From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Oleksii Berezhniak <core@irc.lg.ua>,
Guillaume Nault <g.nault@alphalink.fr>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.2 11/54] ppp: dont override sk->sk_state in pppoe_flush_dev()
Date: Fri, 23 Oct 2015 10:44:47 -0700 [thread overview]
Message-ID: <20151023174519.440773290@linuxfoundation.org> (raw)
In-Reply-To: <20151023174519.086915553@linuxfoundation.org>
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
[ Upstream commit e6740165b8f7f06d8caee0fceab3fb9d790a6fed ]
Since commit 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release"),
pppoe_release() calls dev_put(po->pppoe_dev) if sk is in the
PPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to
PPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the
following oops:
[ 570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0
[ 570.142931] IP: [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[ 570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0
[ 570.144601] Oops: 0000 [#1] SMP
[ 570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio
[ 570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1
[ 570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[ 570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000
[ 570.144601] RIP: 0010:[<ffffffffa018c701>] [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[ 570.144601] RSP: 0018:ffff880036b63e08 EFLAGS: 00010202
[ 570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206
[ 570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20
[ 570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000
[ 570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780
[ 570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0
[ 570.144601] FS: 00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000
[ 570.144601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0
[ 570.144601] Stack:
[ 570.144601] ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0
[ 570.144601] ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008
[ 570.144601] ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5
[ 570.144601] Call Trace:
[ 570.144601] [<ffffffff812caabe>] sock_release+0x1a/0x75
[ 570.144601] [<ffffffff812cabad>] sock_close+0xd/0x11
[ 570.144601] [<ffffffff811347f5>] __fput+0xff/0x1a5
[ 570.144601] [<ffffffff811348cb>] ____fput+0x9/0xb
[ 570.144601] [<ffffffff81056682>] task_work_run+0x66/0x90
[ 570.144601] [<ffffffff8100189e>] prepare_exit_to_usermode+0x8c/0xa7
[ 570.144601] [<ffffffff81001a26>] syscall_return_slowpath+0x16d/0x19b
[ 570.144601] [<ffffffff813babb1>] int_ret_from_sys_call+0x25/0x9f
[ 570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00
[ 570.144601] RIP [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
[ 570.144601] RSP <ffff880036b63e08>
[ 570.144601] CR2: 00000000000004e0
[ 570.200518] ---[ end trace 46956baf17349563 ]---
pppoe_flush_dev() has no reason to override sk->sk_state with
PPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to
PPPOX_DEAD, which is the correct state given that sk is unbound and
po->pppoe_dev is NULL.
Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
Tested-by: Oleksii Berezhniak <core@irc.lg.ua>
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ppp/pppoe.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_d
if (po->pppoe_dev == dev &&
sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
pppox_unbind_sock(sk);
- sk->sk_state = PPPOX_ZOMBIE;
sk->sk_state_change(sk);
po->pppoe_dev = NULL;
dev_put(dev);
next prev parent reply other threads:[~2015-10-23 17:44 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-23 17:44 [PATCH 4.2 00/54] 4.2.5-stable review Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 01/54] net/ibm/emac: bump version numbers for correct work with ethtool Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 02/54] l2tp: protect tunnel->del_work by ref_count Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 03/54] af_unix: Convert the unix_sk macro to an inline function for type safety Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 04/54] af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 05/54] net/unix: fix logic about sk_peek_offset Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 06/54] skbuff: Fix skb checksum flag on skb pull Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 07/54] skbuff: Fix skb checksum partial check Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 08/54] net: dsa: fix preparation of a port STP update Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 09/54] inet: fix races in reqsk_queue_hash_req() Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 10/54] net: add pfmemalloc check in sk_add_backlog() Greg Kroah-Hartman
2015-10-23 17:44 ` Greg Kroah-Hartman [this message]
2015-10-23 17:44 ` [PATCH 4.2 12/54] inet: fix race in reqsk_queue_unlink() Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 13/54] bpf: fix panic in SO_GET_FILTER with native ebpf programs Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 14/54] ovs: do not allocate memory from offline numa node Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 15/54] act_mirred: clear sender cpu before sending to tx Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 16/54] bpf: clear sender_cpu before xmit Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 17/54] ipv6: Dont call with rt6_uncached_list_flush_dev Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 18/54] ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 19/54] tipc: move fragment importance field to new header position Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 20/54] netlink: Trim skb to alloc size to avoid MSG_TRUNC Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 21/54] drm: Fix locking for sysfs dpms file Greg Kroah-Hartman
2015-10-23 17:44 ` [PATCH 4.2 22/54] crypto: sparc - initialize blkcipher.ivsize Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 24/54] crypto: ahash - ensure statesize is non-zero Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 25/54] memcg: convert threshold to bytes Greg Kroah-Hartman
2015-10-24 5:46 ` Ben Hutchings
2015-10-25 16:32 ` Michal Hocko
2015-10-27 10:31 ` Michal Hocko
2015-10-23 17:45 ` [PATCH 4.2 26/54] btrfs: check unsupported filters in balance arguments Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 27/54] btrfs: fix use after free iterating extrefs Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 28/54] arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419 Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 29/54] ARM: ux500: simplify secondary CPU boot Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 30/54] nfsd/blocklayout: accept any minlength Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 31/54] mfd: max77843: Fix max77843_chg_init() return on error Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 32/54] i2c: rcar: enable RuntimePM before registering to the core Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 33/54] i2c: s3c2410: " Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 34/54] i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348 Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 35/54] i2c: designware-platdrv: enable RuntimePM before registering to the core Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 36/54] workqueue: make sure delayed work run in local cpu Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 38/54] KVM: x86: fix SMI to halted VCPU Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 39/54] KVM: x86: fix RSM into 64-bit protected mode Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 40/54] drm/qxl: fix framebuffer dirty rectangle tracking Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 41/54] drm/nouveau/fbcon: take runpm reference when userspace has an open fd Greg Kroah-Hartman
2015-10-24 6:12 ` Ben Hutchings
2015-10-23 17:45 ` [PATCH 4.2 42/54] drm/dp/mst: make mst i2c transfer code more robust Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 43/54] drm/radeon: attach tile property to mst connector Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 44/54] drm/radeon: add pm sysfs files late Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 45/54] drm/amdgpu: " Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 46/54] drm/amdgpu: fix num_crtc on CZ Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 49/54] dm thin: fix missing pool reference count decrement in pool_ctr error path Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 50/54] rbd: fix double free on rbd_dev->header_name Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 51/54] timekeeping: Increment clock_was_set_seq in timekeeping_init() Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 53/54] arm64: Fix THP protection change logic Greg Kroah-Hartman
2015-10-23 17:45 ` [PATCH 4.2 54/54] svcrdma: handle rdma read with a non-zero initial page offset Greg Kroah-Hartman
2015-10-23 21:54 ` [PATCH 4.2 00/54] 4.2.5-stable review Shuah Khan
2015-10-23 23:22 ` Greg Kroah-Hartman
2015-10-24 2:04 ` Guenter Roeck
2015-10-24 13:20 ` Greg Kroah-Hartman
[not found] ` <562ba038.8608b40a.39b42.ffffbb49@mx.google.com>
2015-10-24 15:18 ` Kevin Hilman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20151023174519.440773290@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=core@irc.lg.ua \
--cc=davem@davemloft.net \
--cc=g.nault@alphalink.fr \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).