* [PATCH net] gtp: fix an use-before-init in gtp_newlink()
@ 2020-10-24 15:42 Masahiro Fujiwara
2020-10-25 21:05 ` Jakub Kicinski
0 siblings, 1 reply; 8+ messages in thread
From: Masahiro Fujiwara @ 2020-10-24 15:42 UTC (permalink / raw)
To: Pablo Neira Ayuso, Harald Welte
Cc: fujiwara.masahiro, David S. Miller, Jakub Kicinski,
Andreas Schultz, osmocom-net-gprs, netdev, linux-kernel
*_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
sends GTP packets while creating new GTP device.
RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
<SNIP>
Call Trace:
<IRQ>
gtp_encap_recv+0xc2/0x2e0 [gtp]
? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
udp_queue_rcv_one_skb+0x1fe/0x530
udp_queue_rcv_skb+0x40/0x1b0
udp_unicast_rcv_skb.isra.0+0x78/0x90
__udp4_lib_rcv+0x5af/0xc70
udp_rcv+0x1a/0x20
ip_protocol_deliver_rcu+0xc5/0x1b0
ip_local_deliver_finish+0x48/0x50
ip_local_deliver+0xe5/0xf0
? ip_protocol_deliver_rcu+0x1b0/0x1b0
gtp_encap_enable() should be called after gtp_hastable_new() otherwise
*_pdp_find() will access the uninitialized hash table.
Fixes: 1e3a3abd8 ("gtp: make GTP sockets in gtp_newlink optional")
Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
---
drivers/net/gtp.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 8e47d0112e5d..6c56337b02a3 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -663,10 +663,6 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
gtp = netdev_priv(dev);
- err = gtp_encap_enable(gtp, data);
- if (err < 0)
- return err;
-
if (!data[IFLA_GTP_PDP_HASHSIZE]) {
hashsize = 1024;
} else {
@@ -676,13 +672,18 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
}
err = gtp_hashtable_new(gtp, hashsize);
+ if (err < 0) {
+ return err;
+ }
+
+ err = gtp_encap_enable(gtp, data);
if (err < 0)
goto out_encap;
err = register_netdevice(dev);
if (err < 0) {
netdev_dbg(dev, "failed to register new netdev %d\n", err);
- goto out_hashtable;
+ goto out_encap;
}
gn = net_generic(dev_net(dev), gtp_net_id);
@@ -693,11 +694,10 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
return 0;
-out_hashtable:
- kfree(gtp->addr_hash);
- kfree(gtp->tid_hash);
out_encap:
gtp_encap_disable(gtp);
+ kfree(gtp->addr_hash);
+ kfree(gtp->tid_hash);
return err;
}
--
2.24.3
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH net] gtp: fix an use-before-init in gtp_newlink()
2020-10-24 15:42 [PATCH net] gtp: fix an use-before-init in gtp_newlink() Masahiro Fujiwara
@ 2020-10-25 21:05 ` Jakub Kicinski
2020-10-26 6:37 ` Masahiro Fujiwara
2020-10-26 7:22 ` [PATCH v2 " Masahiro Fujiwara
0 siblings, 2 replies; 8+ messages in thread
From: Jakub Kicinski @ 2020-10-25 21:05 UTC (permalink / raw)
To: Masahiro Fujiwara
Cc: Pablo Neira Ayuso, Harald Welte, David S. Miller,
Andreas Schultz, osmocom-net-gprs, netdev, linux-kernel
On Sat, 24 Oct 2020 15:42:33 +0000 Masahiro Fujiwara wrote:
> *_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
> sends GTP packets while creating new GTP device.
>
> RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
> <SNIP>
> Call Trace:
> <IRQ>
> gtp_encap_recv+0xc2/0x2e0 [gtp]
> ? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
> udp_queue_rcv_one_skb+0x1fe/0x530
> udp_queue_rcv_skb+0x40/0x1b0
> udp_unicast_rcv_skb.isra.0+0x78/0x90
> __udp4_lib_rcv+0x5af/0xc70
> udp_rcv+0x1a/0x20
> ip_protocol_deliver_rcu+0xc5/0x1b0
> ip_local_deliver_finish+0x48/0x50
> ip_local_deliver+0xe5/0xf0
> ? ip_protocol_deliver_rcu+0x1b0/0x1b0
>
> gtp_encap_enable() should be called after gtp_hastable_new() otherwise
> *_pdp_find() will access the uninitialized hash table.
Looks good, minor nits:
- is the time zone broken on your system? Looks like your email has
arrived with the date far in the past, so the build systems have
missed it. Could you double check the time on your system?
> Fixes: 1e3a3abd8 ("gtp: make GTP sockets in gtp_newlink optional")
The hash looks short, should be at lest 12 chars:
Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
> Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
> diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
> index 8e47d0112e5d..6c56337b02a3 100644
> --- a/drivers/net/gtp.c
> +++ b/drivers/net/gtp.c
> @@ -663,10 +663,6 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
>
> gtp = netdev_priv(dev);
>
> - err = gtp_encap_enable(gtp, data);
> - if (err < 0)
> - return err;
> -
> if (!data[IFLA_GTP_PDP_HASHSIZE]) {
> hashsize = 1024;
> } else {
> @@ -676,13 +672,18 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
> }
>
> err = gtp_hashtable_new(gtp, hashsize);
> + if (err < 0) {
> + return err;
> + }
no need for braces around single statement
> +
> + err = gtp_encap_enable(gtp, data);
> if (err < 0)
> goto out_encap;
>
> err = register_netdevice(dev);
> if (err < 0) {
> netdev_dbg(dev, "failed to register new netdev %d\n", err);
> - goto out_hashtable;
> + goto out_encap;
> }
>
> gn = net_generic(dev_net(dev), gtp_net_id);
> @@ -693,11 +694,10 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
>
> return 0;
>
> -out_hashtable:
> - kfree(gtp->addr_hash);
> - kfree(gtp->tid_hash);
> out_encap:
> gtp_encap_disable(gtp);
I'd personally move the out_hashtable: label here and keep it, just for
clarity. Otherwise reader has to double check that gtp_encap_disable()
can be safely called before gtp_encap_enable().
Also gtp_encap_disable() could change in the future breaking this
assumption.
> + kfree(gtp->addr_hash);
> + kfree(gtp->tid_hash);
> return err;
> }
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH net] gtp: fix an use-before-init in gtp_newlink()
2020-10-25 21:05 ` Jakub Kicinski
@ 2020-10-26 6:37 ` Masahiro Fujiwara
2020-10-26 7:22 ` [PATCH v2 " Masahiro Fujiwara
1 sibling, 0 replies; 8+ messages in thread
From: Masahiro Fujiwara @ 2020-10-26 6:37 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Pablo Neira Ayuso, Harald Welte, David S. Miller,
Andreas Schultz, osmocom-net-gprs, netdev, linux-kernel
Hi,
Thanks for the review. Will send a new patch with the fixes soon.
----
Fujiwara
On Mon, Oct 26, 2020 at 6:05 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Sat, 24 Oct 2020 15:42:33 +0000 Masahiro Fujiwara wrote:
> > *_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
> > sends GTP packets while creating new GTP device.
> >
> > RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
> > <SNIP>
> > Call Trace:
> > <IRQ>
> > gtp_encap_recv+0xc2/0x2e0 [gtp]
> > ? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
> > udp_queue_rcv_one_skb+0x1fe/0x530
> > udp_queue_rcv_skb+0x40/0x1b0
> > udp_unicast_rcv_skb.isra.0+0x78/0x90
> > __udp4_lib_rcv+0x5af/0xc70
> > udp_rcv+0x1a/0x20
> > ip_protocol_deliver_rcu+0xc5/0x1b0
> > ip_local_deliver_finish+0x48/0x50
> > ip_local_deliver+0xe5/0xf0
> > ? ip_protocol_deliver_rcu+0x1b0/0x1b0
> >
> > gtp_encap_enable() should be called after gtp_hastable_new() otherwise
> > *_pdp_find() will access the uninitialized hash table.
>
> Looks good, minor nits:
>
> - is the time zone broken on your system? Looks like your email has
> arrived with the date far in the past, so the build systems have
> missed it. Could you double check the time on your system?
>
> > Fixes: 1e3a3abd8 ("gtp: make GTP sockets in gtp_newlink optional")
>
> The hash looks short, should be at lest 12 chars:
>
> Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
>
> > Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
>
> > diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
> > index 8e47d0112e5d..6c56337b02a3 100644
> > --- a/drivers/net/gtp.c
> > +++ b/drivers/net/gtp.c
> > @@ -663,10 +663,6 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
> >
> > gtp = netdev_priv(dev);
> >
> > - err = gtp_encap_enable(gtp, data);
> > - if (err < 0)
> > - return err;
> > -
> > if (!data[IFLA_GTP_PDP_HASHSIZE]) {
> > hashsize = 1024;
> > } else {
> > @@ -676,13 +672,18 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
> > }
> >
> > err = gtp_hashtable_new(gtp, hashsize);
> > + if (err < 0) {
> > + return err;
> > + }
>
> no need for braces around single statement
>
> > +
> > + err = gtp_encap_enable(gtp, data);
> > if (err < 0)
> > goto out_encap;
> >
> > err = register_netdevice(dev);
> > if (err < 0) {
> > netdev_dbg(dev, "failed to register new netdev %d\n", err);
> > - goto out_hashtable;
> > + goto out_encap;
> > }
> >
> > gn = net_generic(dev_net(dev), gtp_net_id);
> > @@ -693,11 +694,10 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
> >
> > return 0;
> >
> > -out_hashtable:
> > - kfree(gtp->addr_hash);
> > - kfree(gtp->tid_hash);
> > out_encap:
> > gtp_encap_disable(gtp);
>
> I'd personally move the out_hashtable: label here and keep it, just for
> clarity. Otherwise reader has to double check that gtp_encap_disable()
> can be safely called before gtp_encap_enable().
>
> Also gtp_encap_disable() could change in the future breaking this
> assumption.
>
> > + kfree(gtp->addr_hash);
> > + kfree(gtp->tid_hash);
> > return err;
> > }
> >
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v2 net] gtp: fix an use-before-init in gtp_newlink()
2020-10-25 21:05 ` Jakub Kicinski
2020-10-26 6:37 ` Masahiro Fujiwara
@ 2020-10-26 7:22 ` Masahiro Fujiwara
2020-10-26 18:46 ` Jakub Kicinski
1 sibling, 1 reply; 8+ messages in thread
From: Masahiro Fujiwara @ 2020-10-26 7:22 UTC (permalink / raw)
To: Pablo Neira Ayuso, Harald Welte
Cc: fujiwara.masahiro, David S. Miller, Jakub Kicinski,
Andreas Schultz, osmocom-net-gprs, netdev, linux-kernel
*_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
sends GTP packets while creating new GTP device.
RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
<SNIP>
Call Trace:
<IRQ>
gtp_encap_recv+0xc2/0x2e0 [gtp]
? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
udp_queue_rcv_one_skb+0x1fe/0x530
udp_queue_rcv_skb+0x40/0x1b0
udp_unicast_rcv_skb.isra.0+0x78/0x90
__udp4_lib_rcv+0x5af/0xc70
udp_rcv+0x1a/0x20
ip_protocol_deliver_rcu+0xc5/0x1b0
ip_local_deliver_finish+0x48/0x50
ip_local_deliver+0xe5/0xf0
? ip_protocol_deliver_rcu+0x1b0/0x1b0
gtp_encap_enable() should be called after gtp_hastable_new() otherwise
*_pdp_find() will access the uninitialized hash table.
Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
---
v2:
- leave out_hashtable: label for clarity (Jakub).
- fix code and comment styles.
drivers/net/gtp.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 8e47d0112e5d..07cb6d9495e8 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -663,10 +663,6 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
gtp = netdev_priv(dev);
- err = gtp_encap_enable(gtp, data);
- if (err < 0)
- return err;
-
if (!data[IFLA_GTP_PDP_HASHSIZE]) {
hashsize = 1024;
} else {
@@ -676,13 +672,17 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
}
err = gtp_hashtable_new(gtp, hashsize);
+ if (err < 0)
+ return err;
+
+ err = gtp_encap_enable(gtp, data);
if (err < 0)
goto out_encap;
err = register_netdevice(dev);
if (err < 0) {
netdev_dbg(dev, "failed to register new netdev %d\n", err);
- goto out_hashtable;
+ goto out_encap;
}
gn = net_generic(dev_net(dev), gtp_net_id);
@@ -693,11 +693,11 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
return 0;
+out_encap:
+ gtp_encap_disable(gtp);
out_hashtable:
kfree(gtp->addr_hash);
kfree(gtp->tid_hash);
-out_encap:
- gtp_encap_disable(gtp);
return err;
}
--
2.24.3
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH v2 net] gtp: fix an use-before-init in gtp_newlink()
2020-10-26 7:22 ` [PATCH v2 " Masahiro Fujiwara
@ 2020-10-26 18:46 ` Jakub Kicinski
2020-10-27 11:30 ` [PATCH v3] " Masahiro Fujiwara
2020-10-27 11:48 ` [PATCH v3 net] " Masahiro Fujiwara
0 siblings, 2 replies; 8+ messages in thread
From: Jakub Kicinski @ 2020-10-26 18:46 UTC (permalink / raw)
To: Masahiro Fujiwara
Cc: Pablo Neira Ayuso, Harald Welte, David S. Miller,
Andreas Schultz, osmocom-net-gprs, netdev, linux-kernel
On Mon, 26 Oct 2020 16:22:27 +0900 Masahiro Fujiwara wrote:
> v2:
> - leave out_hashtable: label for clarity (Jakub).
> - fix code and comment styles.
Thanks!
> diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
> index 8e47d0112e5d..07cb6d9495e8 100644
> --- a/drivers/net/gtp.c
> +++ b/drivers/net/gtp.c
> @@ -663,10 +663,6 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
>
> gtp = netdev_priv(dev);
>
> - err = gtp_encap_enable(gtp, data);
> - if (err < 0)
> - return err;
> -
> if (!data[IFLA_GTP_PDP_HASHSIZE]) {
> hashsize = 1024;
> } else {
> @@ -676,13 +672,17 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
> }
>
> err = gtp_hashtable_new(gtp, hashsize);
> + if (err < 0)
> + return err;
> +
> + err = gtp_encap_enable(gtp, data);
> if (err < 0)
> goto out_encap;
This needs to say goto out_hashtable; now.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v3] gtp: fix an use-before-init in gtp_newlink()
2020-10-26 18:46 ` Jakub Kicinski
@ 2020-10-27 11:30 ` Masahiro Fujiwara
2020-10-27 11:48 ` [PATCH v3 net] " Masahiro Fujiwara
1 sibling, 0 replies; 8+ messages in thread
From: Masahiro Fujiwara @ 2020-10-27 11:30 UTC (permalink / raw)
To: Pablo Neira Ayuso, Harald Welte
Cc: fujiwara.masahiro, David S. Miller, Jakub Kicinski,
Andreas Schultz, osmocom-net-gprs, netdev, linux-kernel
*_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
sends GTP packets while creating new GTP device.
RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
<SNIP>
Call Trace:
<IRQ>
gtp_encap_recv+0xc2/0x2e0 [gtp]
? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
udp_queue_rcv_one_skb+0x1fe/0x530
udp_queue_rcv_skb+0x40/0x1b0
udp_unicast_rcv_skb.isra.0+0x78/0x90
__udp4_lib_rcv+0x5af/0xc70
udp_rcv+0x1a/0x20
ip_protocol_deliver_rcu+0xc5/0x1b0
ip_local_deliver_finish+0x48/0x50
ip_local_deliver+0xe5/0xf0
? ip_protocol_deliver_rcu+0x1b0/0x1b0
gtp_encap_enable() should be called after gtp_hastable_new() otherwise
*_pdp_find() will access the uninitialized hash table.
v2:
- Leave out_hashtable: label for clarity (Jakub).
- Fix code and comment styles.
Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
---
v3:
- Fix goto err label.
drivers/net/gtp.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 8e47d0112e5d..10f910f8cbe5 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -663,10 +663,6 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
gtp = netdev_priv(dev);
- err = gtp_encap_enable(gtp, data);
- if (err < 0)
- return err;
-
if (!data[IFLA_GTP_PDP_HASHSIZE]) {
hashsize = 1024;
} else {
@@ -677,12 +673,16 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
err = gtp_hashtable_new(gtp, hashsize);
if (err < 0)
- goto out_encap;
+ return err;
+
+ err = gtp_encap_enable(gtp, data);
+ if (err < 0)
+ goto out_hashtable;
err = register_netdevice(dev);
if (err < 0) {
netdev_dbg(dev, "failed to register new netdev %d\n", err);
- goto out_hashtable;
+ goto out_encap;
}
gn = net_generic(dev_net(dev), gtp_net_id);
@@ -693,11 +693,11 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
return 0;
+out_encap:
+ gtp_encap_disable(gtp);
out_hashtable:
kfree(gtp->addr_hash);
kfree(gtp->tid_hash);
-out_encap:
- gtp_encap_disable(gtp);
return err;
}
--
2.24.3
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v3 net] gtp: fix an use-before-init in gtp_newlink()
2020-10-26 18:46 ` Jakub Kicinski
2020-10-27 11:30 ` [PATCH v3] " Masahiro Fujiwara
@ 2020-10-27 11:48 ` Masahiro Fujiwara
2020-10-29 16:46 ` Jakub Kicinski
1 sibling, 1 reply; 8+ messages in thread
From: Masahiro Fujiwara @ 2020-10-27 11:48 UTC (permalink / raw)
To: Pablo Neira Ayuso, Harald Welte
Cc: fujiwara.masahiro, David S. Miller, Jakub Kicinski,
Andreas Schultz, osmocom-net-gprs, netdev, linux-kernel
*_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
sends GTP packets while creating new GTP device.
RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
<SNIP>
Call Trace:
<IRQ>
gtp_encap_recv+0xc2/0x2e0 [gtp]
? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
udp_queue_rcv_one_skb+0x1fe/0x530
udp_queue_rcv_skb+0x40/0x1b0
udp_unicast_rcv_skb.isra.0+0x78/0x90
__udp4_lib_rcv+0x5af/0xc70
udp_rcv+0x1a/0x20
ip_protocol_deliver_rcu+0xc5/0x1b0
ip_local_deliver_finish+0x48/0x50
ip_local_deliver+0xe5/0xf0
? ip_protocol_deliver_rcu+0x1b0/0x1b0
gtp_encap_enable() should be called after gtp_hastable_new() otherwise
*_pdp_find() will access the uninitialized hash table.
Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
---
v3:
- Fix goto err label.
drivers/net/gtp.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 8e47d0112e5d..10f910f8cbe5 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -663,10 +663,6 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
gtp = netdev_priv(dev);
- err = gtp_encap_enable(gtp, data);
- if (err < 0)
- return err;
-
if (!data[IFLA_GTP_PDP_HASHSIZE]) {
hashsize = 1024;
} else {
@@ -677,12 +673,16 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
err = gtp_hashtable_new(gtp, hashsize);
if (err < 0)
- goto out_encap;
+ return err;
+
+ err = gtp_encap_enable(gtp, data);
+ if (err < 0)
+ goto out_hashtable;
err = register_netdevice(dev);
if (err < 0) {
netdev_dbg(dev, "failed to register new netdev %d\n", err);
- goto out_hashtable;
+ goto out_encap;
}
gn = net_generic(dev_net(dev), gtp_net_id);
@@ -693,11 +693,11 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
return 0;
+out_encap:
+ gtp_encap_disable(gtp);
out_hashtable:
kfree(gtp->addr_hash);
kfree(gtp->tid_hash);
-out_encap:
- gtp_encap_disable(gtp);
return err;
}
--
2.24.3
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH v3 net] gtp: fix an use-before-init in gtp_newlink()
2020-10-27 11:48 ` [PATCH v3 net] " Masahiro Fujiwara
@ 2020-10-29 16:46 ` Jakub Kicinski
0 siblings, 0 replies; 8+ messages in thread
From: Jakub Kicinski @ 2020-10-29 16:46 UTC (permalink / raw)
To: Masahiro Fujiwara
Cc: Pablo Neira Ayuso, Harald Welte, David S. Miller,
Andreas Schultz, osmocom-net-gprs, netdev, linux-kernel
On Tue, 27 Oct 2020 20:48:46 +0900 Masahiro Fujiwara wrote:
> *_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
> sends GTP packets while creating new GTP device.
>
> RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
> <SNIP>
> Call Trace:
> <IRQ>
> gtp_encap_recv+0xc2/0x2e0 [gtp]
> ? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
> udp_queue_rcv_one_skb+0x1fe/0x530
> udp_queue_rcv_skb+0x40/0x1b0
> udp_unicast_rcv_skb.isra.0+0x78/0x90
> __udp4_lib_rcv+0x5af/0xc70
> udp_rcv+0x1a/0x20
> ip_protocol_deliver_rcu+0xc5/0x1b0
> ip_local_deliver_finish+0x48/0x50
> ip_local_deliver+0xe5/0xf0
> ? ip_protocol_deliver_rcu+0x1b0/0x1b0
>
> gtp_encap_enable() should be called after gtp_hastable_new() otherwise
> *_pdp_find() will access the uninitialized hash table.
>
> Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
> Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
Applied, thank you!
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-10-29 16:46 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-24 15:42 [PATCH net] gtp: fix an use-before-init in gtp_newlink() Masahiro Fujiwara
2020-10-25 21:05 ` Jakub Kicinski
2020-10-26 6:37 ` Masahiro Fujiwara
2020-10-26 7:22 ` [PATCH v2 " Masahiro Fujiwara
2020-10-26 18:46 ` Jakub Kicinski
2020-10-27 11:30 ` [PATCH v3] " Masahiro Fujiwara
2020-10-27 11:48 ` [PATCH v3 net] " Masahiro Fujiwara
2020-10-29 16:46 ` Jakub Kicinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).