From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>,
Tyler Hicks <tyhicks@canonical.com>,
Eric Dumazet <eric.dumazet@gmail.com>,
Christoph Paasch <cpaasch@apple.com>,
Eric Dumazet <edumazet@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 06/51] net: Prevent invalid access to skb->prev in __qdisc_drop_all
Date: Fri, 14 Dec 2018 13:00:08 +0100 [thread overview]
Message-ID: <20181214115713.914283096@linuxfoundation.org> (raw)
In-Reply-To: <20181214115713.244259772@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <cpaasch@apple.com>
[ Upstream commit 9410d386d0a829ace9558336263086c2fbbe8aed ]
__qdisc_drop_all() accesses skb->prev to get to the tail of the
segment-list.
With commit 68d2f84a1368 ("net: gro: properly remove skb from list")
the skb-list handling has been changed to set skb->next to NULL and set
the list-poison on skb->prev.
With that change, __qdisc_drop_all() will panic when it tries to
dereference skb->prev.
Since commit 992cba7e276d ("net: Add and use skb_list_del_init().")
__list_del_entry is used, leaving skb->prev unchanged (thus,
pointing to the list-head if it's the first skb of the list).
This will make __qdisc_drop_all modify the next-pointer of the list-head
and result in a panic later on:
[ 34.501053] general protection fault: 0000 [#1] SMP KASAN PTI
[ 34.501968] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.20.0-rc2.mptcp #108
[ 34.502887] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011
[ 34.504074] RIP: 0010:dev_gro_receive+0x343/0x1f90
[ 34.504751] Code: e0 48 c1 e8 03 42 80 3c 30 00 0f 85 4a 1c 00 00 4d 8b 24 24 4c 39 65 d0 0f 84 0a 04 00 00 49 8d 7c 24 38 48 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 04
[ 34.507060] RSP: 0018:ffff8883af507930 EFLAGS: 00010202
[ 34.507761] RAX: 0000000000000007 RBX: ffff8883970b2c80 RCX: 1ffff11072e165a6
[ 34.508640] RDX: 1ffff11075867008 RSI: ffff8883ac338040 RDI: 0000000000000038
[ 34.509493] RBP: ffff8883af5079d0 R08: ffff8883970b2d40 R09: 0000000000000062
[ 34.510346] R10: 0000000000000034 R11: 0000000000000000 R12: 0000000000000000
[ 34.511215] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8883ac338008
[ 34.512082] FS: 0000000000000000(0000) GS:ffff8883af500000(0000) knlGS:0000000000000000
[ 34.513036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 34.513741] CR2: 000055ccc3e9d020 CR3: 00000003abf32000 CR4: 00000000000006e0
[ 34.514593] Call Trace:
[ 34.514893] <IRQ>
[ 34.515157] napi_gro_receive+0x93/0x150
[ 34.515632] receive_buf+0x893/0x3700
[ 34.516094] ? __netif_receive_skb+0x1f/0x1a0
[ 34.516629] ? virtnet_probe+0x1b40/0x1b40
[ 34.517153] ? __stable_node_chain+0x4d0/0x850
[ 34.517684] ? kfree+0x9a/0x180
[ 34.518067] ? __kasan_slab_free+0x171/0x190
[ 34.518582] ? detach_buf+0x1df/0x650
[ 34.519061] ? lapic_next_event+0x5a/0x90
[ 34.519539] ? virtqueue_get_buf_ctx+0x280/0x7f0
[ 34.520093] virtnet_poll+0x2df/0xd60
[ 34.520533] ? receive_buf+0x3700/0x3700
[ 34.521027] ? qdisc_watchdog_schedule_ns+0xd5/0x140
[ 34.521631] ? htb_dequeue+0x1817/0x25f0
[ 34.522107] ? sch_direct_xmit+0x142/0xf30
[ 34.522595] ? virtqueue_napi_schedule+0x26/0x30
[ 34.523155] net_rx_action+0x2f6/0xc50
[ 34.523601] ? napi_complete_done+0x2f0/0x2f0
[ 34.524126] ? kasan_check_read+0x11/0x20
[ 34.524608] ? _raw_spin_lock+0x7d/0xd0
[ 34.525070] ? _raw_spin_lock_bh+0xd0/0xd0
[ 34.525563] ? kvm_guest_apic_eoi_write+0x6b/0x80
[ 34.526130] ? apic_ack_irq+0x9e/0xe0
[ 34.526567] __do_softirq+0x188/0x4b5
[ 34.527015] irq_exit+0x151/0x180
[ 34.527417] do_IRQ+0xdb/0x150
[ 34.527783] common_interrupt+0xf/0xf
[ 34.528223] </IRQ>
This patch makes sure that skb->prev is set to NULL when entering
netem_enqueue.
Cc: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
Cc: Tyler Hicks <tyhicks@canonical.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: 68d2f84a1368 ("net: gro: properly remove skb from list")
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_netem.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -442,6 +442,9 @@ static int netem_enqueue(struct sk_buff
int count = 1;
int rc = NET_XMIT_SUCCESS;
+ /* Do not fool qdisc_drop_all() */
+ skb->prev = NULL;
+
/* Random duplication */
if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor))
++count;
next prev parent reply other threads:[~2018-12-14 12:26 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-14 12:00 [PATCH 4.9 00/51] 4.9.146-stable review Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 01/51] ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes Greg Kroah-Hartman
2018-12-16 9:56 ` jwiesner
2018-12-17 8:37 ` Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 02/51] ipv6: Check available headroom in ip6_xmit() even without options Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 03/51] net: 8139cp: fix a BUG triggered by changing mtu with network traffic Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 04/51] net/mlx4_core: Correctly set PFC param if global pause is turned off Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 05/51] net: phy: dont allow __set_phy_supported to add unsupported modes Greg Kroah-Hartman
2018-12-14 12:00 ` Greg Kroah-Hartman [this message]
2018-12-14 12:00 ` [PATCH 4.9 07/51] rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 08/51] tcp: fix NULL ref in tail loss probe Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 09/51] tun: forbid iface creation with rtnl ops Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 10/51] neighbour: Avoid writing before skb->head in neigh_hh_output() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 11/51] ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 12/51] ARM: dts: logicpd-somlv: Fix interrupt on mmc3_dat1 Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 13/51] ARM: OMAP1: ams-delta: Fix possible use of uninitialized field Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 14/51] sysv: return err instead of 0 in __sysv_write_inode Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 15/51] selftests: add script to stress-test nft packet path vs. control plane Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 16/51] s390/cpum_cf: Reject request for sampling in event initialization Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 17/51] hwmon: (ina2xx) Fix current value calculation Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 18/51] ASoC: omap-abe-twl6040: Fix missing audio card caused by deferred probing Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 19/51] ASoC: dapm: Recalculate audio map forcely when card instantiated Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 20/51] hwmon: (w83795) temp4_type has writable permission Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 21/51] objtool: Fix double-free in .cold detection error path Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 22/51] objtool: Fix segfault in .cold detection with -ffunction-sections Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 23/51] Btrfs: send, fix infinite loop due to directory rename dependencies Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 24/51] RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 25/51] ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 26/51] ASoC: omap-dmic: Add pm_qos handling to avoid overruns " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 27/51] exportfs: do not read dentry after free Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 28/51] bpf: fix check of allowed specifiers in bpf_trace_printk Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 29/51] ipvs: call ip_vs_dst_notifier earlier than ipv6_dev_notf Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 30/51] USB: omap_udc: use devm_request_irq() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 31/51] USB: omap_udc: fix crashes on probe error and module removal Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 32/51] USB: omap_udc: fix omap_udc_start() on 15xx machines Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 33/51] USB: omap_udc: fix USB gadget functionality on Palm Tungsten E Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 34/51] KVM: x86: fix empty-body warnings Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 35/51] x86/kvm/vmx: fix old-style function declaration Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 36/51] net: thunderx: fix NULL pointer dereference in nic_remove Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 37/51] cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 38/51] igb: fix uninitialized variables Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 39/51] ixgbe: recognize 1000BaseLX SFP modules as 1Gbps Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 40/51] net: hisilicon: remove unexpected free_netdev Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 41/51] drm/ast: fixed reading monitor EDID not stable issue Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 42/51] xen: xlate_mmu: add missing header to fix W=1 warning Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 43/51] fscache: fix race between enablement and dropping of object Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 44/51] fscache, cachefiles: remove redundant variable cache Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 45/51] ocfs2: fix deadlock caused by ocfs2_defrag_extent() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 46/51] hfs: do not free node before using Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 47/51] hfsplus: " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 48/51] debugobjects: avoid recursive calls with kmemleak Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 49/51] ocfs2: fix potential use after free Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 50/51] pstore: Convert console write to use ->write_buf Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.9 51/51] staging: speakup: Replace strncpy with memcpy Greg Kroah-Hartman
2018-12-14 15:53 ` [PATCH 4.9 00/51] 4.9.146-stable review kernelci.org bot
2018-12-14 20:13 ` shuah
2018-12-15 2:07 ` Guenter Roeck
2018-12-15 16:51 ` Dan Rue
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181214115713.914283096@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=bhole_prashant_q7@lab.ntt.co.jp \
--cc=cpaasch@apple.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tyhicks@canonical.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.