UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity
OpenCloudOS-Kernel/net
History
Eric Dumazet 0ceb2f2b5c ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() 
[ Upstream commit 04ccecfa959d3b9ae7348780d8e379c6486176ac ]

Blamed commit accidentally removed a check for rt->rt6i_idev being NULL,
as spotted by syzbot:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
 RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]
 RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914
Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06
RSP: 0018:ffffc900047374e0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0
RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c
R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18
R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930
FS:  0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
  addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856
 addrconf_notify+0x3cb/0x1020
  notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93
  call_netdevice_notifiers_extack net/core/dev.c:2032 [inline]
  call_netdevice_notifiers net/core/dev.c:2046 [inline]
  unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352
  unregister_netdevice_many net/core/dev.c:11414 [inline]
  unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289
  unregister_netdevice include/linux/netdevice.h:3129 [inline]
  __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685
  tun_detach drivers/net/tun.c:701 [inline]
  tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510
  __fput+0x24a/0x8a0 fs/file_table.c:422
  task_work_run+0x24f/0x310 kernel/task_work.c:228
  exit_task_work include/linux/task_work.h:40 [inline]
  do_exit+0xa2f/0x27f0 kernel/exit.c:882
  do_group_exit+0x207/0x2c0 kernel/exit.c:1031
  __do_sys_exit_group kernel/exit.c:1042 [inline]
  __se_sys_exit_group kernel/exit.c:1040 [inline]
  __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040
  x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1acc77def9
Code: Unable to access opcode bytes at 0x7f1acc77decf.
RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043
RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
 RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]
 RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914
Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06
RSP: 0018:ffffc900047374e0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0
RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c
R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18
R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930
FS:  0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Fixes: e332bc67cf ("ipv6: Don't call with rt6_uncached_list_flush_dev")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20240913083147.3095442-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2024-10-04 16:28:59 +02:00
..
6lowpan
…
9p
…
802
…
8021q
…
appletalk
…
atm
…
ax25
…
batman-adv
…
bluetooth Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL 2024-10-04 16:28:57 +02:00
bpf
…
bpfilter
…
bridge net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN 2024-09-12 11:11:35 +02:00
caif
…
can can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). 2024-10-04 16:28:58 +02:00
ceph
…
core sock_map: Add a cond_resched() in sock_hash_free() 2024-10-04 16:28:58 +02:00
dcb
…
dccp tcp/dccp: do not care about families in inet_twsk_purge() 2024-08-29 17:33:46 +02:00
devlink
…
dns_resolver
…
dsa net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and register injection 2024-08-29 17:33:45 +02:00
ethernet
…
ethtool ethtool: check device is present when getting link settings 2024-09-04 13:28:26 +02:00
handshake
…
hsr
…
ieee802154
…
ife
…
ipv4 fou: fix initialization of grc 2024-09-18 19:24:09 +02:00
ipv6 ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() 2024-10-04 16:28:59 +02:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-08-29 17:33:39 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-08-29 17:33:46 +02:00
key
…
l2tp l2tp: fix lockdep splat 2024-08-14 13:58:40 +02:00
l3mdev
…
lapb
…
llc
…
mac80211 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() 2024-10-04 16:28:57 +02:00
mac802154
…
mctp net: mctp: test: Use correct skb for route input check 2024-08-29 17:33:46 +02:00
mpls
…
mptcp mptcp: pm: Fix uaf in __timer_delete_sync 2024-09-18 19:24:06 +02:00
ncsi
…
netfilter netfilter: nf_tables: remove annotation to access set timeout while holding lock 2024-10-04 16:28:54 +02:00
netlabel
…
netlink netlink: hold nlk->cb_mutex longer in __netlink_dump_start() 2024-08-29 17:33:35 +02:00
netrom
…
nfc nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies 2024-08-19 06:04:28 +02:00
nsh
…
openvswitch net: ovs: fix ovs_drop_reasons error 2024-08-29 17:33:50 +02:00
packet
…
phonet
…
psample
…
qrtr
…
rds net:rds: Fix possible deadlock in rds_message_put 2024-08-19 06:04:27 +02:00
rfkill
…
rose
…
rxrpc rxrpc: Don't pick values out of the wire header when setting up security 2024-08-29 17:33:36 +02:00
sched sched: sch_cake: fix bulk flow accounting logic for host fairness 2024-09-12 11:11:28 +02:00
sctp sctp: fix association labeling in the duplicate COOKIE-ECHO case 2024-09-04 13:28:27 +02:00
smc net/smc: add the max value of fallback reason count 2024-08-14 13:58:40 +02:00
strparser
…
sunrpc sunrpc: use the struct net as the svc proc private 2024-08-19 06:04:23 +02:00
switchdev
…
tipc net: tipc: avoid possible garbage value 2024-10-04 16:28:59 +02:00
tls
…
unix af_unix: Remove put_pid()/put_cred() in copy_peercred(). 2024-09-12 11:11:29 +02:00
vmw_vsock vsock: fix recursive ->recvmsg calls 2024-08-29 17:33:21 +02:00
wireless wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors 2024-10-04 16:28:57 +02:00
x25
…
xdp
…
xfrm
…
Kconfig
…
Kconfig.debug
…
Makefile
…
compat.c
…
devres.c
…
socket.c bpf, net: Fix a potential race in do_sock_getsockopt() 2024-09-12 11:11:34 +02:00
sysctl_net.c
…