iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net
History
Hoang Le 310014f572 tipc: fix NULL deref in tipc_link_xmit() 
[ Upstream commit b77413446408fdd256599daf00d5be72b5f3e7c6 ]

The buffer list can have zero skb as following path:
tipc_named_node_up()->tipc_node_xmit()->tipc_link_xmit(), so
we need to check the list before casting an &sk_buff.

Fault report:
 [] tipc: Bulk publication failure
 [] general protection fault, probably for non-canonical [#1] PREEMPT [...]
 [] KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
 [] CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 5.10.0-rc4+ #2
 [] Hardware name: Bochs ..., BIOS Bochs 01/01/2011
 [] RIP: 0010:tipc_link_xmit+0xc1/0x2180
 [] Code: 24 b8 00 00 00 00 4d 39 ec 4c 0f 44 e8 e8 d7 0a 10 f9 48 [...]
 [] RSP: 0018:ffffc90000006ea0 EFLAGS: 00010202
 [] RAX: dffffc0000000000 RBX: ffff8880224da000 RCX: 1ffff11003d3cc0d
 [] RDX: 0000000000000019 RSI: ffffffff886007b9 RDI: 00000000000000c8
 [] RBP: ffffc90000007018 R08: 0000000000000001 R09: fffff52000000ded
 [] R10: 0000000000000003 R11: fffff52000000dec R12: ffffc90000007148
 [] R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90000007018
 [] FS:  0000000000000000(0000) GS:ffff888037400000(0000) knlGS:000[...]
 [] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 [] CR2: 00007fffd2db5000 CR3: 000000002b08f000 CR4: 00000000000006f0

Fixes: af9b028e270fd ("tipc: make media xmit call outside node spinlock context")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Link: https://lore.kernel.org/r/20210108071337.3598-1-hoang.h.le@dektech.com.au
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-23 15:38:19 +01:00
..
6lowpan
6lowpan: Off by one handling ->nexthdr
2020-01-29 10:24:22 +01:00
9p
net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
2020-11-10 10:23:54 +01:00
802
…
8021q
vlan: fix memory leak in vlan_dev_set_egress_priority
2020-01-12 11:24:27 +01:00
appletalk
appletalk: Set error code if register_snap_client failed
2019-12-21 10:41:45 +01:00
atm
atm: fix a memory leak of vcc->user_back
2020-10-01 20:40:12 +02:00
ax25
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 16:44:06 +02:00
batman-adv
batman-adv: set .owner to THIS_MODULE
2020-12-02 08:31:27 +01:00
bluetooth
Bluetooth: Fix null pointer dereference in hci_event_packet()
2020-12-29 13:44:53 +01:00
bridge
net: bridge: vlan: fix error return code in __vlan_add()
2020-12-29 13:44:48 +01:00
caif
caif: reduce stack size with KASAN
2019-05-08 07:19:07 +02:00
can
can: purge socket error queue on sock destruct
2019-07-10 09:55:33 +02:00
ceph
libceph: clear con->out_msg on Policy::stateful_server faults
2020-11-10 10:23:59 +01:00
core
net: avoid 32 x truesize under-estimation for tiny skbs
2021-01-23 15:38:18 +01:00
dcb
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
2021-01-23 15:38:18 +01:00
dccp
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-05-20 08:15:30 +02:00
decnet
decnet: fix DN_IFREQ_SIZE
2019-12-05 15:35:12 +01:00
dns_resolver
KEYS: DNS: fix parsing multiple options
2018-07-22 14:27:39 +02:00
dsa
net: dsa: tag_brcm: Fix skb->fwd_offload_mark location
2020-04-13 10:32:53 +02:00
ethernet
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
hsr
net/hsr: Check skb_put_padto() return value
2020-10-01 20:40:01 +02:00
ieee802154
nl802154: add missing attribute validation for dev_type
2020-03-20 09:07:39 +01:00
ipv4
net: fix pmtu check in nopmtudisc mode
2021-01-17 13:57:53 +01:00
ipv6
net: sit: unregister_netdevice on newlink's error path
2021-01-23 15:38:18 +01:00
ipx
ipx: call ipxitf_put() in ioctl error path
2017-05-25 15:44:41 +02:00
irda
irda: Only insert new objects into the global database via setsockopt
2018-09-15 09:43:01 +02:00
iucv
net/af_iucv: set correct sk_protocol for child sockets
2020-12-11 13:37:56 +01:00
kcm
kcm: switch order of device registration to fix a crash
2019-04-17 08:36:44 +02:00
key
af_key: pfkey_dump needs parameter validation
2020-10-01 20:39:59 +02:00
l2tp
l2tp: fix races with ipv4-mapped ipv6 addresses
2021-01-09 13:35:49 +01:00
l3mdev
…
lapb
lapb: fixed leak of control-blocks.
2019-06-22 08:17:22 +02:00
llc
llc: make sure applications use ARPHRD_ETHER
2020-07-22 09:10:47 +02:00
mac80211
mac80211: mesh: fix mesh_pathtbl_init() error path
2020-12-29 13:44:48 +01:00
mac802154
mac802154: tx: fix use-after-free
2020-10-01 20:40:18 +02:00
mpls
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2020-05-20 08:15:30 +02:00
ncsi
net/ncsi: Use real net-device for response handler
2021-01-12 19:49:01 +01:00
netfilter
netfilter: conntrack: fix reading nf_conntrack_buckets
2021-01-23 15:38:18 +01:00
netlabel
netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
2020-11-24 13:02:56 +01:00
netlink
genetlink: remove genl_bind
2020-07-22 09:10:48 +02:00
netrom
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-05-02 17:23:08 +02:00
nfc
nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()
2020-10-29 09:05:32 +01:00
openvswitch
openvswitch: handle DNAT tuple collision
2020-10-14 09:48:16 +02:00
packet
net/packet: fix overflow in tpacket_rcv
2020-10-14 09:48:13 +02:00
phonet
phonet: fix building with clang
2019-03-23 13:19:44 +01:00
qrtr
net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
2020-06-03 08:16:29 +02:00
rds
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-21 11:01:49 +02:00
rfkill
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 11:24:23 +01:00
rose
rose: Fix Null pointer dereference in rose_send_frame()
2020-12-11 13:37:56 +01:00
rxrpc
rxrpc: Fix handling of an unsupported token type in rxrpc_read()
2021-01-23 15:38:19 +01:00
sched
net: sched: prevent invalid Scell_log shift count
2021-01-12 19:49:02 +01:00
sctp
sctp: change to hold/put transport for proto_unreach_timer
2020-11-24 13:02:58 +01:00
strparser
strparser: Fix incorrect strp->need_bytes value.
2018-04-29 11:32:02 +02:00
sunrpc
net: sunrpc: interpret the return value of kstrtou32 correctly
2021-01-23 15:38:18 +01:00
switchdev
switchdev: Execute bridge ndos only for bridge ports
2016-10-19 10:58:04 -04:00
tipc
tipc: fix NULL deref in tipc_link_xmit()
2021-01-23 15:38:19 +01:00
unix
skbuff: fix a data race in skb_queue_len()
2020-10-01 20:40:06 +02:00
vmw_vsock
vsock: use ns_capable_noaudit() on socket create
2020-11-10 10:24:03 +01:00
wimax
…
wireless
cfg80211: initialize rekey_data
2020-12-29 13:45:02 +01:00
x25
net/x25: prevent a couple of overflows
2020-12-11 13:37:57 +01:00
xfrm
net: xfrm: fix a race condition during allocing spi
2020-11-18 18:26:23 +01:00
compat.c
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 11:02:08 +02:00
Kconfig
…
Makefile
…
socket.c
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-21 11:02:04 +02:00
sysctl_net.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2016-10-06 09:52:23 -07:00