lkml.org 
[lkml]   [2017]   [Dec]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 063/105] ipv6: reorder icmpv6_init() and ip6_mr_init()
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: WANG Cong <xiyou.wangcong@gmail.com>


    [ Upstream commit 15e668070a64bb97f102ad9cf3bccbca0545cda8 ]

    Andrey reported the following kernel crash:

    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] SMP KASAN
    Dumping ftrace buffer:
    (ftrace buffer empty)
    Modules linked in:
    CPU: 0 PID: 14446 Comm: syz-executor6 Not tainted 4.10.0+ #82
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    task: ffff88001f311700 task.stack: ffff88001f6e8000
    RIP: 0010:ip6mr_sk_done+0x15a/0x3d0 net/ipv6/ip6mr.c:1618
    RSP: 0018:ffff88001f6ef418 EFLAGS: 00010202
    RAX: dffffc0000000000 RBX: 1ffff10003edde8c RCX: ffffc900043ee000
    RDX: 0000000000000004 RSI: ffffffff83e3b3f8 RDI: 0000000000000020
    RBP: ffff88001f6ef508 R08: fffffbfff0dcc5d8 R09: 0000000000000000
    R10: ffffffff86e62ec0 R11: 0000000000000000 R12: 0000000000000000
    R13: 0000000000000000 R14: ffff88001f6ef4e0 R15: ffff8800380a0040
    FS: 00007f7a52cec700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000000000061c500 CR3: 000000001f1ae000 CR4: 00000000000006f0
    DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
    Call Trace:
    rawv6_close+0x4c/0x80 net/ipv6/raw.c:1217
    inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
    inet6_release+0x50/0x70 net/ipv6/af_inet6.c:432
    sock_release+0x8d/0x1e0 net/socket.c:597
    __sock_create+0x39d/0x880 net/socket.c:1226
    sock_create_kern+0x3f/0x50 net/socket.c:1243
    inet_ctl_sock_create+0xbb/0x280 net/ipv4/af_inet.c:1526
    icmpv6_sk_init+0x163/0x500 net/ipv6/icmp.c:954
    ops_init+0x10a/0x550 net/core/net_namespace.c:115
    setup_net+0x261/0x660 net/core/net_namespace.c:291
    copy_net_ns+0x27e/0x540 net/core/net_namespace.c:396
    9pnet_virtio: no channels available for device ./file1
    create_new_namespaces+0x437/0x9b0 kernel/nsproxy.c:106
    unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205
    SYSC_unshare kernel/fork.c:2281 [inline]
    SyS_unshare+0x64e/0x1000 kernel/fork.c:2231
    entry_SYSCALL_64_fastpath+0x1f/0xc2

    This is because net->ipv6.mr6_tables is not initialized at that point,
    ip6mr_rules_init() is not called yet, therefore on the error path when
    we iterator the list, we trigger this oops. Fix this by reordering
    ip6mr_rules_init() before icmpv6_sk_init().

    Reported-by: Andrey Konovalov <andreyknvl@google.com>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv6/af_inet6.c | 10 +++++-----
    1 file changed, 5 insertions(+), 5 deletions(-)

    --- a/net/ipv6/af_inet6.c
    +++ b/net/ipv6/af_inet6.c
    @@ -893,12 +893,12 @@ static int __init inet6_init(void)
    err = register_pernet_subsys(&inet6_net_ops);
    if (err)
    goto register_pernet_fail;
    - err = icmpv6_init();
    - if (err)
    - goto icmp_fail;
    err = ip6_mr_init();
    if (err)
    goto ipmr_fail;
    + err = icmpv6_init();
    + if (err)
    + goto icmp_fail;
    err = ndisc_init();
    if (err)
    goto ndisc_fail;
    @@ -1016,10 +1016,10 @@ igmp_fail:
    ndisc_cleanup();
    ndisc_fail:
    ip6_mr_cleanup();
    -ipmr_fail:
    - icmpv6_cleanup();
    icmp_fail:
    unregister_pernet_subsys(&inet6_net_ops);
    +ipmr_fail:
    + icmpv6_cleanup();
    register_pernet_fail:
    sock_unregister(PF_INET6);
    rtnl_unregister_all(PF_INET6);

    \
     
     \ /
      Last update: 2017-12-15 11:32    [W:2.355 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site