From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, YueHaibing <yuehaibing@huawei.com>,
Hulk Robot <hulkci@huawei.com>,
Luis Chamberlain <mcgrof@kernel.org>,
Kees Cook <keescook@chromium.org>,
Alexey Dobriyan <adobriyan@gmail.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Al Viro <viro@zeniv.linux.org.uk>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.9 44/56] fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
Date: Mon, 1 Apr 2019 19:03:00 +0200 [thread overview]
Message-ID: <20190401170106.322158604@linuxfoundation.org> (raw)
In-Reply-To: <20190401170103.398401360@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <yuehaibing@huawei.com>
commit 23da9588037ecdd4901db76a5b79a42b529c4ec3 upstream.
Syzkaller reports:
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
CPU: 1 PID: 5373 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
RIP: 0010:put_links+0x101/0x440 fs/proc/proc_sysctl.c:1599
Code: 00 0f 85 3a 03 00 00 48 8b 43 38 48 89 44 24 20 48 83 c0 38 48 89 c2 48 89 44 24 28 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 fe 02 00 00 48 8b 74 24 20 48 c7 c7 60 2a 9d 91
RSP: 0018:ffff8881d828f238 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8881e01b1140 RCX: ffffffff8ee98267
RDX: 0000000000000007 RSI: ffffc90001479000 RDI: ffff8881e01b1178
RBP: dffffc0000000000 R08: ffffed103ee27259 R09: ffffed103ee27259
R10: 0000000000000001 R11: ffffed103ee27258 R12: fffffffffffffff4
R13: 0000000000000006 R14: ffff8881f59838c0 R15: dffffc0000000000
FS: 00007f072254f700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff8b286668 CR3: 00000001f0542002 CR4: 00000000007606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
drop_sysctl_table+0x152/0x9f0 fs/proc/proc_sysctl.c:1629
get_subdir fs/proc/proc_sysctl.c:1022 [inline]
__register_sysctl_table+0xd65/0x1090 fs/proc/proc_sysctl.c:1335
br_netfilter_init+0xbc/0x1000 [br_netfilter]
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x462e99
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f072254ec58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
RBP: 00007f072254ec70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f072254f6bc
R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
Modules linked in: br_netfilter(+) dvb_usb_dibusb_mc_common dib3000mc dibx000_common dvb_usb_dibusb_common dvb_usb_dw2102 dvb_usb classmate_laptop palmas_regulator cn videobuf2_v4l2 v4l2_common snd_soc_bd28623 mptbase snd_usb_usx2y snd_usbmidi_lib snd_rawmidi wmi libnvdimm lockd sunrpc grace rc_kworld_pc150u rc_core rtc_da9063 sha1_ssse3 i2c_cros_ec_tunnel adxl34x_spi adxl34x nfnetlink lib80211 i5500_temp dvb_as102 dvb_core videobuf2_common videodev media videobuf2_vmalloc videobuf2_memops udc_core lnbp22 leds_lp3952 hid_roccat_ryos s1d13xxxfb mtd vport_geneve openvswitch nf_conncount nf_nat_ipv6 nsh geneve udp_tunnel ip6_udp_tunnel snd_soc_mt6351 sis_agp phylink snd_soc_adau1761_spi snd_soc_adau1761 snd_soc_adau17x1 snd_soc_core snd_pcm_dmaengine ac97_bus snd_compress snd_soc_adau_utils snd_soc_sigmadsp_regmap snd_soc_sigmadsp raid_class hid_roccat_konepure hid_roccat_common hid_roccat c2port_duramar2150 core mdio_bcm_unimac iptable_security iptable_raw iptable_mangle
iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_vti ip_gre ipip sit tunnel4 ip_tunnel hsr veth netdevsim devlink vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon dummy team bonding vcan bridge stp llc ip6_gre gre ip6_tunnel tunnel6 tun crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel joydev mousedev ide_pci_generic piix aesni_intel aes_x86_64 ide_core crypto_simd atkbd cryptd glue_helper serio_raw ata_generic pata_acpi i2c_piix4 floppy sch_fq_codel ip_tables x_tables ipv6 [last unloaded: lm73]
Dumping ftrace buffer:
(ftrace buffer empty)
---[ end trace 770020de38961fd0 ]---
A new dir entry can be created in get_subdir and its 'header->parent' is
set to NULL. Only after insert_header success, it will be set to 'dir',
otherwise 'header->parent' is set to NULL and drop_sysctl_table is called.
However in err handling path of get_subdir, drop_sysctl_table also be
called on 'new->header' regardless its value of parent pointer. Then
put_links is called, which triggers NULL-ptr deref when access member of
header->parent.
In fact we have multiple error paths which call drop_sysctl_table() there,
upon failure on insert_links() we also call drop_sysctl_table().And even
in the successful case on __register_sysctl_table() we still always call
drop_sysctl_table().This patch fix it.
Link: http://lkml.kernel.org/r/20190314085527.13244-1-yuehaibing@huawei.com
Fixes: 0e47c99d7fe25 ("sysctl: Replace root_list with links between sysctl_table_sets")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reported-by: Hulk Robot <hulkci@huawei.com>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: <stable@vger.kernel.org> [3.4+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/proc_sysctl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -1604,7 +1604,8 @@ static void drop_sysctl_table(struct ctl
if (--header->nreg)
return;
- put_links(header);
+ if (parent)
+ put_links(header);
start_unregistering(header);
if (!--header->count)
kfree_rcu(header, rcu);
next prev parent reply other threads:[~2019-04-01 17:51 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-01 17:02 [PATCH 4.9 00/56] 4.9.167-stable review Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 01/56] Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 02/56] Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 03/56] video: fbdev: Set pixclock = 0 in goldfishfb Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 04/56] cfg80211: size various nl80211 messages correctly Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 05/56] stmmac: copy unicast mac address to MAC registers Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 06/56] dccp: do not use ipv6 header for ipv4 flow Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 07/56] mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 08/56] net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 09/56] net: rose: fix a possible stack overflow Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 10/56] packets: Always register packet sk in the same order Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 11/56] tcp: do not use ipv6 header for ipv4 flow Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 12/56] vxlan: Dont call gro_cells_destroy() before device is unregistered Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 13/56] sctp: get sctphdr by offset in sctp_compute_cksum Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 14/56] mac8390: Fix mmio access size probe Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 15/56] tun: properly test for IFF_UP Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 16/56] tun: add a missing rcu_read_unlock() in error path Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 17/56] btrfs: remove WARN_ON in log_dir_items Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 18/56] btrfs: raid56: properly unmap parity page in finish_parity_scrub() Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 19/56] ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 20/56] powerpc: bpf: Fix generation of load/store DW instructions Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 21/56] NFSv4.1 dont free interrupted slot on open Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 22/56] net: dsa: qca8k: remove leftover phy accessors Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 23/56] ALSA: rawmidi: Fix potential Spectre v1 vulnerability Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 24/56] ALSA: seq: oss: Fix " Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 25/56] ALSA: pcm: Fix possible OOB access in PCM oss plugins Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 26/56] ALSA: pcm: Dont suspend stream in unrecoverable PCM state Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 27/56] fs/open.c: allow opening only regular files during execve() Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 28/56] scsi: sd: Fix a race between closing an sd device and sd I/O Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 29/56] scsi: sd: Quiesce warning if device does not report optimal I/O size Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 30/56] scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 31/56] scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 32/56] tty: atmel_serial: fix a potential NULL pointer dereference Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 33/56] staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 34/56] staging: vt6655: Remove vif check from vnt_interrupt Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 35/56] staging: vt6655: Fix interrupt race condition on device start up Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 36/56] serial: max310x: Fix to avoid potential NULL pointer dereference Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 37/56] serial: sh-sci: Fix setting SCSCR_TIE while transferring data Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 38/56] USB: serial: cp210x: add new device id Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 39/56] USB: serial: ftdi_sio: add additional NovaTech products Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 40/56] USB: serial: mos7720: fix mos_parport refcount imbalance on error path Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 41/56] USB: serial: option: set driver_info for SIM5218 and compatibles Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 42/56] USB: serial: option: add Olicard 600 Greg Kroah-Hartman
2019-04-01 17:02 ` [PATCH 4.9 43/56] Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc Greg Kroah-Hartman
2019-04-01 17:03 ` Greg Kroah-Hartman [this message]
2019-04-01 17:03 ` [PATCH 4.9 45/56] gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 46/56] usb: common: Consider only available nodes for dr_mode Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 47/56] usb: host: xhci-rcar: Add XHCI_TRUST_TX_LENGTH quirk Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 48/56] perf intel-pt: Fix TSC slip Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 49/56] cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 50/56] x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 51/56] KVM: Reject device ioctls from processes other than the VMs creator Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 52/56] KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 53/56] USB: gadget: f_hid: fix deadlock in f_hidg_write() Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 54/56] xhci: Fix port resume done detection for SS ports with LPM enabled Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 55/56] Revert "USB: core: only clean up what we allocated" Greg Kroah-Hartman
2019-04-01 17:03 ` [PATCH 4.9 56/56] arm64: support keyctl() system call in 32-bit mode Greg Kroah-Hartman
2019-04-01 21:03 ` [PATCH 4.9 00/56] 4.9.167-stable review kernelci.org bot
2019-04-02 3:01 ` Naresh Kamboju
2019-04-02 9:03 ` Jon Hunter
2019-04-02 19:04 ` Guenter Roeck
2019-04-02 23:54 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190401170106.322158604@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=ast@kernel.org \
--cc=daniel@iogearbox.net \
--cc=ebiederm@xmission.com \
--cc=hulkci@huawei.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mcgrof@kernel.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
--cc=yuehaibing@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).