[PATCH net] udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n

[Xiang Mei <xmei5@asu.edu>]

When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0
(success) without actually creating a socket. Callers such as
fou_create() then proceed to dereference the uninitialized socket
pointer, resulting in a NULL pointer dereference.

Return -EPFNOSUPPORT instead, so callers correctly take their error
paths. There is only one caller of the vulnerable function and only
privileged users can trigger it.

The captured NULL deref crash:
[    0.489638] BUG: kernel NULL pointer dereference, address: 0000000000000018
[    0.489962] #PF: supervisor read access in kernel mode
[    0.490193] #PF: error_code(0x0000) - not-present page
[    0.490435] PGD 102a11067 P4D 102a11067 PUD 102a12067 PMD 0
[    0.490706] Oops: Oops: 0000 [#1] SMP NOPTI
[    0.490905] CPU: 0 UID: 0 PID: 140 Comm: exploit Not tainted 7.0.0-rc3+ #2 PREEMPTLAZY
[    0.491266] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[    0.491786] RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)
[    0.492009] Code: c5 48 85 c0 0f 84 04 02 00 00 48 8b 34 24 0f b7 44 24 1c 4c 8d 44 24 30 b9 07 00 00 00 0f b7 54 24 0c 4c 89 c7 48 89 6c 24 28 <4c> 8b 6e 18 66 89 45 0a 0f b6 44 24 10 66 89 55 0e 48 89 75 00 88
All code
========
   0:	c5 48 85             	(bad)
   3:	c0 0f 84             	rorb   $0x84,(%rdi)
   6:	04 02                	add    $0x2,%al
   8:	00 00                	add    %al,(%rax)
   a:	48 8b 34 24          	mov    (%rsp),%rsi
   e:	0f b7 44 24 1c       	movzwl 0x1c(%rsp),%eax
  13:	4c 8d 44 24 30       	lea    0x30(%rsp),%r8
  18:	b9 07 00 00 00       	mov    $0x7,%ecx
  1d:	0f b7 54 24 0c       	movzwl 0xc(%rsp),%edx
  22:	4c 89 c7             	mov    %r8,%rdi
  25:	48 89 6c 24 28       	mov    %rbp,0x28(%rsp)
  2a:*	4c 8b 6e 18          	mov    0x18(%rsi),%r13		<-- trapping instruction
  2e:	66 89 45 0a          	mov    %ax,0xa(%rbp)
  32:	0f b6 44 24 10       	movzbl 0x10(%rsp),%eax
  37:	66 89 55 0e          	mov    %dx,0xe(%rbp)
  3b:	48 89 75 00          	mov    %rsi,0x0(%rbp)
  3f:	88                   	.byte 0x88

Code starting with the faulting instruction
===========================================
   0:	4c 8b 6e 18          	mov    0x18(%rsi),%r13
   4:	66 89 45 0a          	mov    %ax,0xa(%rbp)
   8:	0f b6 44 24 10       	movzbl 0x10(%rsp),%eax
   d:	66 89 55 0e          	mov    %dx,0xe(%rbp)
  11:	48 89 75 00          	mov    %rsi,0x0(%rbp)
  15:	88                   	.byte 0x88
[    0.492846] RSP: 0018:ffffc900004a7a68 EFLAGS: 00010282
[    0.493095] RAX: 0000000000003201 RBX: 0000000000000000 RCX: 0000000000000007
[    0.493419] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900004a7a98
[    0.493754] RBP: ffff888102882180 R08: ffffc900004a7a98 R09: ffff888102882180
[    0.494084] R10: 0000000000000001 R11: 0000000000000000 R12: ffffc900004a7a90
[    0.494399] R13: ffff8881008f7a00 R14: ffffc900004a7b20 R15: 0000000000000000
[    0.494744] FS:  0000000021ac2380(0000) GS:ffff888196dab000(0000) knlGS:0000000000000000
[    0.495126] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    0.495385] CR2: 0000000000000018 CR3: 0000000102a0a004 CR4: 0000000000772ef0
[    0.495723] PKRU: 55555554
[    0.495861] Call Trace:
[    0.495990]  <TASK>
[    0.496101]  genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)
[    0.496362]  genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)
[    0.496530]  ? __pfx_fou_nl_add_doit (net/ipv4/fou_core.c:755)
[    0.496757]  ? __pfx_genl_rcv_msg (net/netlink/genetlink.c:1200)
[    0.496962]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)
[    0.497153]  genl_rcv (net/netlink/genetlink.c:1219)
[    0.497299]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
[    0.497476]  netlink_sendmsg (net/netlink/af_netlink.c:1894)
[    0.497669]  __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))
[    0.497856]  __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))
[    0.498033]  __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))
[    0.498212]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
[    0.498381]  entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)
[    0.498610] RIP: 0033:0x41ce17
[    0.498763] Code: ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 00 f3 0f 1e fa 80 3d 4d 62 09 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 69 c3 55 48 89 e5 53 48 83 ec 38 44 89 4d d0
All code
========
   0:	ff                   	(bad)
   1:	ff f7                	push   %rdi
   3:	d8 64 89 02          	fsubs  0x2(%rcx,%rcx,4)
   7:	48 c7 c0 ff ff ff ff 	mov    $0xffffffffffffffff,%rax
   e:	eb b5                	jmp    0xffffffffffffffc5
  10:	0f 1f 00             	nopl   (%rax)
  13:	f3 0f 1e fa          	endbr64
  17:	80 3d 4d 62 09 00 00 	cmpb   $0x0,0x9624d(%rip)        # 0x9626b
  1e:	41 89 ca             	mov    %ecx,%r10d
  21:	74 10                	je     0x33
  23:	b8 2c 00 00 00       	mov    $0x2c,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
  30:	77 69                	ja     0x9b
  32:	c3                   	ret
  33:	55                   	push   %rbp
  34:	48 89 e5             	mov    %rsp,%rbp
  37:	53                   	push   %rbx
  38:	48 83 ec 38          	sub    $0x38,%rsp
  3c:	44 89 4d d0          	mov    %r9d,-0x30(%rbp)

Code starting with the faulting instruction
===========================================
   0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
   6:	77 69                	ja     0x71
   8:	c3                   	ret
   9:	55                   	push   %rbp
   a:	48 89 e5             	mov    %rsp,%rbp
   d:	53                   	push   %rbx
   e:	48 83 ec 38          	sub    $0x38,%rsp
  12:	44 89 4d d0          	mov    %r9d,-0x30(%rbp)
[    0.499591] RSP: 002b:00007ffd7730d918 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[    0.499950] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000041ce17
[    0.500272] RDX: 000000000000002c RSI: 00000000004b3b20 RDI: 0000000000000003
[    0.500585] RBP: 00007ffd7730d970 R08: 00007ffd7730d94c R09: 000000000000000c
[    0.500923] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffd7730da88
[    0.501246] R13: 00007ffd7730da98 R14: 00000000004ad868 R15: 0000000000000001
[    0.501559]  </TASK>

Fixes: fd384412e199b ("udp_tunnel: Seperate ipv6 functions into its own file.")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
 include/net/udp_tunnel.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h
index d9c6d04bb3b5..fc1fc43345b5 100644
--- a/include/net/udp_tunnel.h
+++ b/include/net/udp_tunnel.h
@@ -52,7 +52,7 @@ int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
 static inline int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
 				   struct socket **sockp)
 {
-	return 0;
+	return -EPFNOSUPPORT;
 }
 #endif
 
-- 
2.43.0