From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Xin Long <lucien.xin@gmail.com>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL for 3.18 042/101] dccp: call inet_add_protocol after register_pernet_subsys in dccp_v4_init
Date: Mon, 9 Apr 2018 00:35:52 +0000 [thread overview]
Message-ID: <20180409003505.164715-42-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20180409003505.164715-1-alexander.levin@microsoft.com>
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit d5494acb88aa9dd1325079c9b8855008a52c19b3 ]
Now dccp_ipv4 works as a kernel module. During loading this module, if
one dccp packet is being recieved after inet_add_protocol but before
register_pernet_subsys in which v4_ctl_sk is initialized, a null pointer
dereference may be triggered because of init_net.dccp.v4_ctl_sk is 0x0.
Jianlin found this issue when the following call trace occurred:
[ 171.950177] BUG: unable to handle kernel NULL pointer dereference at 0000000000000110
[ 171.951007] IP: [<ffffffffc0558364>] dccp_v4_ctl_send_reset+0xc4/0x220 [dccp_ipv4]
[...]
[ 171.984629] Call Trace:
[ 171.984859] <IRQ>
[ 171.985061]
[ 171.985213] [<ffffffffc0559a53>] dccp_v4_rcv+0x383/0x3f9 [dccp_ipv4]
[ 171.985711] [<ffffffff815ca054>] ip_local_deliver_finish+0xb4/0x1f0
[ 171.986309] [<ffffffff815ca339>] ip_local_deliver+0x59/0xd0
[ 171.986852] [<ffffffff810cd7a4>] ? update_curr+0x104/0x190
[ 171.986956] [<ffffffff815c9cda>] ip_rcv_finish+0x8a/0x350
[ 171.986956] [<ffffffff815ca666>] ip_rcv+0x2b6/0x410
[ 171.986956] [<ffffffff810c83b4>] ? task_cputime+0x44/0x80
[ 171.986956] [<ffffffff81586f22>] __netif_receive_skb_core+0x572/0x7c0
[ 171.986956] [<ffffffff810d2c51>] ? trigger_load_balance+0x61/0x1e0
[ 171.986956] [<ffffffff81587188>] __netif_receive_skb+0x18/0x60
[ 171.986956] [<ffffffff8158841e>] process_backlog+0xae/0x180
[ 171.986956] [<ffffffff8158799d>] net_rx_action+0x16d/0x380
[ 171.986956] [<ffffffff81090b7f>] __do_softirq+0xef/0x280
[ 171.986956] [<ffffffff816b6a1c>] call_softirq+0x1c/0x30
This patch is to move inet_add_protocol after register_pernet_subsys in
dccp_v4_init, so that v4_ctl_sk is initialized before any incoming dccp
packets are processed.
Reported-by: Jianlin Shi <jishi@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
net/dccp/ipv4.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 502d9a885329..adce7f5d4f07 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -1051,33 +1051,34 @@ static int __init dccp_v4_init(void)
{
int err = proto_register(&dccp_v4_prot, 1);
- if (err != 0)
+ if (err)
goto out;
- err = inet_add_protocol(&dccp_v4_protocol, IPPROTO_DCCP);
- if (err != 0)
- goto out_proto_unregister;
-
inet_register_protosw(&dccp_v4_protosw);
err = register_pernet_subsys(&dccp_v4_ops);
if (err)
goto out_destroy_ctl_sock;
+
+ err = inet_add_protocol(&dccp_v4_protocol, IPPROTO_DCCP);
+ if (err)
+ goto out_proto_unregister;
+
out:
return err;
+out_proto_unregister:
+ unregister_pernet_subsys(&dccp_v4_ops);
out_destroy_ctl_sock:
inet_unregister_protosw(&dccp_v4_protosw);
- inet_del_protocol(&dccp_v4_protocol, IPPROTO_DCCP);
-out_proto_unregister:
proto_unregister(&dccp_v4_prot);
goto out;
}
static void __exit dccp_v4_exit(void)
{
+ inet_del_protocol(&dccp_v4_protocol, IPPROTO_DCCP);
unregister_pernet_subsys(&dccp_v4_ops);
inet_unregister_protosw(&dccp_v4_protosw);
- inet_del_protocol(&dccp_v4_protocol, IPPROTO_DCCP);
proto_unregister(&dccp_v4_prot);
}
--
2.15.1
next prev parent reply other threads:[~2018-04-09 0:40 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-09 0:35 [PATCH AUTOSEL for 3.18 001/101] ALSA: timer: Wrap with spinlock for queue access Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 002/101] e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 003/101] perf/core: Correct event creation with PERF_FORMAT_GROUP Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 004/101] MIPS: mm: fixed mappings: correct initialisation Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 005/101] MIPS: kprobes: flush_insn_slot should flush only if probe initialised Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 006/101] net: emac: fix reset timeout with AR8035 phy Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 007/101] perf tests: Decompress kernel module before objdump Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 008/101] xen: avoid type warning in xchg_xen_ulong Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 009/101] KEYS: put keyring if install_session_keyring_to_cred() fails Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 010/101] bnx2x: Allow vfs to disable txvlan offload Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 011/101] sctp: fix recursive locking warning in sctp_do_peeloff Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 012/101] sparc64: ldc abort during vds iso boot Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 013/101] iio: magnetometer: st_magn_spi: fix spi_device_id table Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 014/101] Bluetooth: Send HCI Set Event Mask Page 2 command only when needed Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 015/101] ACPICA: Events: Add runtime stub support for event APIs Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 016/101] ACPICA: Disassembler: Abort on an invalid/unknown AML opcode Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 017/101] s390/dasd: Display read-only attribute correctly Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 018/101] vxlan: dont migrate permanent fdb entries during learn Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 019/101] scsi: csiostor: Avoid content leaks and casts Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 020/101] scsi: megaraid: Fix a sleep-in-atomic bug Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 021/101] scsi: lpfc: Fix return value of board_mode store routine in case of online failure Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 022/101] usb: usbip tool: Check the return of get_nports() Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 023/101] usb: usbip tool: Fix refresh_imported_device_list() Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 024/101] PCI: Correct PCI_STD_RESOURCE_END usage Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 025/101] PCI: Add domain number check to find_smbios_instance_string() Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 026/101] mtd: handle partitioning on devices with 0 erasesize Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 027/101] platform/x86: acer-wmi: Detect RF Button capability Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 028/101] caif: Add sockaddr length check before accessing sa_family in connect handler Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 029/101] ixgbe: avoid permanent lock of *_PTP_TX_IN_PROGRESS Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 030/101] net_sched: move tcf_lock down after gen_replace_estimator() Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 031/101] PCI: Protect pci_error_handlers->reset_notify() usage with device_lock() Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 032/101] firmware: dmi_scan: Check DMI structure length Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 033/101] i2c: ismt: fix wrong device address when unmap the data buffer Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 034/101] drm/mgag200: Fix to always set HiPri for G200e4 V2 Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 035/101] r8152: add byte_enable for ocp_read_word function Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 036/101] Btrfs: skip commit transaction if we don't have enough pinned bytes Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 037/101] scsi: lpfc: Fix crash after firmware flash when IO is running Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 038/101] mmc: sdhci-esdhc: Add SDHCI_QUIRK_32BIT_DMA_ADDR Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 039/101] x86/nmi: Fix timeout test in test_nmi_ipi() Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 040/101] arm64: pass machine size to sparse Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 041/101] fib_rules: Resolve goto rules target on delete Sasha Levin
2018-04-09 0:35 ` Sasha Levin [this message]
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 043/101] arm64: ptrace: Fix VFP register dumping in compat coredumps Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 044/101] veth: Be more robust on network device creation when no attributes Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 045/101] macvlan: Do not return error when setting the same mac address Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 046/101] sctp: adjust ssthresh when transport is idle Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 047/101] arm64: pass endianness info to sparse Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 048/101] scsi: bnx2i: missing error code in bnx2i_ep_connect() Sasha Levin
2018-04-09 0:35 ` [PATCH AUTOSEL for 3.18 049/101] powerpc: Fix /proc/cpuinfo revision for POWER9 DD2 Sasha Levin
2018-04-09 0:36 ` [PATCH AUTOSEL for 3.18 050/101] ACPI: EC: Fix EC command visibility for dynamic debug Sasha Levin
2018-04-09 0:36 ` [PATCH AUTOSEL for 3.18 051/101] scsi: sun_esp: fix device reference leaks Sasha Levin
2018-04-09 0:41 ` [PATCH AUTOSEL for 3.18 052/101] powerpc/fadump: avoid duplicates in crash memory ranges Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180409003505.164715-42-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=lucien.xin@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).