From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Vasily Gorbik <gor@linux.ibm.com>,
Ursula Braun <ubraun@linux.ibm.com>,
Julian Wiedmann <jwi@linux.ibm.com>,
Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 4.14 59/85] net/af_iucv: fix null pointer dereference on shutdown
Date: Tue, 17 Nov 2020 14:05:28 +0100 [thread overview]
Message-ID: <20201117122113.926875822@linuxfoundation.org> (raw)
In-Reply-To: <20201117122111.018425544@linuxfoundation.org>
From: Ursula Braun <ubraun@linux.ibm.com>
[ Upstream commit 4031eeafa71eaf22ae40a15606a134ae86345daf ]
syzbot reported the following KASAN finding:
BUG: KASAN: nullptr-dereference in iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
Read of size 2 at addr 000000000000021e by task syz-executor907/519
CPU: 0 PID: 519 Comm: syz-executor907 Not tainted 5.9.0-syzkaller-07043-gbcf9877ad213 #0
Hardware name: IBM 3906 M04 701 (KVM/Linux)
Call Trace:
[<00000000c576af60>] unwind_start arch/s390/include/asm/unwind.h:65 [inline]
[<00000000c576af60>] show_stack+0x180/0x228 arch/s390/kernel/dumpstack.c:135
[<00000000c9dcd1f8>] __dump_stack lib/dump_stack.c:77 [inline]
[<00000000c9dcd1f8>] dump_stack+0x268/0x2f0 lib/dump_stack.c:118
[<00000000c5fed016>] print_address_description.constprop.0+0x5e/0x218 mm/kasan/report.c:383
[<00000000c5fec82a>] __kasan_report mm/kasan/report.c:517 [inline]
[<00000000c5fec82a>] kasan_report+0x11a/0x168 mm/kasan/report.c:534
[<00000000c98b5b60>] iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
[<00000000c98b6262>] iucv_sock_shutdown+0x44a/0x4c0 net/iucv/af_iucv.c:1457
[<00000000c89d3a54>] __sys_shutdown+0x12c/0x1c8 net/socket.c:2204
[<00000000c89d3b70>] __do_sys_shutdown net/socket.c:2212 [inline]
[<00000000c89d3b70>] __s390x_sys_shutdown+0x38/0x48 net/socket.c:2210
[<00000000c9e36eac>] system_call+0xe0/0x28c arch/s390/kernel/entry.S:415
There is nothing to shutdown if a connection has never been established.
Besides that iucv->hs_dev is not yet initialized if a socket is in
IUCV_OPEN state and iucv->path is not yet initialized if socket is in
IUCV_BOUND state.
So, just skip the shutdown calls for a socket in these states.
Fixes: eac3731bd04c ("[S390]: Add AF_IUCV socket support")
Fixes: 82492a355fac ("af_iucv: add shutdown for HS transport")
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
[jwi: correct one Fixes tag]
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/iucv/af_iucv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1552,7 +1552,8 @@ static int iucv_sock_shutdown(struct soc
break;
}
- if (how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) {
+ if ((how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) &&
+ sk->sk_state == IUCV_CONNECTED) {
if (iucv->transport == AF_IUCV_TRANS_IUCV) {
txmsg.class = 0;
txmsg.tag = 0;
next prev parent reply other threads:[~2020-11-17 13:16 UTC|newest]
Thread overview: 88+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-17 13:04 [PATCH 4.14 00/85] 4.14.207-rc1 review Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 01/85] regulator: defer probe when trying to get voltage from unresolved supply Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 02/85] ring-buffer: Fix recursion protection transitions between interrupt context Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 03/85] mm: mempolicy: fix potential pte_unmap_unlock pte error Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 04/85] time: Prevent undefined behaviour in timespec64_to_ns() Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 05/85] nbd: dont update block size after device is started Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 06/85] btrfs: sysfs: init devices outside of the chunk_mutex Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 07/85] btrfs: reschedule when cloning lots of extents Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 08/85] genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 09/85] hv_balloon: disable warning when floor reached Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 10/85] net: xfrm: fix a race condition during allocing spi Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 11/85] perf tools: Add missing swap for ino_generation Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 12/85] ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 13/85] can: rx-offload: dont call kfree_skb() from IRQ context Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 14/85] can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard " Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 15/85] can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 16/85] can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 17/85] can: peak_usb: add range checking in decode operations Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 18/85] can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 19/85] can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 20/85] xfs: flush new eof page on truncate to avoid post-eof corruption Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 21/85] Btrfs: fix missing error return if writeback for extent buffer never started Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 22/85] ath9k_htc: Use appropriate rs_datalen type Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 23/85] usb: gadget: goku_udc: fix potential crashes in probe Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 24/85] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 25/85] gfs2: Add missing truncate_inode_pages_final for sd_aspace Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 26/85] gfs2: check for live vs. read-only file system in gfs2_fitrim Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 27/85] scsi: hpsa: Fix memory leak in hpsa_init_one() Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 28/85] drm/amdgpu: perform srbm soft reset always on SDMA resume Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 29/85] mac80211: fix use of skb payload instead of header Greg Kroah-Hartman
2020-11-17 13:04 ` [PATCH 4.14 30/85] mac80211: always wind down STA state Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 31/85] cfg80211: regulatory: Fix inconsistent format argument Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 32/85] scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 33/85] iommu/amd: Increase interrupt remapping table limit to 512 entries Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 34/85] pinctrl: intel: Set default bias in case no particular value given Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 35/85] ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 36/85] pinctrl: aspeed: Fix GPI only function problem Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 37/85] nbd: fix a block_device refcount leak in nbd_release Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 38/85] xfs: fix flags argument to rmap lookup when converting shared file rmaps Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 39/85] xfs: fix rmap key and record comparison functions Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 40/85] xfs: fix a missing unlock on error in xfs_fs_map_blocks Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 41/85] of/address: Fix of_node memory leak in of_dma_is_coherent Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 42/85] cosa: Add missing kfree in error path of cosa_write Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 43/85] perf: Fix get_recursion_context() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 44/85] ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 45/85] ext4: unlock xattr_sem properly in ext4_inline_data_truncate() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 46/85] thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 47/85] uio: Fix use-after-free in uio_unregister_device() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 48/85] usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 49/85] mei: protect mei_cl_mtu from null dereference Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 50/85] futex: Dont enable IRQs unconditionally in put_pi_state() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 51/85] ocfs2: initialize ip_next_orphan Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 52/85] selinux: Fix error return code in sel_ib_pkey_sid_slow() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 53/85] dont dump the threads that had been already exiting when zapped Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 54/85] drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 55/85] pinctrl: amd: use higher precision for 512 RtcClk Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 56/85] pinctrl: amd: fix incorrect way to disable debounce filter Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 57/85] swiotlb: fix "x86: Dont panic if can not alloc buffer for swiotlb" Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 58/85] IPv6: Set SIT tunnel hard_header_len to zero Greg Kroah-Hartman
2020-11-17 13:05 ` Greg Kroah-Hartman [this message]
2020-11-17 13:05 ` [PATCH 4.14 60/85] net/x25: Fix null-ptr-deref in x25_connect Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 61/85] vrf: Fix fast path output packet handling with async Netfilter rules Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 62/85] r8169: fix potential skb double free in an error path Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 63/85] net: Update window_clamp if SOCK_RCVBUF is set Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 64/85] random32: make prandom_u32() output unpredictable Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 65/85] x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 66/85] perf/core: Fix bad use of igrab() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 67/85] perf/core: Fix crash when using HW tracing kernel filters Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 68/85] perf/core: Fix a memory leak in perf_event_parse_addr_filter() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 69/85] xen/events: avoid removing an event channel while handling it Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 70/85] xen/events: add a proper barrier to 2-level uevent unmasking Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 71/85] xen/events: fix race in evtchn_fifo_unmask() Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 72/85] xen/events: add a new "late EOI" evtchn framework Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 73/85] xen/blkback: use lateeoi irq binding Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 74/85] xen/netback: " Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 75/85] xen/scsiback: " Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 76/85] xen/pvcallsback: " Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 77/85] xen/pciback: " Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 78/85] xen/events: switch user event channels to lateeoi model Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 79/85] xen/events: use a common cpu hotplug hook for event channels Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 80/85] xen/events: defer eoi in case of excessive number of events Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 81/85] xen/events: block rogue events for some time Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 82/85] perf/core: Fix race in the perf_mmap_close() function Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 83/85] Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 84/85] reboot: fix overflow parsing reboot cpu number Greg Kroah-Hartman
2020-11-17 13:05 ` [PATCH 4.14 85/85] Convert trailing spaces and periods in path components Greg Kroah-Hartman
2020-11-18 8:34 ` [PATCH 4.14 00/85] 4.14.207-rc1 review Naresh Kamboju
2020-11-18 15:22 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201117122113.926875822@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=gor@linux.ibm.com \
--cc=jwi@linux.ibm.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=ubraun@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).