* [PATCH] NFC: Prevent NULL deref when getting socket name
@ 2012-06-30 9:56 Sasha Levin
2012-07-02 18:24 ` John W. Linville
0 siblings, 1 reply; 3+ messages in thread
From: Sasha Levin @ 2012-06-30 9:56 UTC (permalink / raw)
To: lauro.venancio, aloisio.almeida, sameo, linville
Cc: linux-wireless, netdev, linux-kernel, Sasha Levin
llcp_sock_getname can be called without a device attached to the nfc_llcp_sock.
This would lead to the following BUG:
[ 362.341807] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 362.341815] IP: [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0
[ 362.341818] PGD 31b35067 PUD 30631067 PMD 0
[ 362.341821] Oops: 0000 [#627] PREEMPT SMP DEBUG_PAGEALLOC
[ 362.341826] CPU 3
[ 362.341827] Pid: 7816, comm: trinity-child55 Tainted: G D W 3.5.0-rc4-next-20120628-sasha-00005-g9f23eb7 #479
[ 362.341831] RIP: 0010:[<ffffffff836258e5>] [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0
[ 362.341832] RSP: 0018:ffff8800304fde88 EFLAGS: 00010286
[ 362.341834] RAX: 0000000000000000 RBX: ffff880033cb8000 RCX: 0000000000000001
[ 362.341835] RDX: ffff8800304fdec4 RSI: ffff8800304fdec8 RDI: ffff8800304fdeda
[ 362.341836] RBP: ffff8800304fdea8 R08: 7ebcebcb772b7ffb R09: 5fbfcb9c35bdfd53
[ 362.341838] R10: 4220020c54326244 R11: 0000000000000246 R12: ffff8800304fdec8
[ 362.341839] R13: ffff8800304fdec4 R14: ffff8800304fdec8 R15: 0000000000000044
[ 362.341841] FS: 00007effa376e700(0000) GS:ffff880035a00000(0000) knlGS:0000000000000000
[ 362.341843] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 362.341844] CR2: 0000000000000000 CR3: 0000000030438000 CR4: 00000000000406e0
[ 362.341851] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 362.341856] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 362.341858] Process trinity-child55 (pid: 7816, threadinfo ffff8800304fc000, task ffff880031270000)
[ 362.341858] Stack:
[ 362.341862] ffff8800304fdea8 ffff880035156780 0000000000000000 0000000000001000
[ 362.341865] ffff8800304fdf78 ffffffff83183b40 00000000304fdec8 0000006000000000
[ 362.341868] ffff8800304f0027 ffffffff83729649 ffff8800304fdee8 ffff8800304fdf48
[ 362.341869] Call Trace:
[ 362.341874] [<ffffffff83183b40>] sys_getpeername+0xa0/0x110
[ 362.341877] [<ffffffff83729649>] ? _raw_spin_unlock_irq+0x59/0x80
[ 362.341882] [<ffffffff810f342b>] ? do_setitimer+0x23b/0x290
[ 362.341886] [<ffffffff81985ede>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[ 362.341889] [<ffffffff8372a539>] system_call_fastpath+0x16/0x1b
[ 362.341921] Code: 84 00 00 00 00 00 b8 b3 ff ff ff 48 85 db 74 54 66 41 c7 04 24 27 00 49 8d 7c 24 12 41 c7 45 00 60 00 00 00 48 8b 83 28 05 00 00 <8b> 00 41 89 44 24 04 0f b6 83 41 05 00 00 41 88 44 24 10 0f b6
[ 362.341924] RIP [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0
[ 362.341925] RSP <ffff8800304fde88>
[ 362.341926] CR2: 0000000000000000
[ 362.341928] ---[ end trace 6d450e935ee18bf3 ]---
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
---
net/nfc/llcp/sock.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 2c0b317..05ca5a6 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -292,7 +292,7 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
pr_debug("%p\n", sk);
- if (llcp_sock == NULL)
+ if (llcp_sock == NULL || llcp_sock->dev == NULL)
return -EBADFD;
addr->sa_family = AF_NFC;
--
1.7.8.6
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] NFC: Prevent NULL deref when getting socket name
2012-06-30 9:56 [PATCH] NFC: Prevent NULL deref when getting socket name Sasha Levin
@ 2012-07-02 18:24 ` John W. Linville
2012-07-05 15:42 ` Samuel Ortiz
0 siblings, 1 reply; 3+ messages in thread
From: John W. Linville @ 2012-07-02 18:24 UTC (permalink / raw)
To: Sasha Levin
Cc: lauro.venancio, aloisio.almeida, sameo, linux-wireless, netdev,
linux-kernel
On Sat, Jun 30, 2012 at 11:56:47AM +0200, Sasha Levin wrote:
> llcp_sock_getname can be called without a device attached to the nfc_llcp_sock.
>
> This would lead to the following BUG:
>
> [ 362.341807] BUG: unable to handle kernel NULL pointer dereference at (null)
> [ 362.341815] IP: [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0
> [ 362.341818] PGD 31b35067 PUD 30631067 PMD 0
> [ 362.341821] Oops: 0000 [#627] PREEMPT SMP DEBUG_PAGEALLOC
> [ 362.341826] CPU 3
> [ 362.341827] Pid: 7816, comm: trinity-child55 Tainted: G D W 3.5.0-rc4-next-20120628-sasha-00005-g9f23eb7 #479
> [ 362.341831] RIP: 0010:[<ffffffff836258e5>] [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0
> [ 362.341832] RSP: 0018:ffff8800304fde88 EFLAGS: 00010286
> [ 362.341834] RAX: 0000000000000000 RBX: ffff880033cb8000 RCX: 0000000000000001
> [ 362.341835] RDX: ffff8800304fdec4 RSI: ffff8800304fdec8 RDI: ffff8800304fdeda
> [ 362.341836] RBP: ffff8800304fdea8 R08: 7ebcebcb772b7ffb R09: 5fbfcb9c35bdfd53
> [ 362.341838] R10: 4220020c54326244 R11: 0000000000000246 R12: ffff8800304fdec8
> [ 362.341839] R13: ffff8800304fdec4 R14: ffff8800304fdec8 R15: 0000000000000044
> [ 362.341841] FS: 00007effa376e700(0000) GS:ffff880035a00000(0000) knlGS:0000000000000000
> [ 362.341843] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 362.341844] CR2: 0000000000000000 CR3: 0000000030438000 CR4: 00000000000406e0
> [ 362.341851] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 362.341856] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [ 362.341858] Process trinity-child55 (pid: 7816, threadinfo ffff8800304fc000, task ffff880031270000)
> [ 362.341858] Stack:
> [ 362.341862] ffff8800304fdea8 ffff880035156780 0000000000000000 0000000000001000
> [ 362.341865] ffff8800304fdf78 ffffffff83183b40 00000000304fdec8 0000006000000000
> [ 362.341868] ffff8800304f0027 ffffffff83729649 ffff8800304fdee8 ffff8800304fdf48
> [ 362.341869] Call Trace:
> [ 362.341874] [<ffffffff83183b40>] sys_getpeername+0xa0/0x110
> [ 362.341877] [<ffffffff83729649>] ? _raw_spin_unlock_irq+0x59/0x80
> [ 362.341882] [<ffffffff810f342b>] ? do_setitimer+0x23b/0x290
> [ 362.341886] [<ffffffff81985ede>] ? trace_hardirqs_on_thunk+0x3a/0x3f
> [ 362.341889] [<ffffffff8372a539>] system_call_fastpath+0x16/0x1b
> [ 362.341921] Code: 84 00 00 00 00 00 b8 b3 ff ff ff 48 85 db 74 54 66 41 c7 04 24 27 00 49 8d 7c 24 12 41 c7 45 00 60 00 00 00 48 8b 83 28 05 00 00 <8b> 00 41 89 44 24 04 0f b6 83 41 05 00 00 41 88 44 24 10 0f b6
> [ 362.341924] RIP [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0
> [ 362.341925] RSP <ffff8800304fde88>
> [ 362.341926] CR2: 0000000000000000
> [ 362.341928] ---[ end trace 6d450e935ee18bf3 ]---
>
> Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Samuel, I'm taking this one directly.
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver.com might be all we have. Be ready.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] NFC: Prevent NULL deref when getting socket name
2012-07-02 18:24 ` John W. Linville
@ 2012-07-05 15:42 ` Samuel Ortiz
0 siblings, 0 replies; 3+ messages in thread
From: Samuel Ortiz @ 2012-07-05 15:42 UTC (permalink / raw)
To: John W. Linville
Cc: Sasha Levin, lauro.venancio, aloisio.almeida, linux-wireless,
netdev, linux-kernel
Hi John,
On Mon, Jul 02, 2012 at 02:24:38PM -0400, John W. Linville wrote:
> On Sat, Jun 30, 2012 at 11:56:47AM +0200, Sasha Levin wrote:
> > llcp_sock_getname can be called without a device attached to the nfc_llcp_sock.
> >
> > This would lead to the following BUG:
> >
> > [ 362.341807] BUG: unable to handle kernel NULL pointer dereference at (null)
> > [ 362.341815] IP: [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0
> > [ 362.341818] PGD 31b35067 PUD 30631067 PMD 0
> > [ 362.341821] Oops: 0000 [#627] PREEMPT SMP DEBUG_PAGEALLOC
> > [ 362.341826] CPU 3
> > [ 362.341827] Pid: 7816, comm: trinity-child55 Tainted: G D W 3.5.0-rc4-next-20120628-sasha-00005-g9f23eb7 #479
> > [ 362.341831] RIP: 0010:[<ffffffff836258e5>] [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0
> > [ 362.341832] RSP: 0018:ffff8800304fde88 EFLAGS: 00010286
> > [ 362.341834] RAX: 0000000000000000 RBX: ffff880033cb8000 RCX: 0000000000000001
> > [ 362.341835] RDX: ffff8800304fdec4 RSI: ffff8800304fdec8 RDI: ffff8800304fdeda
> > [ 362.341836] RBP: ffff8800304fdea8 R08: 7ebcebcb772b7ffb R09: 5fbfcb9c35bdfd53
> > [ 362.341838] R10: 4220020c54326244 R11: 0000000000000246 R12: ffff8800304fdec8
> > [ 362.341839] R13: ffff8800304fdec4 R14: ffff8800304fdec8 R15: 0000000000000044
> > [ 362.341841] FS: 00007effa376e700(0000) GS:ffff880035a00000(0000) knlGS:0000000000000000
> > [ 362.341843] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [ 362.341844] CR2: 0000000000000000 CR3: 0000000030438000 CR4: 00000000000406e0
> > [ 362.341851] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > [ 362.341856] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> > [ 362.341858] Process trinity-child55 (pid: 7816, threadinfo ffff8800304fc000, task ffff880031270000)
> > [ 362.341858] Stack:
> > [ 362.341862] ffff8800304fdea8 ffff880035156780 0000000000000000 0000000000001000
> > [ 362.341865] ffff8800304fdf78 ffffffff83183b40 00000000304fdec8 0000006000000000
> > [ 362.341868] ffff8800304f0027 ffffffff83729649 ffff8800304fdee8 ffff8800304fdf48
> > [ 362.341869] Call Trace:
> > [ 362.341874] [<ffffffff83183b40>] sys_getpeername+0xa0/0x110
> > [ 362.341877] [<ffffffff83729649>] ? _raw_spin_unlock_irq+0x59/0x80
> > [ 362.341882] [<ffffffff810f342b>] ? do_setitimer+0x23b/0x290
> > [ 362.341886] [<ffffffff81985ede>] ? trace_hardirqs_on_thunk+0x3a/0x3f
> > [ 362.341889] [<ffffffff8372a539>] system_call_fastpath+0x16/0x1b
> > [ 362.341921] Code: 84 00 00 00 00 00 b8 b3 ff ff ff 48 85 db 74 54 66 41 c7 04 24 27 00 49 8d 7c 24 12 41 c7 45 00 60 00 00 00 48 8b 83 28 05 00 00 <8b> 00 41 89 44 24 04 0f b6 83 41 05 00 00 41 88 44 24 10 0f b6
> > [ 362.341924] RIP [<ffffffff836258e5>] llcp_sock_getname+0x75/0xc0
> > [ 362.341925] RSP <ffff8800304fde88>
> > [ 362.341926] CR2: 0000000000000000
> > [ 362.341928] ---[ end trace 6d450e935ee18bf3 ]---
> >
> > Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
>
> Samuel, I'm taking this one directly.
Thanks. It was already on my for-wireless branch.
Cheers,
Samuel.
--
Intel Open Source Technology Centre
http://oss.intel.com/
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-07-05 15:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-06-30 9:56 [PATCH] NFC: Prevent NULL deref when getting socket name Sasha Levin
2012-07-02 18:24 ` John W. Linville
2012-07-05 15:42 ` Samuel Ortiz
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.