Yan Zhai
6446369fb9
net: fix NULL pointer in skb_segment_list ...
commit 876e8ca8366735a604bac86ff7e2732fc9d85d2d upstream.
Commit 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
introduced UDP listifyed GRO. The segmentation relies on frag_list being
untouched when passing through the network stack. This assumption can be
broken sometimes, where frag_list itself gets pulled into linear area,
leaving frag_list being NULL. When this happens it can trigger
following NULL pointer dereference, and panic the kernel. Reverse the
test condition should fix it.
[19185.577801][ C1] BUG: kernel NULL pointer dereference, address:
...
[19185.663775][ C1] RIP: 0010:skb_segment_list+0x1cc/0x390
...
[19185.834644][ C1] Call Trace:
[19185.841730][ C1] <TASK>
[19185.848563][ C1] __udp_gso_segment+0x33e/0x510
[19185.857370][ C1] inet_gso_segment+0x15b/0x3e0
[19185.866059][ C1] skb_mac_gso_segment+0x97/0x110
[19185.874939][ C1] __skb_gso_segment+0xb2/0x160
[19185.883646][ C1] udp_queue_rcv_skb+0xc3/0x1d0
[19185.892319][ C1] udp_unicast_rcv_skb+0x75/0x90
[19185.900979][ C1] ip_protocol_deliver_rcu+0xd2/0x200
[19185.910003][ C1] ip_local_deliver_finish+0x44/0x60
[19185.918757][ C1] __netif_receive_skb_one_core+0x8b/0xa0
[19185.927834][ C1] process_backlog+0x88/0x130
[19185.935840][ C1] __napi_poll+0x27/0x150
[19185.943447][ C1] net_rx_action+0x27e/0x5f0
[19185.951331][ C1] ? mlx5_cq_tasklet_cb+0x70/0x160 [mlx5_core]
[19185.960848][ C1] __do_softirq+0xbc/0x25d
[19185.968607][ C1] irq_exit_rcu+0x83/0xb0
[19185.976247][ C1] common_interrupt+0x43/0xa0
[19185.984235][ C1] asm_common_interrupt+0x22/0x40
...
[19186.094106][ C1] </TASK>
Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Yan Zhai <yan@cloudflare.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/Y9gt5EUizK1UImEP@debian
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-06 07:56:16 +01:00
2021-09-15 09:50:34 +02:00
2022-12-14 11:31:54 +01:00
2023-01-14 10:16:18 +01:00
2022-07-29 17:19:07 +02:00
2021-04-07 15:00:08 +02:00
2022-10-30 09:41:16 +01:00
2022-06-22 14:13:17 +02:00
2022-05-18 10:23:42 +02:00
2023-02-06 07:56:16 +01:00
2023-01-14 10:15:31 +01:00
2021-07-14 16:56:29 +02:00
2022-12-02 17:39:57 +01:00
2023-01-14 10:16:48 +01:00
2022-12-14 11:31:59 +01:00
2022-05-25 09:17:56 +02:00
2023-02-06 07:56:16 +01:00
2022-03-08 19:09:37 +01:00
2022-12-02 17:40:01 +01:00
2022-08-31 17:15:19 +02:00
2022-12-14 11:32:01 +01:00
2023-01-24 07:19:55 +01:00
2023-01-14 10:15:37 +01:00
2022-11-03 23:57:51 +09:00
2023-02-01 08:23:25 +01:00
2023-01-18 11:44:55 +01:00
2021-03-07 12:34:05 +01:00
2022-11-25 17:45:56 +01:00
2022-12-02 17:39:58 +01:00
2023-02-01 08:23:14 +01:00
2022-04-27 13:53:50 +02:00
2021-02-10 09:29:14 +01:00
2022-03-28 09:57:10 +02:00
2023-01-24 07:20:01 +01:00
2022-12-14 11:32:01 +01:00
2022-09-08 11:11:40 +02:00
2023-01-14 10:16:52 +01:00
2022-01-05 12:40:32 +01:00
2023-02-01 08:23:27 +01:00
2022-04-13 21:01:00 +02:00
2023-02-01 08:23:24 +01:00
2023-02-01 08:23:25 +01:00
2023-02-01 08:23:12 +01:00
2023-01-14 10:16:12 +01:00
2023-01-14 10:16:29 +01:00
2022-01-11 15:25:01 +01:00
2021-03-07 12:34:07 +01:00
2022-08-25 11:38:23 +02:00
2022-10-26 13:25:23 +02:00
2020-11-12 09:18:06 +01:00
2022-11-10 18:14:19 +01:00
2023-01-14 10:16:12 +01:00
2023-02-01 08:23:25 +01:00
2023-02-01 08:23:25 +01:00
2022-09-28 11:10:36 +02:00
2021-11-18 14:04:27 +01:00
2023-01-14 10:16:44 +01:00
2021-02-07 15:37:12 +01:00
2023-01-18 11:44:58 +01:00
2022-08-03 12:00:46 +02:00
2022-12-14 11:32:01 +01:00
2023-01-14 10:15:42 +01:00
2023-01-14 10:15:36 +01:00
2022-11-25 17:45:47 +01:00
2022-10-15 07:55:51 +02:00
2023-01-18 11:44:57 +01:00
2021-06-18 10:00:06 +02:00
2023-01-04 11:39:24 +01:00
6446369fb9