From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Eric Dumazet <edumazet@google.com>,
syzbot <syzkaller@googlegroups.com>,
Mahesh Bandewar <maheshb@google.com>,
Jakub Kicinski <jakub.kicinski@netronome.com>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 29/59] bonding: fix potential NULL deref in bond_update_slave_arr
Date: Sat, 26 Oct 2019 09:18:40 -0400 [thread overview]
Message-ID: <20191026131910.3435-29-sashal@kernel.org> (raw)
In-Reply-To: <20191026131910.3435-1-sashal@kernel.org>
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit a7137534b597b7c303203e6bc3ed87e87a273bb8 ]
syzbot got a NULL dereference in bond_update_slave_arr() [1],
happening after a failure to allocate bond->slave_arr
A workqueue (bond_slave_arr_handler) is supposed to retry
the allocation later, but if the slave is removed before
the workqueue had a chance to complete, bond->slave_arr
can still be NULL.
[1]
Failed to build slave-array.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bond_update_slave_arr.cold+0xc6/0x198 drivers/net/bonding/bond_main.c:4039
RSP: 0018:ffff88018fe33678 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000290b000
RDX: 0000000000000000 RSI: ffffffff82b63037 RDI: ffff88019745ea20
RBP: ffff88018fe33760 R08: ffff880170754280 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88019745ea00 R14: 0000000000000000 R15: ffff88018fe338b0
FS: 00007febd837d700(0000) GS:ffff8801dad00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004540a0 CR3: 00000001c242e005 CR4: 00000000001626f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
[<ffffffff82b5b45e>] __bond_release_one+0x43e/0x500 drivers/net/bonding/bond_main.c:1923
[<ffffffff82b5b966>] bond_release drivers/net/bonding/bond_main.c:2039 [inline]
[<ffffffff82b5b966>] bond_do_ioctl+0x416/0x870 drivers/net/bonding/bond_main.c:3562
[<ffffffff83ae25f4>] dev_ifsioc+0x6f4/0x940 net/core/dev_ioctl.c:328
[<ffffffff83ae2e58>] dev_ioctl+0x1b8/0xc70 net/core/dev_ioctl.c:495
[<ffffffff83995ffd>] sock_do_ioctl+0x1bd/0x300 net/socket.c:1088
[<ffffffff83996a80>] sock_ioctl+0x300/0x5d0 net/socket.c:1196
[<ffffffff81b124db>] vfs_ioctl fs/ioctl.c:47 [inline]
[<ffffffff81b124db>] file_ioctl fs/ioctl.c:501 [inline]
[<ffffffff81b124db>] do_vfs_ioctl+0xacb/0x1300 fs/ioctl.c:688
[<ffffffff81b12dc6>] SYSC_ioctl fs/ioctl.c:705 [inline]
[<ffffffff81b12dc6>] SyS_ioctl+0xb6/0xe0 fs/ioctl.c:696
[<ffffffff8101ccc8>] do_syscall_64+0x528/0x770 arch/x86/entry/common.c:305
[<ffffffff84400091>] entry_SYSCALL_64_after_hwframe+0x42/0xb7
Fixes: ee6377147409 ("bonding: Simplify the xmit function for modes that use xmit_hash")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 0d2392c4b625a..2804e2d1ae5e5 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4033,7 +4033,7 @@ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave)
* this to-be-skipped slave to send a packet out.
*/
old_arr = rtnl_dereference(bond->slave_arr);
- for (idx = 0; idx < old_arr->count; idx++) {
+ for (idx = 0; old_arr != NULL && idx < old_arr->count; idx++) {
if (skipslave == old_arr->arr[idx]) {
old_arr->arr[idx] =
old_arr->arr[old_arr->count-1];
--
2.20.1
next prev parent reply other threads:[~2019-10-26 13:20 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-26 13:18 [PATCH AUTOSEL 4.19 01/59] tools: bpf: Use !building_out_of_srctree to determine srctree Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 03/59] mac80211_hwsim: fix incorrect dev_alloc_name failure goto Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 06/59] net: dsa: b53: Do not clear existing mirrored port mask Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 07/59] net: stmmac: gmac4+: Not all Unicast addresses may be available Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 10/59] rxrpc: Fix call ref leak Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 11/59] rxrpc: Fix trace-after-put looking at the put peer record Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 12/59] rxrpc: Fix trace-after-put looking at the put connection record Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 13/59] rxrpc: Fix trace-after-put looking at the put call record Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 14/59] rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 15/59] mac80211: accept deauth frames in IBSS mode Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 16/59] mac80211: fix scan when operating on DFS channels in ETSI domains Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 17/59] llc: fix sk_buff leak in llc_sap_state_process() Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 18/59] llc: fix sk_buff leak in llc_conn_service() Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 19/59] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 20/59] llc: fix sk_buff refcounting in llc_conn_state_process() Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 21/59] NFC: pn533: fix use-after-free and memleaks Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 22/59] ip6erspan: remove the incorrect mtu limit for ip6erspan Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 23/59] iwlwifi: dbg_ini: fix memory leak in alloc_sgtable Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 24/59] iwlwifi: pcie: fix memory leaks in iwl_pcie_ctxt_info_gen3_init Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 25/59] iwlwifi: exclude GEO SAR support for 3168 Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 27/59] net: stmmac: fix length of PTP clock's name string Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 28/59] net: stmmac: fix disabling flexible PPS output Sasha Levin
2019-10-26 13:18 ` Sasha Levin [this message]
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 32/59] act_mirred: Fix mirred_init_module error handling Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 33/59] net: usb: qmi_wwan: add Telit 0x1050 composition Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 34/59] net: avoid possible false sharing in sk_leave_memory_pressure() Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 35/59] net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 36/59] net/smc: receive returns without data Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 37/59] net/smc: receive pending data after RCV_SHUTDOWN Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 39/59] vhost/test: stop device before reset Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 40/59] net/ibmvnic: Fix EOI when running in XIVE mode Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 47/59] net: i82596: fix dma_alloc_attr for sni_82596 Sasha Levin
2019-10-26 13:18 ` [PATCH AUTOSEL 4.19 48/59] net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 Sasha Levin
2019-10-26 13:19 ` [PATCH AUTOSEL 4.19 49/59] net: usb: sr9800: fix uninitialized local variable Sasha Levin
2019-10-26 13:19 ` [PATCH AUTOSEL 4.19 51/59] net: stmmac: disable/enable ptp_ref_clk in suspend/resume flow Sasha Levin
2019-10-26 13:19 ` [PATCH AUTOSEL 4.19 52/59] usb: hso: obey DMA rules in tiocmget Sasha Levin
2019-10-26 13:19 ` [PATCH AUTOSEL 4.19 54/59] net: stmmac: fix argument to stmmac_pcs_ctrl_ane() Sasha Levin
2019-10-26 13:19 ` [PATCH AUTOSEL 4.19 56/59] net: usb: lan78xx: Connect PHY before registering MAC Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191026131910.3435-29-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=edumazet@google.com \
--cc=jakub.kicinski@netronome.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maheshb@google.com \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).