 48 c1 e0 04 49 8b 54 01 38 49 8b 44 01 30 49 89 51 20 49 89 41 18 48 8b 83 b0 00 00 00 <48> 8b 30 49 8b 86 08 0b 00 00 48 8b 40 20 48 8b 50 08 48 0b 10 [ 196.256190] RIP: seg6_do_srh_encap+0x1ac/0x300 RSP: ffffb2ce00b23a60 [ 196.256445] CR2: 0000000000000000 [ 196.256676] ---[ end trace 71af7d093603885c ]--- Fixes: 8936ef7604 ("ipv6: sr: fix NULL pointer dereference when setting encap source address") Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Acked-by: David Lebrun <dlebrun@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-04-29 11:33:10 +02:00
..
6lowpan	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
9p	9p/trans_virtio: discard zero-length reply	2018-02-22 15:42:30 +01:00
802	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
8021q	vlan: also check phy_driver ts_info for vlan's real device	2018-04-12 12:32:24 +02:00
appletalk	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
atm	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ax25	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-08-09 16:28:45 -07:00
bluetooth	Bluetooth: Fix connection if directed advertising and privacy is used	2018-04-19 08:56:19 +02:00
bpf
bridge	netfilter: compat: prepare xt_compat_init_offsets to return errors	2018-04-26 11:02:21 +02:00
caif	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
can	can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once	2018-01-23 19:58:17 +01:00
ceph	libceph: don't WARN() if user tries to add invalid key	2017-11-30 08:40:45 +00:00
core	net: fool proof dev_valid_name()	2018-04-12 12:32:25 +02:00
dcb	rtnetlink: make rtnl_register accept a flags parameter	2017-08-09 16:57:38 -07:00
dccp	dccp: check sk for closed state in dccp_sendmsg()	2018-03-31 18:10:40 +02:00
decnet	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock	2018-02-25 11:07:52 +01:00
dns_resolver	KEYS: Fix race between updating and finding a negative key	2017-10-18 09:12:40 +01:00
dsa	net: dsa: Discard frames from unused ports	2018-04-24 09:36:39 +02:00
ethernet
hsr	net/hsr: Check skb_put_padto() return value	2017-08-22 13:40:23 -07:00
ieee802154	ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()	2018-03-31 18:10:40 +02:00
ife	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
ipv4	netfilter: compat: prepare xt_compat_init_offsets to return errors	2018-04-26 11:02:21 +02:00
ipv6	ipv6: sr: fix NULL pointer dereference in seg6_do_srh_encap()- v4 pkts	2018-04-29 11:33:10 +02:00
ipx	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
iucv	net/iucv: Free memory obtained by kzalloc	2018-03-31 18:10:41 +02:00
kcm	kcm: lock lower socket in kcm_attach	2018-03-31 18:10:40 +02:00
key	af_key: fix buffer overread in parse_exthdrs()	2018-01-23 19:58:12 +01:00
l2tp	l2tp: fix missing print session offset info	2018-04-12 12:32:12 +02:00
l3mdev
lapb	net, lapb: convert lapb_cb.refcnt from atomic_t to refcount_t	2017-07-04 22:35:16 +01:00
llc	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mac80211	mac80211: Fix setting TX power on monitor interfaces	2018-04-12 12:32:15 +02:00
mac802154	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mpls	mpls, nospec: Sanitize array index in mpls_label_ok()	2018-02-22 15:42:28 +01:00
ncsi	net/ncsi: Fix length of GVI response packet	2017-10-21 01:56:38 +01:00
netfilter	netfilter: x_tables: limit allocation requests for blob rule heads	2018-04-26 11:02:21 +02:00
netlabel	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
netlink	netlink: make sure nladdr has correct size in netlink_connect()	2018-04-12 12:32:23 +02:00
netrom	net, netrom: convert nr_node.refcount from atomic_t to refcount_t	2017-07-04 22:35:17 +01:00
nfc	NFC: fix device-allocation error return	2017-11-30 08:40:55 +00:00
nsh	nsh: add GSO support	2017-08-29 15:16:52 -07:00
openvswitch	openvswitch: Remove padding from packet before L3+ conntrack processing	2018-04-26 11:02:15 +02:00
packet	net/packet: fix a race in packet_bind() and packet_notifier()	2017-12-17 15:07:56 +01:00
phonet	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
psample	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
qrtr	qrtr: Move to postcore_initcall	2017-11-08 14:32:18 +09:00
rds	RDS: IB: Fix null pointer issue	2018-04-26 11:02:17 +02:00
rfkill
rose
rxrpc	rxrpc: Don't put crypto buffers on the stack	2018-04-26 11:02:19 +02:00
sched	net/sched: fix NULL dereference on the error path of tcf_skbmod_init()	2018-04-12 12:32:26 +02:00
sctp	sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6	2018-04-12 12:32:24 +02:00
smc	net/smc: fix NULL pointer dereference on sock_create_kern() error path	2018-03-15 10:54:28 +01:00
strparser	strparser: Fix sign of err codes	2018-04-12 12:32:26 +02:00
sunrpc	SUNRPC: Don't call __UDPX_INC_STATS() from a preemptible context	2018-04-26 11:02:19 +02:00
switchdev	net: switchdev: Remove bridge bypass support from switchdev	2017-08-07 14:48:48 -07:00
tipc	tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path	2018-03-03 10:24:30 +01:00
tls	tls: reset crypto_info when do_tls_setsockopt_tx fails	2018-01-31 14:03:48 +01:00
unix	License cleanup: add SPDX license identifiers to some files	2017-11-02 10:04:46 -07:00
vmw_vsock	VSOCK: fix outdated sk_state value in hvs_release()	2018-02-25 11:07:59 +01:00
wimax	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
wireless	nl80211: Check for the required netlink attribute presence	2018-03-03 10:24:34 +01:00
x25	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm	xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems	2018-04-08 14:26:29 +02:00
compat.c	net: compat: assert the size of cmsg copied in is as expected	2017-09-20 15:36:18 -07:00
Kconfig	net: Remove CONFIG_NETFILTER_DEBUG and _ASSERT() macros.	2017-09-04 13:25:20 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
socket.c	kmemcheck: remove annotations	2018-02-22 15:42:23 +01:00
sysctl_net.c