All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH net] route: Avoid crash from dereferencing NULL rt->from
@ 2019-04-14 21:21 Jonathan Lemon
  2019-04-14 22:29 ` Eric Dumazet
                   ` (4 more replies)
  0 siblings, 5 replies; 9+ messages in thread
From: Jonathan Lemon @ 2019-04-14 21:21 UTC (permalink / raw)
  To: netdev, dsahern; +Cc: kernel-team

When __ip6_rt_update_pmtu() is called, rt->from is RCU dereferenced, but is
never checked for null - rt6_flush_exceptions() may have removed the entry.

[ 1913.989004] RIP: 0010:ip6_rt_cache_alloc+0x13/0x170
[ 1914.209410] Call Trace:
[ 1914.214798]  <IRQ>
[ 1914.219226]  __ip6_rt_update_pmtu+0xb0/0x190
[ 1914.228649]  ip6_tnl_xmit+0x2c2/0x970 [ip6_tunnel]
[ 1914.239223]  ? ip6_tnl_parse_tlv_enc_lim+0x32/0x1a0 [ip6_tunnel]
[ 1914.252489]  ? __gre6_xmit+0x148/0x530 [ip6_gre]
[ 1914.262678]  ip6gre_tunnel_xmit+0x17e/0x3c7 [ip6_gre]
[ 1914.273831]  dev_hard_start_xmit+0x8d/0x1f0
[ 1914.283061]  sch_direct_xmit+0xfa/0x230
[ 1914.291521]  __qdisc_run+0x154/0x4b0
[ 1914.299407]  net_tx_action+0x10e/0x1f0
[ 1914.307678]  __do_softirq+0xca/0x297
[ 1914.315567]  irq_exit+0x96/0xa0
[ 1914.322494]  smp_apic_timer_interrupt+0x68/0x130
[ 1914.332683]  apic_timer_interrupt+0xf/0x20
[ 1914.341721]  </IRQ>

Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
---
 net/ipv6/route.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d555edaaff13..b9cbe6815f2c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2331,6 +2331,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
 
 		rcu_read_lock();
 		from = rcu_dereference(rt6->from);
+		if (!from) {
+			rcu_read_unlock();
+			return;
+		}
 		nrt6 = ip6_rt_cache_alloc(from, daddr, saddr);
 		if (nrt6) {
 			rt6_do_update_pmtu(nrt6, mtu);
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2019-04-22  0:17 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-14 21:21 [PATCH net] route: Avoid crash from dereferencing NULL rt->from Jonathan Lemon
2019-04-14 22:29 ` Eric Dumazet
2019-04-15 16:17   ` Martin Lau
2019-04-15 19:16     ` David Ahern
2019-04-15  0:38 ` David Ahern
2019-04-15 15:36 ` Martin Lau
2019-04-15 20:35 ` David Miller
2019-04-22  0:17 ` [route] 3be5fb4873: INFO:rcu_sched_self-detected_stall_on_CPU kernel test robot
2019-04-22  0:17   ` kernel test robot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.