From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Artem Savkov <asavkov@redhat.com>,
Eric Dumazet <edumazet@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.8 23/45] ip6_offload: check segs for NULL in ipv6_gso_segment.
Date: Fri, 9 Dec 2016 17:20:52 +0100 [thread overview]
Message-ID: <20161209161755.905651399@linuxfoundation.org> (raw)
In-Reply-To: <20161209161754.912203877@linuxfoundation.org>
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Savkov <asavkov@redhat.com>
[ Upstream commit 6b6ebb6b01c873d0cfe3449e8a1219ee6e5fc022 ]
segs needs to be checked for being NULL in ipv6_gso_segment() before calling
skb_shinfo(segs), otherwise kernel can run into a NULL-pointer dereference:
[ 97.811262] BUG: unable to handle kernel NULL pointer dereference at 00000000000000cc
[ 97.819112] IP: [<ffffffff816e52f9>] ipv6_gso_segment+0x119/0x2f0
[ 97.825214] PGD 0 [ 97.827047]
[ 97.828540] Oops: 0000 [#1] SMP
[ 97.831678] Modules linked in: vhost_net vhost macvtap macvlan nfsv3 rpcsec_gss_krb5
nfsv4 dns_resolver nfs fscache xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4
iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack
ipt_REJECT nf_reject_ipv4 tun ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter
bridge stp llc snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic snd_hda_intel
snd_hda_codec edac_mce_amd snd_hda_core edac_core snd_hwdep kvm_amd snd_seq kvm snd_seq_device
snd_pcm irqbypass snd_timer ppdev parport_serial snd parport_pc k10temp pcspkr soundcore parport
sp5100_tco shpchp sg wmi i2c_piix4 acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc
ip_tables xfs libcrc32c sr_mod cdrom sd_mod ata_generic pata_acpi amdkfd amd_iommu_v2 radeon
broadcom bcm_phy_lib i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops
ttm ahci serio_raw tg3 firewire_ohci libahci pata_atiixp drm ptp libata firewire_core pps_core
i2c_core crc_itu_t fjes dm_mirror dm_region_hash dm_log dm_mod
[ 97.927721] CPU: 1 PID: 3504 Comm: vhost-3495 Not tainted 4.9.0-7.el7.test.x86_64 #1
[ 97.935457] Hardware name: AMD Snook/Snook, BIOS ESK0726A 07/26/2010
[ 97.941806] task: ffff880129a1c080 task.stack: ffffc90001bcc000
[ 97.947720] RIP: 0010:[<ffffffff816e52f9>] [<ffffffff816e52f9>] ipv6_gso_segment+0x119/0x2f0
[ 97.956251] RSP: 0018:ffff88012fc43a10 EFLAGS: 00010207
[ 97.961557] RAX: 0000000000000000 RBX: ffff8801292c8700 RCX: 0000000000000594
[ 97.968687] RDX: 0000000000000593 RSI: ffff880129a846c0 RDI: 0000000000240000
[ 97.975814] RBP: ffff88012fc43a68 R08: ffff880129a8404e R09: 0000000000000000
[ 97.982942] R10: 0000000000000000 R11: ffff880129a84076 R12: 00000020002949b3
[ 97.990070] R13: ffff88012a580000 R14: 0000000000000000 R15: ffff88012a580000
[ 97.997198] FS: 0000000000000000(0000) GS:ffff88012fc40000(0000) knlGS:0000000000000000
[ 98.005280] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 98.011021] CR2: 00000000000000cc CR3: 0000000126c5d000 CR4: 00000000000006e0
[ 98.018149] Stack:
[ 98.020157] 00000000ffffffff ffff88012fc43ac8 ffffffffa017ad0a 000000000000000e
[ 98.027584] 0000001300000000 0000000077d59998 ffff8801292c8700 00000020002949b3
[ 98.035010] ffff88012a580000 0000000000000000 ffff88012a580000 ffff88012fc43a98
[ 98.042437] Call Trace:
[ 98.044879] <IRQ> [ 98.046803] [<ffffffffa017ad0a>] ? tg3_start_xmit+0x84a/0xd60 [tg3]
[ 98.053156] [<ffffffff815eeee0>] skb_mac_gso_segment+0xb0/0x130
[ 98.059158] [<ffffffff815eefd3>] __skb_gso_segment+0x73/0x110
[ 98.064985] [<ffffffff815ef40d>] validate_xmit_skb+0x12d/0x2b0
[ 98.070899] [<ffffffff815ef5d2>] validate_xmit_skb_list+0x42/0x70
[ 98.077073] [<ffffffff81618560>] sch_direct_xmit+0xd0/0x1b0
[ 98.082726] [<ffffffff815efd86>] __dev_queue_xmit+0x486/0x690
[ 98.088554] [<ffffffff8135c135>] ? cpumask_next_and+0x35/0x50
[ 98.094380] [<ffffffff815effa0>] dev_queue_xmit+0x10/0x20
[ 98.099863] [<ffffffffa09ce057>] br_dev_queue_push_xmit+0xa7/0x170 [bridge]
[ 98.106907] [<ffffffffa09ce161>] br_forward_finish+0x41/0xc0 [bridge]
[ 98.113430] [<ffffffff81627cf2>] ? nf_iterate+0x52/0x60
[ 98.118735] [<ffffffff81627d6b>] ? nf_hook_slow+0x6b/0xc0
[ 98.124216] [<ffffffffa09ce32c>] __br_forward+0x14c/0x1e0 [bridge]
[ 98.130480] [<ffffffffa09ce120>] ? br_dev_queue_push_xmit+0x170/0x170 [bridge]
[ 98.137785] [<ffffffffa09ce4bd>] br_forward+0x9d/0xb0 [bridge]
[ 98.143701] [<ffffffffa09cfbb7>] br_handle_frame_finish+0x267/0x560 [bridge]
[ 98.150834] [<ffffffffa09d0064>] br_handle_frame+0x174/0x2f0 [bridge]
[ 98.157355] [<ffffffff8102fb89>] ? sched_clock+0x9/0x10
[ 98.162662] [<ffffffff810b63b2>] ? sched_clock_cpu+0x72/0xa0
[ 98.168403] [<ffffffff815eccf5>] __netif_receive_skb_core+0x1e5/0xa20
[ 98.174926] [<ffffffff813659f9>] ? timerqueue_add+0x59/0xb0
[ 98.180580] [<ffffffff815ed548>] __netif_receive_skb+0x18/0x60
[ 98.186494] [<ffffffff815ee625>] process_backlog+0x95/0x140
[ 98.192145] [<ffffffff815edccd>] net_rx_action+0x16d/0x380
[ 98.197713] [<ffffffff8170cff1>] __do_softirq+0xd1/0x283
[ 98.203106] [<ffffffff8170b2bc>] do_softirq_own_stack+0x1c/0x30
[ 98.209107] <EOI> [ 98.211029] [<ffffffff8108a5c0>] do_softirq+0x50/0x60
[ 98.216166] [<ffffffff815ec853>] netif_rx_ni+0x33/0x80
[ 98.221386] [<ffffffffa09eeff7>] tun_get_user+0x487/0x7f0 [tun]
[ 98.227388] [<ffffffffa09ef3ab>] tun_sendmsg+0x4b/0x60 [tun]
[ 98.233129] [<ffffffffa0b68932>] handle_tx+0x282/0x540 [vhost_net]
[ 98.239392] [<ffffffffa0b68c25>] handle_tx_kick+0x15/0x20 [vhost_net]
[ 98.245916] [<ffffffffa0abacfe>] vhost_worker+0x9e/0xf0 [vhost]
[ 98.251919] [<ffffffffa0abac60>] ? vhost_umem_alloc+0x40/0x40 [vhost]
[ 98.258440] [<ffffffff81003a47>] ? do_syscall_64+0x67/0x180
[ 98.264094] [<ffffffff810a44d9>] kthread+0xd9/0xf0
[ 98.268965] [<ffffffff810a4400>] ? kthread_park+0x60/0x60
[ 98.274444] [<ffffffff8170a4d5>] ret_from_fork+0x25/0x30
[ 98.279836] Code: 8b 93 d8 00 00 00 48 2b 93 d0 00 00 00 4c 89 e6 48 89 df 66 89 93 c2 00 00 00 ff 10 48 3d 00 f0 ff ff 49 89 c2 0f 87 52 01 00 00 <41> 8b 92 cc 00 00 00 48 8b 80 d0 00 00 00 44 0f b7 74 10 06 66
[ 98.299425] RIP [<ffffffff816e52f9>] ipv6_gso_segment+0x119/0x2f0
[ 98.305612] RSP <ffff88012fc43a10>
[ 98.309094] CR2: 00000000000000cc
[ 98.312406] ---[ end trace 726a2c7a2d2d78d0 ]---
Signed-off-by: Artem Savkov <asavkov@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_offload.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -98,7 +98,7 @@ static struct sk_buff *ipv6_gso_segment(
segs = ops->callbacks.gso_segment(skb, features);
}
- if (IS_ERR(segs))
+ if (IS_ERR_OR_NULL(segs))
goto out;
for (skb = segs; skb; skb = skb->next) {
next prev parent reply other threads:[~2016-12-09 16:22 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20161209162112epcas5p48e365650e03ecaae64d811516a0f837d@epcas5p4.samsung.com>
2016-12-09 16:20 ` [PATCH 4.8 00/45] 4.8.14-stable review Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 01/45] gro_cells: mark napi struct as not busy poll candidates Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 02/45] virtio-net: add a missing synchronize_net() Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 03/45] net: dsa: b53: Fix VLAN usage and how we treat CPU port Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 04/45] net: check dead netns for peernet2id_alloc() Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 05/45] ip6_tunnel: disable caching when the traffic class is inherited Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 06/45] net: sky2: Fix shutdown crash Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 07/45] af_unix: conditionally use freezable blocking calls in read Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 08/45] rtnetlink: fix FDB size computation Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 09/45] l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 10/45] rtnl: fix the loop index update error in rtnl_dump_ifinfo() Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 11/45] ipv6: bump genid when the IFA_F_TENTATIVE flag is clear Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 12/45] udplite: call proper backlog handlers Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 13/45] net: dsa: bcm_sf2: Ensure we re-negotiate EEE during after link change Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 14/45] net, sched: respect rcu grace period on cls destruction Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 15/45] net: dsa: fix unbalanced dsa_switch_tree reference counting Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 16/45] net/sched: pedit: make sure that offset is valid Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 17/45] netlink: Call cb->done from a worker thread Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 18/45] netlink: Do not schedule work from sk_destruct Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 19/45] net: macb: fix the RX queue reset in macb_rx() Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 20/45] net/dccp: fix use-after-free in dccp_invalid_packet Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 21/45] GSO: Reload iph after pskb_may_pull Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 22/45] packet: fix race condition in packet_set_ring Greg Kroah-Hartman
2016-12-09 16:20 ` Greg Kroah-Hartman [this message]
2016-12-09 16:20 ` [PATCH 4.8 25/45] net: bcmgenet: Utilize correct struct device for all DMA operations Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 26/45] sh_eth: remove unchecked interrupts for RZ/A1 Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 28/45] geneve: avoid use-after-free of skb->data Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 29/45] net: avoid signed overflows for SO_{SND|RCV}BUFFORCE Greg Kroah-Hartman
2016-12-09 16:20 ` [PATCH 4.8 30/45] net: ping: check minimum size on ICMP header length Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 31/45] ipv4: Restore fib_trie_flush_external function and fix call ordering Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 32/45] ipv4: Fix memory leak in exception case for splitting tries Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 33/45] ipv4: Drop leaf from suffix pull/push functions Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 34/45] ipv4: Drop suffix update from resize code Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 35/45] sparc64: Fix find_node warning if numa node cannot be found Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 36/45] sparc64: fix compile warning section mismatch in find_node() Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 37/45] sparc32: Fix inverted invalid_frame_pointer checks on sigreturns Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 38/45] Dont feed anything but regular iovecs to blk_rq_map_user_iov Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 39/45] constify iov_iter_count() and iter_is_iovec() Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 40/45] ipv6: Set skb->protocol properly for local output Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 41/45] ipv4: " Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 42/45] Revert: "ip6_tunnel: Update skb->protocol to ETH_P_IPV6 in ip6_tnl_xmit()" Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 44/45] esp4: Fix integrity verification when ESN are used Greg Kroah-Hartman
2016-12-09 16:21 ` [PATCH 4.8 45/45] esp6: " Greg Kroah-Hartman
2016-12-09 18:24 ` [PATCH 4.8 00/45] 4.8.14-stable review Shuah Khan
2016-12-10 12:17 ` Greg Kroah-Hartman
2016-12-09 22:36 ` Guenter Roeck
2016-12-10 12:17 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161209161755.905651399@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=asavkov@redhat.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.