From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>,
"David S. Miller" <davem@davemloft.net>,
Amit Pundir <amit.pundir@linaro.org>
Subject: [PATCH 4.4 55/60] sch_netem: avoid null pointer deref on init failure
Date: Thu, 13 Sep 2018 15:31:02 +0200 [thread overview]
Message-ID: <20180913131748.089940965@linuxfoundation.org> (raw)
In-Reply-To: <20180913131745.261413581@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
commit 634576a1844dba15bc5e6fc61d72f37e13a21615 upstream.
netem can fail in ->init due to missing options (either not supplied by
user-space or used as a default qdisc) causing a timer->base null
pointer deref in its ->destroy() and ->reset() callbacks.
Reproduce:
$ sysctl net.core.default_qdisc=netem
$ ip l set ethX up
Crash log:
[ 1814.846943] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 1814.847181] IP: hrtimer_active+0x17/0x8a
[ 1814.847270] PGD 59c34067
[ 1814.847271] P4D 59c34067
[ 1814.847337] PUD 37374067
[ 1814.847403] PMD 0
[ 1814.847468]
[ 1814.847582] Oops: 0000 [#1] SMP
[ 1814.847655] Modules linked in: sch_netem(O) sch_fq_codel(O)
[ 1814.847761] CPU: 3 PID: 1573 Comm: ip Tainted: G O 4.13.0-rc6+ #62
[ 1814.847884] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 1814.848043] task: ffff88003723a700 task.stack: ffff88005adc8000
[ 1814.848235] RIP: 0010:hrtimer_active+0x17/0x8a
[ 1814.848407] RSP: 0018:ffff88005adcb590 EFLAGS: 00010246
[ 1814.848590] RAX: 0000000000000000 RBX: ffff880058e359d8 RCX: 0000000000000000
[ 1814.848793] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880058e359d8
[ 1814.848998] RBP: ffff88005adcb5b0 R08: 00000000014080c0 R09: 00000000ffffffff
[ 1814.849204] R10: ffff88005adcb660 R11: 0000000000000020 R12: 0000000000000000
[ 1814.849410] R13: ffff880058e359d8 R14: 00000000ffffffff R15: 0000000000000001
[ 1814.849616] FS: 00007f733bbca740(0000) GS:ffff88005d980000(0000) knlGS:0000000000000000
[ 1814.849919] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1814.850107] CR2: 0000000000000000 CR3: 0000000059f0d000 CR4: 00000000000406e0
[ 1814.850313] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1814.850518] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1814.850723] Call Trace:
[ 1814.850875] hrtimer_try_to_cancel+0x1a/0x93
[ 1814.851047] hrtimer_cancel+0x15/0x20
[ 1814.851211] qdisc_watchdog_cancel+0x12/0x14
[ 1814.851383] netem_reset+0xe6/0xed [sch_netem]
[ 1814.851561] qdisc_destroy+0x8b/0xe5
[ 1814.851723] qdisc_create_dflt+0x86/0x94
[ 1814.851890] ? dev_activate+0x129/0x129
[ 1814.852057] attach_one_default_qdisc+0x36/0x63
[ 1814.852232] netdev_for_each_tx_queue+0x3d/0x48
[ 1814.852406] dev_activate+0x4b/0x129
[ 1814.852569] __dev_open+0xe7/0x104
[ 1814.852730] __dev_change_flags+0xc6/0x15c
[ 1814.852899] dev_change_flags+0x25/0x59
[ 1814.853064] do_setlink+0x30c/0xb3f
[ 1814.853228] ? check_chain_key+0xb0/0xfd
[ 1814.853396] ? check_chain_key+0xb0/0xfd
[ 1814.853565] rtnl_newlink+0x3a4/0x729
[ 1814.853728] ? rtnl_newlink+0x117/0x729
[ 1814.853905] ? ns_capable_common+0xd/0xb1
[ 1814.854072] ? ns_capable+0x13/0x15
[ 1814.854234] rtnetlink_rcv_msg+0x188/0x197
[ 1814.854404] ? rcu_read_unlock+0x3e/0x5f
[ 1814.854572] ? rtnl_newlink+0x729/0x729
[ 1814.854737] netlink_rcv_skb+0x6c/0xce
[ 1814.854902] rtnetlink_rcv+0x23/0x2a
[ 1814.855064] netlink_unicast+0x103/0x181
[ 1814.855230] netlink_sendmsg+0x326/0x337
[ 1814.855398] sock_sendmsg_nosec+0x14/0x3f
[ 1814.855584] sock_sendmsg+0x29/0x2e
[ 1814.855747] ___sys_sendmsg+0x209/0x28b
[ 1814.855912] ? do_raw_spin_unlock+0xcd/0xf8
[ 1814.856082] ? _raw_spin_unlock+0x27/0x31
[ 1814.856251] ? __handle_mm_fault+0x651/0xdb1
[ 1814.856421] ? check_chain_key+0xb0/0xfd
[ 1814.856592] __sys_sendmsg+0x45/0x63
[ 1814.856755] ? __sys_sendmsg+0x45/0x63
[ 1814.856923] SyS_sendmsg+0x19/0x1b
[ 1814.857083] entry_SYSCALL_64_fastpath+0x23/0xc2
[ 1814.857256] RIP: 0033:0x7f733b2dd690
[ 1814.857419] RSP: 002b:00007ffe1d3387d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 1814.858238] RAX: ffffffffffffffda RBX: ffffffff810d278c RCX: 00007f733b2dd690
[ 1814.858445] RDX: 0000000000000000 RSI: 00007ffe1d338820 RDI: 0000000000000003
[ 1814.858651] RBP: ffff88005adcbf98 R08: 0000000000000001 R09: 0000000000000003
[ 1814.858856] R10: 00007ffe1d3385a0 R11: 0000000000000246 R12: 0000000000000002
[ 1814.859060] R13: 000000000066f1a0 R14: 00007ffe1d3408d0 R15: 0000000000000000
[ 1814.859267] ? trace_hardirqs_off_caller+0xa7/0xcf
[ 1814.859446] Code: 10 55 48 89 c7 48 89 e5 e8 45 a1 fb ff 31 c0 5d c3
31 c0 c3 66 66 66 66 90 55 48 89 e5 41 56 41 55 41 54 53 49 89 fd 49 8b
45 30 <4c> 8b 20 41 8b 5c 24 38 31 c9 31 d2 48 c7 c7 50 8e 1d 82 41 89
[ 1814.860022] RIP: hrtimer_active+0x17/0x8a RSP: ffff88005adcb590
[ 1814.860214] CR2: 0000000000000000
Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Fixes: 0fbbeb1ba43b ("[PKT_SCHED]: Fix missing qdisc_destroy() in qdisc_create_dflt()")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_netem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -943,11 +943,11 @@ static int netem_init(struct Qdisc *sch,
struct netem_sched_data *q = qdisc_priv(sch);
int ret;
+ qdisc_watchdog_init(&q->watchdog, sch);
+
if (!opt)
return -EINVAL;
- qdisc_watchdog_init(&q->watchdog, sch);
-
q->loss_model = CLG_RANDOM;
ret = netem_change(sch, opt);
if (ret)
next prev parent reply other threads:[~2018-09-13 13:34 UTC|newest]
Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-13 13:30 [PATCH 4.4 00/60] 4.4.156-stable review Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 01/60] x86/speculation/l1tf: Fix up pte->pfn conversion for PAE Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 02/60] staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 03/60] net: bcmgenet: use MAC link status for fixed phy Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 04/60] qlge: Fix netdev features configuration Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 05/60] tcp: do not restart timewait timer on rst reception Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 06/60] vti6: remove !skb->ignore_df check from vti6_xmit() Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 07/60] cifs: check if SMB2 PDU size has been padded and suppress the warning Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 08/60] hfsplus: dont return 0 when fill_super() failed Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 09/60] hfs: prevent crash on exit from failed search Greg Kroah-Hartman
2018-09-13 13:30 ` Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 10/60] fork: dont copy inconsistent signal handler state to child Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 11/60] reiserfs: change j_timestamp type to time64_t Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 12/60] hfsplus: fix NULL dereference in hfsplus_lookup() Greg Kroah-Hartman
2018-09-13 13:30 ` Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 13/60] fat: validate ->i_start before using Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 14/60] scripts: modpost: check memory allocation results Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 15/60] mm/fadvise.c: fix signed overflow UBSAN complaint Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 16/60] fs/dcache.c: fix kmemcheck splat at take_dentry_name_snapshot() Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 17/60] ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest() Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 18/60] mfd: sm501: Set coherent_dma_mask when creating subdevices Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 19/60] platform/x86: asus-nb-wmi: Add keymap entry for lid flip action on UX360 Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 20/60] irqchip/bcm7038-l1: Hide cpu offline callback when building for !SMP Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 21/60] net/9p: fix error path of p9_virtio_probe Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 22/60] powerpc: Fix size calculation using resource_size() Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 23/60] s390/dasd: fix hanging offline processing due to canceled worker Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 24/60] scsi: aic94xx: fix an error code in aic94xx_init() Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 25/60] PCI: mvebu: Fix I/O space end address calculation Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 26/60] dm kcopyd: avoid softlockup in run_complete_job Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 27/60] staging: comedi: ni_mio_common: fix subdevice flags for PFI subdevice Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 28/60] selftests/powerpc: Kill child processes on SIGINT Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 29/60] smb3: fix reset of bytes read and written stats Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 30/60] SMB3: Number of requests sent should be displayed for SMB3 not just CIFS Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 31/60] powerpc/pseries: Avoid using the size greater than RTAS_ERROR_LOG_MAX Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 32/60] btrfs: replace: Reset on-disk dev stats value after replace Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 33/60] btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 34/60] btrfs: Dont remove block group that still has pinned down bytes Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 35/60] debugobjects: Make stack check warning more informative Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 36/60] x86/pae: use 64 bit atomic xchg function in native_ptep_get_and_clear Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 37/60] kbuild: make missing $DEPMOD a Warning instead of an Error Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 38/60] irda: Fix memory leak caused by repeated binds of irda socket Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 39/60] irda: Only insert new objects into the global database via setsockopt Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 40/60] Revert "ARM: imx_v6_v7_defconfig: Select ULPI support" Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 41/60] enic: do not call enic_change_mtu in enic_probe Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 42/60] Fixes: Commit cdbf92675fad ("mm: numa: avoid waiting on freed migrated pages") Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 43/60] genirq: Delay incrementing interrupt count if its disabled/pending Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 44/60] irqchip/gic-v3-its: Recompute the number of pages on page size change Greg Kroah-Hartman
2018-09-13 13:30 ` Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 45/60] irqchip/gicv3-its: Fix memory leak in its_free_tables() Greg Kroah-Hartman
2018-09-13 13:30 ` Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 46/60] irqchip/gicv3-its: Avoid cache flush beyond ITS_BASERn memory size Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 47/60] irqchip/gic-v3: Add missing barrier to 32bit version of gic_read_iar() Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 48/60] irqchip/gic: Make interrupt ID 1020 invalid Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 49/60] ovl: rename is_merge to is_lowest Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 50/60] ovl: override creds with the ones from the superblock mounter Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 51/60] ovl: proper cleanup of workdir Greg Kroah-Hartman
2018-09-13 13:30 ` [PATCH 4.4 52/60] sch_htb: fix crash on init failure Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.4 53/60] sch_multiq: fix double free " Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.4 54/60] sch_hhf: fix null pointer dereference " Greg Kroah-Hartman
2018-09-13 13:31 ` Greg Kroah-Hartman [this message]
2018-09-13 13:31 ` [PATCH 4.4 56/60] sch_tbf: fix two null pointer dereferences " Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.4 57/60] mei: me: allow runtime pm for platform with D0i3 Greg Kroah-Hartman
2018-09-13 13:31 ` Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.4 58/60] s390/lib: use expoline for all bcr instructions Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.4 59/60] ASoC: wm8994: Fix missing break in switch Greg Kroah-Hartman
2018-09-13 13:31 ` [PATCH 4.4 60/60] btrfs: use correct compare function of dirty_metadata_bytes Greg Kroah-Hartman
2018-09-13 19:07 ` [PATCH 4.4 00/60] 4.4.156-stable review Nathan Chancellor
2018-09-14 12:49 ` Naresh Kamboju
2018-09-14 14:52 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180913131748.089940965@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=amit.pundir@linaro.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=nikolay@cumulusnetworks.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.