From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>,
Tyler Hicks <tyhicks@canonical.com>,
Eric Dumazet <eric.dumazet@gmail.com>,
Christoph Paasch <cpaasch@apple.com>,
Eric Dumazet <edumazet@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 04/88] net: Prevent invalid access to skb->prev in __qdisc_drop_all
Date: Fri, 14 Dec 2018 12:59:38 +0100 [thread overview]
Message-ID: <20181214115702.427414823@linuxfoundation.org> (raw)
In-Reply-To: <20181214115702.151309521@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <cpaasch@apple.com>
[ Upstream commit 9410d386d0a829ace9558336263086c2fbbe8aed ]
__qdisc_drop_all() accesses skb->prev to get to the tail of the
segment-list.
With commit 68d2f84a1368 ("net: gro: properly remove skb from list")
the skb-list handling has been changed to set skb->next to NULL and set
the list-poison on skb->prev.
With that change, __qdisc_drop_all() will panic when it tries to
dereference skb->prev.
Since commit 992cba7e276d ("net: Add and use skb_list_del_init().")
__list_del_entry is used, leaving skb->prev unchanged (thus,
pointing to the list-head if it's the first skb of the list).
This will make __qdisc_drop_all modify the next-pointer of the list-head
and result in a panic later on:
[ 34.501053] general protection fault: 0000 [#1] SMP KASAN PTI
[ 34.501968] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.20.0-rc2.mptcp #108
[ 34.502887] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011
[ 34.504074] RIP: 0010:dev_gro_receive+0x343/0x1f90
[ 34.504751] Code: e0 48 c1 e8 03 42 80 3c 30 00 0f 85 4a 1c 00 00 4d 8b 24 24 4c 39 65 d0 0f 84 0a 04 00 00 49 8d 7c 24 38 48 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 04
[ 34.507060] RSP: 0018:ffff8883af507930 EFLAGS: 00010202
[ 34.507761] RAX: 0000000000000007 RBX: ffff8883970b2c80 RCX: 1ffff11072e165a6
[ 34.508640] RDX: 1ffff11075867008 RSI: ffff8883ac338040 RDI: 0000000000000038
[ 34.509493] RBP: ffff8883af5079d0 R08: ffff8883970b2d40 R09: 0000000000000062
[ 34.510346] R10: 0000000000000034 R11: 0000000000000000 R12: 0000000000000000
[ 34.511215] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8883ac338008
[ 34.512082] FS: 0000000000000000(0000) GS:ffff8883af500000(0000) knlGS:0000000000000000
[ 34.513036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 34.513741] CR2: 000055ccc3e9d020 CR3: 00000003abf32000 CR4: 00000000000006e0
[ 34.514593] Call Trace:
[ 34.514893] <IRQ>
[ 34.515157] napi_gro_receive+0x93/0x150
[ 34.515632] receive_buf+0x893/0x3700
[ 34.516094] ? __netif_receive_skb+0x1f/0x1a0
[ 34.516629] ? virtnet_probe+0x1b40/0x1b40
[ 34.517153] ? __stable_node_chain+0x4d0/0x850
[ 34.517684] ? kfree+0x9a/0x180
[ 34.518067] ? __kasan_slab_free+0x171/0x190
[ 34.518582] ? detach_buf+0x1df/0x650
[ 34.519061] ? lapic_next_event+0x5a/0x90
[ 34.519539] ? virtqueue_get_buf_ctx+0x280/0x7f0
[ 34.520093] virtnet_poll+0x2df/0xd60
[ 34.520533] ? receive_buf+0x3700/0x3700
[ 34.521027] ? qdisc_watchdog_schedule_ns+0xd5/0x140
[ 34.521631] ? htb_dequeue+0x1817/0x25f0
[ 34.522107] ? sch_direct_xmit+0x142/0xf30
[ 34.522595] ? virtqueue_napi_schedule+0x26/0x30
[ 34.523155] net_rx_action+0x2f6/0xc50
[ 34.523601] ? napi_complete_done+0x2f0/0x2f0
[ 34.524126] ? kasan_check_read+0x11/0x20
[ 34.524608] ? _raw_spin_lock+0x7d/0xd0
[ 34.525070] ? _raw_spin_lock_bh+0xd0/0xd0
[ 34.525563] ? kvm_guest_apic_eoi_write+0x6b/0x80
[ 34.526130] ? apic_ack_irq+0x9e/0xe0
[ 34.526567] __do_softirq+0x188/0x4b5
[ 34.527015] irq_exit+0x151/0x180
[ 34.527417] do_IRQ+0xdb/0x150
[ 34.527783] common_interrupt+0xf/0xf
[ 34.528223] </IRQ>
This patch makes sure that skb->prev is set to NULL when entering
netem_enqueue.
Cc: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
Cc: Tyler Hicks <tyhicks@canonical.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: 68d2f84a1368 ("net: gro: properly remove skb from list")
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_netem.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -432,6 +432,9 @@ static int netem_enqueue(struct sk_buff
int count = 1;
int rc = NET_XMIT_SUCCESS;
+ /* Do not fool qdisc_drop_all() */
+ skb->prev = NULL;
+
/* Random duplication */
if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor))
++count;
next prev parent reply other threads:[~2018-12-14 12:13 UTC|newest]
Thread overview: 105+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-14 11:59 [PATCH 4.4 00/88] 4.4.168-stable review Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 01/88] ipv6: Check available headroom in ip6_xmit() even without options Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 02/88] net: 8139cp: fix a BUG triggered by changing mtu with network traffic Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 03/88] net: phy: dont allow __set_phy_supported to add unsupported modes Greg Kroah-Hartman
2018-12-14 11:59 ` Greg Kroah-Hartman [this message]
2018-12-14 11:59 ` [PATCH 4.4 05/88] rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 06/88] tcp: fix NULL ref in tail loss probe Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 07/88] tun: forbid iface creation with rtnl ops Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 08/88] neighbour: Avoid writing before skb->head in neigh_hh_output() Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 09/88] ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes Greg Kroah-Hartman
2018-12-16 9:57 ` jwiesner
2018-12-14 11:59 ` [PATCH 4.4 10/88] ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 11/88] ARM: OMAP1: ams-delta: Fix possible use of uninitialized field Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 12/88] sysv: return err instead of 0 in __sysv_write_inode Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 13/88] s390/cpum_cf: Reject request for sampling in event initialization Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 14/88] hwmon: (ina2xx) Fix current value calculation Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 15/88] ASoC: dapm: Recalculate audio map forcely when card instantiated Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 16/88] hwmon: (w83795) temp4_type has writable permission Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 17/88] Btrfs: send, fix infinite loop due to directory rename dependencies Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 18/88] ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 19/88] ASoC: omap-dmic: Add pm_qos handling to avoid overruns " Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 20/88] exportfs: do not read dentry after free Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 21/88] bpf: fix check of allowed specifiers in bpf_trace_printk Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 22/88] USB: omap_udc: use devm_request_irq() Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 23/88] USB: omap_udc: fix crashes on probe error and module removal Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 24/88] USB: omap_udc: fix omap_udc_start() on 15xx machines Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 25/88] USB: omap_udc: fix USB gadget functionality on Palm Tungsten E Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 26/88] KVM: x86: fix empty-body warnings Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 27/88] net: thunderx: fix NULL pointer dereference in nic_remove Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 28/88] ixgbe: recognize 1000BaseLX SFP modules as 1Gbps Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 29/88] net: hisilicon: remove unexpected free_netdev Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 30/88] drm/ast: fixed reading monitor EDID not stable issue Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 31/88] xen: xlate_mmu: add missing header to fix W=1 warning Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 32/88] fscache: fix race between enablement and dropping of object Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 33/88] fscache, cachefiles: remove redundant variable cache Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 34/88] ocfs2: fix deadlock caused by ocfs2_defrag_extent() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 35/88] hfs: do not free node before using Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 36/88] hfsplus: " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 37/88] debugobjects: avoid recursive calls with kmemleak Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 38/88] ocfs2: fix potential use after free Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 39/88] pstore: Convert console write to use ->write_buf Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 40/88] ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 41/88] KVM: nVMX: fix msr bitmaps to prevent L2 from accessing L0 x2APIC Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 42/88] KVM: nVMX: mark vmcs12 pages dirty on L2 exit Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 43/88] KVM: nVMX: Eliminate vmcs02 pool Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 44/88] KVM: VMX: introduce alloc_loaded_vmcs Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 45/88] KVM: VMX: make MSR bitmaps per-VCPU Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 46/88] KVM/x86: Add IBPB support Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 47/88] KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 48/88] KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 49/88] KVM/SVM: " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 50/88] KVM/x86: Remove indirect MSR op calls from SPEC_CTRL Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 51/88] x86: reorganize SMAP handling in user space accesses Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 52/88] x86: fix SMAP in 32-bit environments Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 53/88] x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 54/88] x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end} Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 55/88] x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 56/88] x86/bugs, KVM: Support the combination of guest and host IBRS Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 57/88] x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 58/88] KVM: SVM: Move spec control call after restore of GS Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 59/88] x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 60/88] x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 61/88] KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 62/88] bpf: support 8-byte metafield access Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 63/88] bpf/verifier: Add spi variable to check_stack_write() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 64/88] bpf/verifier: Pass instruction index to check_mem_access() and check_xadd() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 65/88] bpf: Prevent memory disambiguation attack Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 66/88] wil6210: missing length check in wmi_set_ie Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 67/88] posix-timers: Sanitize overrun handling Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 68/88] mm/hugetlb.c: dont call region_abort if region_chg fails Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 69/88] hugetlbfs: fix offset overflow in hugetlbfs mmap Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 70/88] hugetlbfs: check for pgoff value overflow Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 71/88] hugetlbfs: fix bug in pgoff overflow checking Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 72/88] swiotlb: clean up reporting Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 73/88] sr: pass down correctly sized SCSI sense buffer Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 74/88] mm: remove write/force parameters from __get_user_pages_locked() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 75/88] mm: remove write/force parameters from __get_user_pages_unlocked() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 76/88] mm: replace get_user_pages_unlocked() write/force parameters with gup_flags Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 77/88] mm: replace get_user_pages_locked() " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 78/88] mm: replace get_vaddr_frames() " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 79/88] mm: replace get_user_pages() " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 80/88] mm: replace __access_remote_vm() write parameter " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 81/88] mm: replace access_remote_vm() " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 82/88] proc: dont use FOLL_FORCE for reading cmdline and environment Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 83/88] proc: do not access cmdline nor environ from file-backed areas Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 84/88] media: dvb-frontends: fix i2c access helpers for KASAN Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 85/88] matroxfb: fix size of memcpy Greg Kroah-Hartman
2018-12-14 12:01 ` [PATCH 4.4 86/88] staging: speakup: Replace strncpy with memcpy Greg Kroah-Hartman
2018-12-14 12:01 ` [PATCH 4.4 87/88] rocker: fix rocker_tlv_put_* functions for KASAN Greg Kroah-Hartman
2018-12-14 12:01 ` [PATCH 4.4 88/88] selftests: Move networking/timestamping from Documentation Greg Kroah-Hartman
2018-12-14 15:39 ` [PATCH 4.4 00/88] 4.4.168-stable review Guenter Roeck
2018-12-14 17:33 ` kernelci.org bot
2018-12-14 20:12 ` shuah
2018-12-15 2:10 ` Guenter Roeck
2018-12-15 8:07 ` Greg Kroah-Hartman
2018-12-15 15:45 ` Guenter Roeck
2018-12-16 23:58 ` Ben Hutchings
2018-12-17 9:05 ` Greg Kroah-Hartman
2018-12-17 13:46 ` Guenter Roeck
2018-12-17 19:08 ` Greg Kroah-Hartman
2018-12-17 20:12 ` Guenter Roeck
2018-12-17 20:52 ` Greg Kroah-Hartman
2018-12-15 11:15 ` Harsh Shandilya
2018-12-17 9:06 ` Greg Kroah-Hartman
2018-12-15 16:44 ` Dan Rue
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181214115702.427414823@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=bhole_prashant_q7@lab.ntt.co.jp \
--cc=cpaasch@apple.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tyhicks@canonical.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).