From: Jiri Pirko <jiri@resnulli.us>
To: Davide Caratti <dcaratti@redhat.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
Roman Mashak <mrv@mojatatu.com>,
Manish Kurup <kurup.manish@gmail.com>,
netdev@vger.kernel.org
Subject: Re: [PATCH net 3/5] net/sched: fix NULL dereference in the error path of tunnel_key_init()
Date: Fri, 16 Mar 2018 09:26:52 +0100 [thread overview]
Message-ID: <20180316082652.GK2130@nanopsycho> (raw)
In-Reply-To: <1e5eec19547fb24e358551c7d6b789aba4702f6b.1521154629.git.dcaratti@redhat.com>
Fri, Mar 16, 2018 at 12:00:55AM CET, dcaratti@redhat.com wrote:
>when the following command
>
> # tc action add action tunnel_key unset index 100
>
>is run for the first time, and tunnel_key_init() fails to allocate struct
>tcf_tunnel_key_params, tunnel_key_release() dereferences NULL pointers.
>This causes the following error:
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
> IP: tunnel_key_release+0xd/0x40 [act_tunnel_key]
> PGD 8000000033787067 P4D 8000000033787067 PUD 74646067 PMD 0
> Oops: 0000 [#1] SMP PTI
> Modules linked in: act_tunnel_key(E) act_csum ip6table_filter ip6_tables iptable_filter binfmt_misc ext4 mbcache jbd2 crct10dif_pclmul crc32_pclmul snd_hda_codec_generic ghash_clmulni_intel snd_hda_intel pcbc snd_hda_codec snd_hda_core snd_hwdep snd_seq aesni_intel snd_seq_device crypto_simd glue_helper snd_pcm cryptd joydev snd_timer pcspkr virtio_balloon snd i2c_piix4 soundcore nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c ata_generic pata_acpi qxl drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm virtio_net virtio_blk drm virtio_console crc32c_intel ata_piix serio_raw i2c_core virtio_pci libata virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod
> CPU: 2 PID: 3101 Comm: tc Tainted: G E 4.16.0-rc4.act_vlan.orig+ #403
> Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
> RIP: 0010:tunnel_key_release+0xd/0x40 [act_tunnel_key]
> RSP: 0018:ffffba46803b7768 EFLAGS: 00010286
> RAX: ffffffffc09010a0 RBX: 0000000000000000 RCX: 0000000000000024
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99ee336d7480
> RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044
> R10: 0000000000000220 R11: ffff99ee79d73131 R12: 0000000000000000
> R13: ffff99ee32d67610 R14: ffff99ee7671dc38 R15: 00000000fffffff4
> FS: 00007febcb2cd740(0000) GS:ffff99ee7fd00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000010 CR3: 000000007c8e4005 CR4: 00000000001606e0
> Call Trace:
> __tcf_idr_release+0x79/0xf0
> tunnel_key_init+0xd9/0x460 [act_tunnel_key]
> tcf_action_init_1+0x2cc/0x430
> tcf_action_init+0xd3/0x1b0
> tc_ctl_action+0x18b/0x240
> rtnetlink_rcv_msg+0x29c/0x310
> ? _cond_resched+0x15/0x30
> ? __kmalloc_node_track_caller+0x1b9/0x270
> ? rtnl_calcit.isra.28+0x100/0x100
> netlink_rcv_skb+0xd2/0x110
> netlink_unicast+0x17c/0x230
> netlink_sendmsg+0x2cd/0x3c0
> sock_sendmsg+0x30/0x40
> ___sys_sendmsg+0x27a/0x290
> __sys_sendmsg+0x51/0x90
> do_syscall_64+0x6e/0x1a0
> entry_SYSCALL_64_after_hwframe+0x3d/0xa2
> RIP: 0033:0x7febca6deba0
> RSP: 002b:00007ffe7b0dd128 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007ffe7b0dd250 RCX: 00007febca6deba0
> RDX: 0000000000000000 RSI: 00007ffe7b0dd1a0 RDI: 0000000000000003
> RBP: 000000005aaa90cb R08: 0000000000000002 R09: 0000000000000000
> R10: 00007ffe7b0dcba0 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007ffe7b0dd264 R14: 0000000000000001 R15: 0000000000669f60
> Code: 44 00 00 8b 0d b5 23 00 00 48 8b 87 48 10 00 00 48 8b 3c c8 e9 a5 e5 d8 c3 0f 1f 44 00 00 0f 1f 44 00 00 53 48 8b 9f b0 00 00 00 <83> 7b 10 01 74 0b 48 89 df 31 f6 5b e9 f2 fa 7f c3 48 8b 7b 18
> RIP: tunnel_key_release+0xd/0x40 [act_tunnel_key] RSP: ffffba46803b7768
> CR2: 0000000000000010
>
>Fix this in tunnel_key_release(), ensuring 'param' is not NULL before
>dereferencing it.
>
>Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
>Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
next prev parent reply other threads:[~2018-03-16 8:26 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-15 23:00 [PATCH net 0/5] net/sched: fix NULL dereference in the error path of .init() Davide Caratti
2018-03-15 23:00 ` [PATCH net 1/5] net/sched: fix NULL dereference in the error path of tcf_vlan_init() Davide Caratti
2018-03-15 23:00 ` [PATCH net 2/5] net/sched: fix NULL dereference in the error path of tcf_csum_init() Davide Caratti
2018-03-16 8:26 ` Jiri Pirko
2018-03-15 23:00 ` [PATCH net 3/5] net/sched: fix NULL dereference in the error path of tunnel_key_init() Davide Caratti
2018-03-16 8:26 ` Jiri Pirko [this message]
2018-03-15 23:00 ` [PATCH net 4/5] net/sched: fix NULL dereference in the error path of tcf_sample_init() Davide Caratti
2018-03-16 8:27 ` Jiri Pirko
2018-03-15 23:00 ` [PATCH net 5/5] net/sched: fix NULL dereference on the error path of tcf_skbmod_init() Davide Caratti
2018-03-16 8:27 ` Jiri Pirko
2018-03-17 23:53 ` [PATCH net 0/5] net/sched: fix NULL dereference in the error path of .init() David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180316082652.GK2130@nanopsycho \
--to=jiri@resnulli.us \
--cc=davem@davemloft.net \
--cc=dcaratti@redhat.com \
--cc=kurup.manish@gmail.com \
--cc=mrv@mojatatu.com \
--cc=netdev@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.