From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Taras Chornyi <taras.chornyi@plvision.eu>,
Vadym Kochan <vadym.kochan@plvision.eu>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 5.6 05/71] net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin
Date: Mon, 20 Apr 2020 14:38:19 +0200 [thread overview]
Message-ID: <20200420121509.302929139@linuxfoundation.org> (raw)
In-Reply-To: <20200420121508.491252919@linuxfoundation.org>
From: Taras Chornyi <taras.chornyi@plvision.eu>
[ Upstream commit 690cc86321eb9bcee371710252742fb16fe96824 ]
When CONFIG_IP_MULTICAST is not set and multicast ip is added to the device
with autojoin flag or when multicast ip is deleted kernel will crash.
steps to reproduce:
ip addr add 224.0.0.0/32 dev eth0
ip addr del 224.0.0.0/32 dev eth0
or
ip addr add 224.0.0.0/32 dev eth0 autojoin
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088
pc : _raw_write_lock_irqsave+0x1e0/0x2ac
lr : lock_sock_nested+0x1c/0x60
Call trace:
_raw_write_lock_irqsave+0x1e0/0x2ac
lock_sock_nested+0x1c/0x60
ip_mc_config.isra.28+0x50/0xe0
inet_rtm_deladdr+0x1a8/0x1f0
rtnetlink_rcv_msg+0x120/0x350
netlink_rcv_skb+0x58/0x120
rtnetlink_rcv+0x14/0x20
netlink_unicast+0x1b8/0x270
netlink_sendmsg+0x1a0/0x3b0
____sys_sendmsg+0x248/0x290
___sys_sendmsg+0x80/0xc0
__sys_sendmsg+0x68/0xc0
__arm64_sys_sendmsg+0x20/0x30
el0_svc_common.constprop.2+0x88/0x150
do_el0_svc+0x20/0x80
el0_sync_handler+0x118/0x190
el0_sync+0x140/0x180
Fixes: 93a714d6b53d ("multicast: Extend ip address command to enable multicast group join/leave on")
Signed-off-by: Taras Chornyi <taras.chornyi@plvision.eu>
Signed-off-by: Vadym Kochan <vadym.kochan@plvision.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/devinet.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -614,12 +614,15 @@ struct in_ifaddr *inet_ifa_byprefix(stru
return NULL;
}
-static int ip_mc_config(struct sock *sk, bool join, const struct in_ifaddr *ifa)
+static int ip_mc_autojoin_config(struct net *net, bool join,
+ const struct in_ifaddr *ifa)
{
+#if defined(CONFIG_IP_MULTICAST)
struct ip_mreqn mreq = {
.imr_multiaddr.s_addr = ifa->ifa_address,
.imr_ifindex = ifa->ifa_dev->dev->ifindex,
};
+ struct sock *sk = net->ipv4.mc_autojoin_sk;
int ret;
ASSERT_RTNL();
@@ -632,6 +635,9 @@ static int ip_mc_config(struct sock *sk,
release_sock(sk);
return ret;
+#else
+ return -EOPNOTSUPP;
+#endif
}
static int inet_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh,
@@ -675,7 +681,7 @@ static int inet_rtm_deladdr(struct sk_bu
continue;
if (ipv4_is_multicast(ifa->ifa_address))
- ip_mc_config(net->ipv4.mc_autojoin_sk, false, ifa);
+ ip_mc_autojoin_config(net, false, ifa);
__inet_del_ifa(in_dev, ifap, 1, nlh, NETLINK_CB(skb).portid);
return 0;
}
@@ -940,8 +946,7 @@ static int inet_rtm_newaddr(struct sk_bu
*/
set_ifa_lifetime(ifa, valid_lft, prefered_lft);
if (ifa->ifa_flags & IFA_F_MCAUTOJOIN) {
- int ret = ip_mc_config(net->ipv4.mc_autojoin_sk,
- true, ifa);
+ int ret = ip_mc_autojoin_config(net, true, ifa);
if (ret < 0) {
inet_free_ifa(ifa);
next prev parent reply other threads:[~2020-04-20 12:43 UTC|newest]
Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-20 12:38 [PATCH 5.6 00/71] 5.6.6-rc1 review Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 01/71] amd-xgbe: Use __napi_schedule() in BH context Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 02/71] hsr: check protocol version in hsr_newlink() Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 03/71] l2tp: Allow management of tunnels and session in user namespace Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 04/71] net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode Greg Kroah-Hartman
2020-04-20 12:38 ` Greg Kroah-Hartman [this message]
2020-04-20 12:38 ` [PATCH 5.6 06/71] net: ipv6: do not consider routes via gateways for anycast address check Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 07/71] net: macsec: fix using wrong structure in macsec_changelink() Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 08/71] net: phy: micrel: use genphy_read_status for KSZ9131 Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 09/71] net: qrtr: send msgs from local of same id as broadcast Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 10/71] net: revert default NAPI poll timeout to 2 jiffies Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 11/71] net: tun: record RX queue in skb before do_xdp_generic() Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 12/71] net: dsa: mt7530: move mt7623 settings out off the mt7530 Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 13/71] net: ethernet: mediatek: " Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 14/71] net/mlx5: Fix frequent ioread PCI access during recovery Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 15/71] net/mlx5e: Add missing release firmware call Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 16/71] net/mlx5e: Fix nest_level for vlan pop action Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 17/71] net/mlx5e: Fix pfnum in devlink port attribute Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 18/71] net: icmp6: do not select saddr from iif when route has prefsrc set Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 19/71] net: mscc: ocelot: fix untagged packet drops when enslaving to vlan aware bridge Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 20/71] net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 21/71] net: phy: marvell: Fix pause frame negotiation Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 22/71] Revert "ACPI: EC: Do not clear boot_ec_is_ecdt in acpi_ec_add()" Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 23/71] ovl: fix value of i_ino for lower hardlink corner case Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 24/71] scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 25/71] platform/chrome: cros_ec_rpmsg: Fix race with host event Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 26/71] jbd2: improve comments about freeing data buffers whose page mapping is NULL Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 27/71] acpi/nfit: improve bounds checking for func Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 28/71] perf report: Fix no branch type statistics report issue Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 29/71] pwm: pca9685: Fix PWM/GPIO inter-operation Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 30/71] net: stmmac: xgmac: Fix VLAN register handling Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 31/71] net/bpfilter: remove superfluous testing message Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 32/71] ext4: fix incorrect group count in ext4_fill_super error message Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 33/71] ext4: fix incorrect inodes per group in " Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 34/71] HID: lg-g15: Do not fail the probe when we fail to disable F# emulation Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 35/71] clk: at91: sam9x60: fix usb clock parents Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 36/71] clk: at91: usb: use proper usbs_mask Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 37/71] ARM: dts: imx7-colibri: fix muxing of usbc_det pin Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 38/71] arm64: dts: librem5-devkit: add a vbus supply to usb0 Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 39/71] usb: dwc3: gadget: Dont clear flags before transfer ended Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 40/71] ASoC: Intel: mrfld: fix incorrect check on p->sink Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 41/71] ASoC: Intel: mrfld: return error codes when an error occurs Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 42/71] ALSA: hda: Allow setting preallocation again for x86 Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 43/71] ALSA: hda/realtek - Enable the headset mic on Asus FX505DT Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 44/71] ALSA: usb-audio: Filter error from connector kctl ops, too Greg Kroah-Hartman
2020-04-20 12:38 ` [PATCH 5.6 45/71] ALSA: usb-audio: Dont override ignore_ctl_error value from the map Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 46/71] ALSA: usb-audio: Dont create jack controls for PCM terminals Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 47/71] ALSA: usb-audio: Check mapping at creating connector controls, too Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 48/71] arm64: vdso: dont free unallocated pages Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 49/71] keys: Fix proc_keys_next to increase position index Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 50/71] tracing: Fix the race between registering snapshot event trigger and triggering snapshot operation Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 51/71] btrfs: check commit root generation in should_ignore_root Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 52/71] nl80211: fix NL80211_ATTR_FTM_RESPONDER policy Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 53/71] mac80211: fix race in ieee80211_register_hw() Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 54/71] mac80211_hwsim: Use kstrndup() in place of kasprintf() Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 55/71] net/mlx5e: Encapsulate updating netdev queues into a function Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 56/71] net/mlx5e: Rename hw_modify to preactivate Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 57/71] net/mlx5e: Use preactivate hook to set the indirection table Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 58/71] drm/amd/powerplay: force the trim of the mclk dpm_levels if OD is enabled Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 59/71] drm/amdgpu/gfx9: add gfxoff quirk Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 60/71] drm/amdgpu: fix the hw hang during perform system reboot and reset Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 61/71] i2c: designware: platdrv: Remove DPM_FLAG_SMART_SUSPEND flag on BYT and CHT Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 62/71] drm/nouveau/sec2/gv100-: add missing MODULE_FIRMWARE() Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 63/71] drm/i915/perf: Do not clear pollin for small user read buffers Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 64/71] rcu: Dont acquire lock in NMI handler in rcu_nmi_enter_common() Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 65/71] ext4: do not zeroout extents beyond i_disksize Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 66/71] irqchip/ti-sci-inta: Fix processing of masked irqs Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 67/71] proc, time/namespace: Show clock symbolic names in /proc/pid/timens_offsets Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 68/71] x86/resctrl: Preserve CDP enable over CPU hotplug Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 69/71] x86/resctrl: Fix invalid attempt at removing the default resource group Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 70/71] x86/microcode/AMD: Increase microcode PATCH_MAX_SIZE Greg Kroah-Hartman
2020-04-20 12:39 ` [PATCH 5.6 71/71] scsi: target: iscsi: calling iscsit_stop_session() inside iscsit_close_session() has no effect Greg Kroah-Hartman
2020-04-20 17:31 ` [PATCH 5.6 00/71] 5.6.6-rc1 review Naresh Kamboju
2020-04-20 19:53 ` Guenter Roeck
2020-04-21 9:55 ` Greg Kroah-Hartman
2020-04-21 9:55 ` Jon Hunter
2020-04-21 13:22 ` Greg Kroah-Hartman
2020-04-21 16:49 ` shuah
2020-04-21 18:42 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200420121509.302929139@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=taras.chornyi@plvision.eu \
--cc=vadym.kochan@plvision.eu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).