From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Andrey Konovalov <andreyknvl@google.com>,
David Ahern <dsa@cumulusnetworks.com>,
"David S. Miller" <davem@davemloft.net>,
"Nobuhiro Iwamatsu (CIP)" <nobuhiro1.iwamatsu@toshiba.co.jp>
Subject: [PATCH 4.4 35/86] net: handle no dst on skb in icmp6_send
Date: Mon, 18 May 2020 19:36:06 +0200 [thread overview]
Message-ID: <20200518173457.623138564@linuxfoundation.org> (raw)
In-Reply-To: <20200518173450.254571947@linuxfoundation.org>
From: David Ahern <dsa@cumulusnetworks.com>
commit 79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2 upstream.
Andrey reported the following while fuzzing the kernel with syzkaller:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 3859 Comm: a.out Not tainted 4.9.0-rc6+ #429
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff8800666d4200 task.stack: ffff880067348000
RIP: 0010:[<ffffffff833617ec>] [<ffffffff833617ec>]
icmp6_send+0x5fc/0x1e30 net/ipv6/icmp.c:451
RSP: 0018:ffff88006734f2c0 EFLAGS: 00010206
RAX: ffff8800666d4200 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000000018
RBP: ffff88006734f630 R08: ffff880064138418 R09: 0000000000000003
R10: dffffc0000000000 R11: 0000000000000005 R12: 0000000000000000
R13: ffffffff84e7e200 R14: ffff880064138484 R15: ffff8800641383c0
FS: 00007fb3887a07c0(0000) GS:ffff88006cc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 000000006b040000 CR4: 00000000000006f0
Stack:
ffff8800666d4200 ffff8800666d49f8 ffff8800666d4200 ffffffff84c02460
ffff8800666d4a1a 1ffff1000ccdaa2f ffff88006734f498 0000000000000046
ffff88006734f440 ffffffff832f4269 ffff880064ba7456 0000000000000000
Call Trace:
[<ffffffff83364ddc>] icmpv6_param_prob+0x2c/0x40 net/ipv6/icmp.c:557
[< inline >] ip6_tlvopt_unknown net/ipv6/exthdrs.c:88
[<ffffffff83394405>] ip6_parse_tlv+0x555/0x670 net/ipv6/exthdrs.c:157
[<ffffffff8339a759>] ipv6_parse_hopopts+0x199/0x460 net/ipv6/exthdrs.c:663
[<ffffffff832ee773>] ipv6_rcv+0xfa3/0x1dc0 net/ipv6/ip6_input.c:191
...
icmp6_send / icmpv6_send is invoked for both rx and tx paths. In both
cases the dst->dev should be preferred for determining the L3 domain
if the dst has been set on the skb. Fallback to the skb->dev if it has
not. This covers the case reported here where icmp6_send is invoked on
Rx before the route lookup.
Fixes: 5d41ce29e ("net: icmp6_send should use dst dev to determine L3 domain")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/icmp.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -445,8 +445,10 @@ static void icmp6_send(struct sk_buff *s
if (__ipv6_addr_needs_scope_id(addr_type))
iif = skb->dev->ifindex;
- else
- iif = l3mdev_master_ifindex(skb_dst(skb)->dev);
+ else {
+ dst = skb_dst(skb);
+ iif = l3mdev_master_ifindex(dst ? dst->dev : skb->dev);
+ }
/*
* Must not send error if the source does not uniquely
next prev parent reply other threads:[~2020-05-18 17:39 UTC|newest]
Thread overview: 95+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-18 17:35 [PATCH 4.4 00/86] 4.4.224-rc1 review Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 01/86] USB: serial: qcserial: Add DW5816e support Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 02/86] Revert "net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS" Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 03/86] dp83640: reverse arguments to list_add_tail Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 04/86] net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc() Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 05/86] sch_sfq: validate silly quantum values Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 06/86] sch_choke: avoid potential panic in choke_reset() Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 07/86] Revert "ACPI / video: Add force_native quirk for HP Pavilion dv6" Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 08/86] enic: do not overwrite error code Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 09/86] ipv6: fix cleanup ordering for ip6_mr failure Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 10/86] binfmt_elf: move brk out of mmap when doing direct loader exec Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 11/86] x86/apm: Dont access __preempt_count with zeroed fs Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 12/86] Revert "IB/ipoib: Update broadcast object if PKey value was changed in index 0" Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 13/86] USB: uas: add quirk for LaCie 2Big Quadra Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 14/86] USB: serial: garmin_gps: add sanity checking for data length Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 15/86] batman-adv: fix batadv_nc_random_weight_tq Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 16/86] scripts/decodecode: fix trapping instruction formatting Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 17/86] phy: micrel: Disable auto negotiation on startup Greg Kroah-Hartman
2020-05-19 5:45 ` Henri Rosten
2020-05-19 10:53 ` Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 18/86] phy: micrel: Ensure interrupts are reenabled on resume Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 19/86] binfmt_elf: Do not move brk for INTERP-less ET_EXEC Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 20/86] ext4: add cond_resched() to ext4_protect_reserved_inode Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 21/86] net: ipv6: add net argument to ip6_dst_lookup_flow Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 22/86] net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 23/86] blktrace: Fix potential deadlock between delete & sysfs ops Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 24/86] blktrace: fix unlocked access to init/start-stop/teardown Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 25/86] blktrace: fix trace mutex deadlock Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 26/86] blktrace: Protect q->blk_trace with RCU Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 27/86] blktrace: fix dereference after null check Greg Kroah-Hartman
2020-05-18 17:35 ` [PATCH 4.4 28/86] ptp: do not explicitly set drvdata in ptp_clock_register() Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 29/86] ptp: use is_visible method to hide unused attributes Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 30/86] ptp: create "pins" together with the rest of attributes Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 31/86] chardev: add helper function to register char devs with a struct device Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 32/86] ptp: Fix pass zero to ERR_PTR() in ptp_clock_register Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 33/86] ptp: fix the race between the release of ptp_clock and cdev Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 34/86] ptp: free ptp device pin descriptors properly Greg Kroah-Hartman
2020-05-18 17:36 ` Greg Kroah-Hartman [this message]
2020-05-18 17:36 ` [PATCH 4.4 36/86] net/sonic: Fix a resource leak in an error handling path in jazz_sonic_probe() Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 37/86] net: moxa: Fix a potential double free_irq() Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 38/86] drop_monitor: work around gcc-10 stringop-overflow warning Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 39/86] scsi: sg: add sg_remove_request in sg_write Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 40/86] spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 41/86] cifs: Check for timeout on Negotiate stage Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 42/86] cifs: Fix a race condition with cifs_echo_request Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 43/86] dmaengine: pch_dma.c: Avoid data race between probe and irq handler Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 44/86] dmaengine: mmp_tdma: Reset channel error on release Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 45/86] drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 46/86] ipc/util.c: sysvipc_find_ipc() incorrectly updates position index Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 47/86] net: openvswitch: fix csum updates for MPLS actions Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 48/86] gre: do not keep the GRE header around in collect medata mode Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 49/86] mm/memory_hotplug.c: fix overflow in test_pages_in_a_zone() Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 50/86] scsi: qla2xxx: Avoid double completion of abort command Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 51/86] i40e: avoid NVM acquire deadlock during NVM update Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 52/86] net/mlx5: Fix driver load error flow when firmware is stuck Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 53/86] netfilter: conntrack: avoid gcc-10 zero-length-bounds warning Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 54/86] IB/mlx4: Test return value of calls to ib_get_cached_pkey Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 55/86] pnp: Use list_for_each_entry() instead of open coding Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 56/86] gcc-10 warnings: fix low-hanging fruit Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 57/86] kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 58/86] Stop the ad-hoc games with -Wno-maybe-initialized Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 59/86] gcc-10: disable zero-length-bounds warning for now Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 60/86] gcc-10: disable array-bounds " Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 61/86] gcc-10: disable stringop-overflow " Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 62/86] gcc-10: disable restrict " Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 63/86] block: defer timeouts to a workqueue Greg Kroah-Hartman
2020-05-19 6:00 ` Henri Rosten
2020-05-19 7:31 ` Greg Kroah-Hartman
2020-05-19 10:53 ` Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 64/86] blk-mq: Allow timeouts to run while queue is freezing Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 65/86] blk-mq: sync the update nr_hw_queues with blk_mq_queue_tag_busy_iter Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 66/86] blk-mq: Allow blocking queue tag iter callbacks Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 67/86] x86/paravirt: Remove the unused irq_enable_sysexit pv op Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 68/86] gcc-10: avoid shadowing standard library free() in crypto Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 69/86] net: fix a potential recursive NETDEV_FEAT_CHANGE Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 70/86] net: ipv4: really enforce backoff for redirects Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 71/86] netlabel: cope with NULL catmap Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 72/86] ALSA: hda/realtek - Limit int mic boost for Thinkpad T530 Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 73/86] ALSA: rawmidi: Fix racy buffer resize under concurrent accesses Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 74/86] ALSA: rawmidi: Initialize allocated buffers Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 75/86] USB: gadget: fix illegal array access in binding with UDC Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 76/86] ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 77/86] x86: Fix early boot crash on gcc-10, third try Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 78/86] exec: Move would_dump into flush_old_exec Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 79/86] usb: gadget: net2272: Fix a memory leak in an error handling path in net2272_plat_probe() Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 80/86] usb: gadget: audio: Fix a missing error return value in audio_bind() Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 81/86] usb: gadget: legacy: fix error return code in gncm_bind() Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 82/86] usb: gadget: legacy: fix error return code in cdc_bind() Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 83/86] Revert "ALSA: hda/realtek: Fix pop noise on ALC225" Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 84/86] ARM: dts: r8a7740: Add missing extal2 to CPG node Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 85/86] KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce Greg Kroah-Hartman
2020-05-18 17:36 ` [PATCH 4.4 86/86] Makefile: disallow data races on gcc-10 as well Greg Kroah-Hartman
2020-05-19 8:29 ` [PATCH 4.4 00/86] 4.4.224-rc1 review Naresh Kamboju
2020-05-19 8:49 ` Jon Hunter
2020-05-21 7:47 ` Chris Paterson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200518173457.623138564@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andreyknvl@google.com \
--cc=davem@davemloft.net \
--cc=dsa@cumulusnetworks.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nobuhiro1.iwamatsu@toshiba.co.jp \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).