From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
syzbot <syzkaller@googlegroups.com>,
Mahesh Bandewar <maheshb@google.com>,
Jakub Kicinski <jakub.kicinski@netronome.com>
Subject: [PATCH 4.9 53/62] bonding: fix potential NULL deref in bond_update_slave_arr
Date: Mon, 4 Nov 2019 22:45:15 +0100 [thread overview]
Message-ID: <20191104211954.599976834@linuxfoundation.org> (raw)
In-Reply-To: <20191104211901.387893698@linuxfoundation.org>
From: Eric Dumazet <edumazet@google.com>
commit a7137534b597b7c303203e6bc3ed87e87a273bb8 upstream.
syzbot got a NULL dereference in bond_update_slave_arr() [1],
happening after a failure to allocate bond->slave_arr
A workqueue (bond_slave_arr_handler) is supposed to retry
the allocation later, but if the slave is removed before
the workqueue had a chance to complete, bond->slave_arr
can still be NULL.
[1]
Failed to build slave-array.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bond_update_slave_arr.cold+0xc6/0x198 drivers/net/bonding/bond_main.c:4039
RSP: 0018:ffff88018fe33678 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000290b000
RDX: 0000000000000000 RSI: ffffffff82b63037 RDI: ffff88019745ea20
RBP: ffff88018fe33760 R08: ffff880170754280 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88019745ea00 R14: 0000000000000000 R15: ffff88018fe338b0
FS: 00007febd837d700(0000) GS:ffff8801dad00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004540a0 CR3: 00000001c242e005 CR4: 00000000001626f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
[<ffffffff82b5b45e>] __bond_release_one+0x43e/0x500 drivers/net/bonding/bond_main.c:1923
[<ffffffff82b5b966>] bond_release drivers/net/bonding/bond_main.c:2039 [inline]
[<ffffffff82b5b966>] bond_do_ioctl+0x416/0x870 drivers/net/bonding/bond_main.c:3562
[<ffffffff83ae25f4>] dev_ifsioc+0x6f4/0x940 net/core/dev_ioctl.c:328
[<ffffffff83ae2e58>] dev_ioctl+0x1b8/0xc70 net/core/dev_ioctl.c:495
[<ffffffff83995ffd>] sock_do_ioctl+0x1bd/0x300 net/socket.c:1088
[<ffffffff83996a80>] sock_ioctl+0x300/0x5d0 net/socket.c:1196
[<ffffffff81b124db>] vfs_ioctl fs/ioctl.c:47 [inline]
[<ffffffff81b124db>] file_ioctl fs/ioctl.c:501 [inline]
[<ffffffff81b124db>] do_vfs_ioctl+0xacb/0x1300 fs/ioctl.c:688
[<ffffffff81b12dc6>] SYSC_ioctl fs/ioctl.c:705 [inline]
[<ffffffff81b12dc6>] SyS_ioctl+0xb6/0xe0 fs/ioctl.c:696
[<ffffffff8101ccc8>] do_syscall_64+0x528/0x770 arch/x86/entry/common.c:305
[<ffffffff84400091>] entry_SYSCALL_64_after_hwframe+0x42/0xb7
Fixes: ee6377147409 ("bonding: Simplify the xmit function for modes that use xmit_hash")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/bonding/bond_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3963,7 +3963,7 @@ out:
* this to-be-skipped slave to send a packet out.
*/
old_arr = rtnl_dereference(bond->slave_arr);
- for (idx = 0; idx < old_arr->count; idx++) {
+ for (idx = 0; old_arr != NULL && idx < old_arr->count; idx++) {
if (skipslave == old_arr->arr[idx]) {
old_arr->arr[idx] =
old_arr->arr[old_arr->count-1];
next prev parent reply other threads:[~2019-11-04 22:25 UTC|newest]
Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-04 21:44 [PATCH 4.9 00/62] 4.9.199-stable review Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 01/62] dm snapshot: use mutex instead of rw_semaphore Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 02/62] dm snapshot: introduce account_start_copy() and account_end_copy() Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 03/62] dm snapshot: rework COW throttling to fix deadlock Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 04/62] dm: Use kzalloc for all structs with embedded biosets/mempools Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 05/62] sc16is7xx: Fix for "Unexpected interrupt: 8" Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 06/62] HID: i2c-hid: add Direkt-Tek DTLAPY133-1 to descriptor override Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 07/62] x86/cpu: Add Atom Tremont (Jacobsville) Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 08/62] HID: i2c-hid: Add Odys Winbook 13 to descriptor override Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 09/62] scripts/setlocalversion: Improve -dirty check with git-status --no-optional-locks Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 10/62] usb: handle warm-reset port requests on hub resume Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 11/62] rtc: pcf8523: set xtal load capacitance from DT Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 12/62] exec: load_script: Do not exec truncated interpreter path Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 13/62] iio: fix center temperature of bmc150-accel-core Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 14/62] perf map: Fix overlapped map handling Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 15/62] perf jevents: Fix period for Intel fixed counters Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 16/62] staging: rtl8188eu: fix null dereference when kzalloc fails Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 17/62] RDMA/iwcm: Fix a lock inversion issue Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 18/62] gpio: max77620: Use correct unit for debounce times Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 19/62] fs: cifs: mute -Wunused-const-variable message Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 20/62] serial: mctrl_gpio: Check for NULL pointer Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 21/62] efi/cper: Fix endianness of PCIe class code Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 22/62] efi/x86: Do not clean dummy variable in kexec path Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 23/62] ocfs2: clear zero in unaligned direct IO Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 24/62] fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry() Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 25/62] fs: ocfs2: fix a possible null-pointer dereference in ocfs2_write_end_nolock() Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 26/62] fs: ocfs2: fix a possible null-pointer dereference in ocfs2_info_scan_inode_alloc() Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 27/62] MIPS: fw: sni: Fix out of bounds init of o32 stack Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 28/62] NFSv4: Fix leak of clp->cl_acceptor string Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 29/62] s390/uaccess: avoid (false positive) compiler warnings Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 30/62] tracing: Initialize iter->seq after zeroing in tracing_read_pipe() Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 31/62] USB: legousbtower: fix a signedness bug in tower_probe() Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 32/62] thunderbolt: Use 32-bit writes when writing ring producer/consumer Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 33/62] ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe() Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 34/62] fuse: flush dirty data/metadata before non-truncate setattr Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 35/62] fuse: truncate pending writes on O_TRUNC Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 36/62] ALSA: bebob: Fix prototype of helper function to return negative value Greg Kroah-Hartman
2019-11-04 21:44 ` [PATCH 4.9 37/62] UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments") Greg Kroah-Hartman
2019-11-05 14:31 ` Oliver Neukum
2019-11-06 0:11 ` Sasha Levin
2019-11-06 7:45 ` Oliver Neukum
2019-11-06 11:17 ` Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 38/62] USB: gadget: Reject endpoints with 0 maxpacket value Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 39/62] usb-storage: Revert commit 747668dbc061 ("usb-storage: Set virt_boundary_mask to avoid SG overflows") Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 40/62] USB: ldusb: fix ring-buffer locking Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 41/62] USB: ldusb: fix control-message timeout Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 42/62] USB: serial: whiteheat: fix potential slab corruption Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 43/62] USB: serial: whiteheat: fix line-speed endianness Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 44/62] HID: i2c-hid: add Trekstor Primebook C11B to descriptor override Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 45/62] HID: Fix assumption that devices have inputs Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 46/62] HID: fix error message in hid_open_report() Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 47/62] nl80211: fix validation of mesh path nexthop Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 48/62] s390/cmm: fix information leak in cmm_timeout_handler() Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 49/62] rtlwifi: Fix potential overflow on P2P code Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 50/62] dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 51/62] llc: fix sk_buff leak in llc_sap_state_process() Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 52/62] llc: fix sk_buff leak in llc_conn_service() Greg Kroah-Hartman
2019-11-04 21:45 ` Greg Kroah-Hartman [this message]
2019-11-04 21:45 ` [PATCH 4.9 54/62] net: usb: sr9800: fix uninitialized local variable Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 55/62] sch_netem: fix rcu splat in netem_enqueue() Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 56/62] sctp: fix the issue that flags are ignored when using kernel_connect Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 57/62] sctp: not bind the socket in sctp_connect Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 58/62] xfs: Correctly invert xfs_buftarg LRU isolation logic Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 59/62] ALSA: timer: Follow standard EXPORT_SYMBOL() declarations Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 60/62] ALSA: timer: Limit max instances per timer Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 61/62] ALSA: timer: Simplify error path in snd_timer_open() Greg Kroah-Hartman
2019-11-04 21:45 ` [PATCH 4.9 62/62] ALSA: timer: Fix mutex deadlock at releasing card Greg Kroah-Hartman
2019-11-05 5:56 ` [PATCH 4.9 00/62] 4.9.199-stable review kernelci.org bot
2019-11-05 7:05 ` Naresh Kamboju
2019-11-05 14:24 ` Guenter Roeck
2019-11-05 17:01 ` shuah
2019-11-05 23:37 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191104211954.599976834@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=edumazet@google.com \
--cc=jakub.kicinski@netronome.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maheshb@google.com \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox