iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7b50ee3dad
linux/net/tipc
History
Hoang Huu Le 7b50ee3dad tipc: fix NULL pointer dereference in tipc_named_rcv 
In the function node_lost_contact(), we call __skb_queue_purge() without
grabbing the list->lock. This can cause to a race-condition why processing
the list 'namedq' in calling path tipc_named_rcv()->tipc_named_dequeue().

    [] BUG: kernel NULL pointer dereference, address: 0000000000000000
    [] #PF: supervisor read access in kernel mode
    [] #PF: error_code(0x0000) - not-present page
    [] PGD 7ca63067 P4D 7ca63067 PUD 6c553067 PMD 0
    [] Oops: 0000 [#1] SMP NOPTI
    [] CPU: 1 PID: 15 Comm: ksoftirqd/1 Tainted: G  O  5.9.0-rc6+ #2
    [] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS [...]
    [] RIP: 0010:tipc_named_rcv+0x103/0x320 [tipc]
    [] Code: 41 89 44 24 10 49 8b 16 49 8b 46 08 49 c7 06 00 00 00 [...]
    [] RSP: 0018:ffffc900000a7c58 EFLAGS: 00000282
    [] RAX: 00000000000012ec RBX: 0000000000000000 RCX: ffff88807bde1270
    [] RDX: 0000000000002c7c RSI: 0000000000002c7c RDI: ffff88807b38f1a8
    [] RBP: ffff88807b006288 R08: ffff88806a367800 R09: ffff88806a367900
    [] R10: ffff88806a367a00 R11: ffff88806a367b00 R12: ffff88807b006258
    [] R13: ffff88807b00628a R14: ffff888069334d00 R15: ffff88806a434600
    [] FS:  0000000000000000(0000) GS:ffff888079480000(0000) knlGS:0[...]
    [] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [] CR2: 0000000000000000 CR3: 0000000077320000 CR4: 00000000000006e0
    [] Call Trace:
    []  ? tipc_bcast_rcv+0x9a/0x1a0 [tipc]
    []  tipc_rcv+0x40d/0x670 [tipc]
    []  ? _raw_spin_unlock+0xa/0x20
    []  tipc_l2_rcv_msg+0x55/0x80 [tipc]
    []  __netif_receive_skb_one_core+0x8c/0xa0
    []  process_backlog+0x98/0x140
    []  net_rx_action+0x13a/0x420
    []  __do_softirq+0xdb/0x316
    []  ? smpboot_thread_fn+0x2f/0x1e0
    []  ? smpboot_thread_fn+0x74/0x1e0
    []  ? smpboot_thread_fn+0x14e/0x1e0
    []  run_ksoftirqd+0x1a/0x40
    []  smpboot_thread_fn+0x149/0x1e0
    []  ? sort_range+0x20/0x20
    []  kthread+0x131/0x150
    []  ? kthread_unuse_mm+0xa0/0xa0
    []  ret_from_fork+0x22/0x30
    [] Modules linked in: veth tipc(O) ip6_udp_tunnel udp_tunnel [...]
    [] CR2: 0000000000000000
    [] ---[ end trace 65c276a8e2e2f310 ]---

To fix this, we need to grab the lock of the 'namedq' list on both
path calling.

Fixes: cad2929dc4 ("tipc: update a binding service via broadcast")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Hoang Huu Le <hoang.h.le@dektech.com.au>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-10-09 18:29:06 -07:00
..
addr.c tipc: initialise addr_trail_end when setting node addresses 2019-08-11 21:40:04 -07:00
addr.h
bcast.c tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
bcast.h tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
bearer.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
bearer.h tipc: introduce variable window congestion control 2019-12-10 17:31:15 -08:00
core.c tipc: fix ordering of tipc module init and exit routine 2019-12-06 12:01:09 -08:00
core.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-16 21:51:42 -08:00
crypto.c tipc: fix using smp_processor_id() in preemptible 2020-08-30 19:12:17 -07:00
crypto.h tipc: introduce TIPC encryption & authentication 2019-11-08 14:01:59 -08:00
diag.c tipc: switch to rhashtable iterator 2018-08-29 18:04:54 -07:00
discover.c net: tipc: kerneldoc fixes 2020-07-13 17:20:40 -07:00
discover.h
eth_media.c tipc: Use is_broadcast_ether_addr() instead of memcmp() 2020-08-03 16:21:46 -07:00
group.c tipc: Fix memory leak in tipc_group_create_member() 2020-09-14 16:36:20 -07:00
group.h tipc: extend sock diag for group communication 2018-06-30 21:05:42 +09:00
ib_media.c tipc: introduce variable window congestion control 2019-12-10 17:31:15 -08:00
Kconfig tipc: not enable tipc when ipv6 works as a module 2020-08-16 21:04:55 -07:00
link.c net: tipc: kerneldoc fixes 2020-09-15 13:33:04 -07:00
link.h tipc: add support for broadcast rcv stats dumping 2020-05-26 15:16:52 -07:00
Makefile tipc: remove meaningless assignment in Makefile 2020-01-08 12:38:54 -08:00
monitor.c tipc: add NULL pointer check to prevent kernel oops 2020-03-15 00:07:00 -07:00
monitor.h tipc: update mon's self addr when node addr generated 2019-11-12 19:45:45 -08:00
msg.c tipc: fix the skb_unshare() in tipc_buf_append() 2020-10-09 18:22:56 -07:00
msg.h tipc: Use struct_size() helper 2020-06-19 20:15:25 -07:00
name_distr.c tipc: fix NULL pointer dereference in tipc_named_rcv 2020-10-09 18:29:06 -07:00
name_distr.h tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
name_table.c tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
name_table.h tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
net.c tipc: make legacy address flag readable over netlink 2019-12-20 21:18:42 -08:00
net.h tipc: make legacy address flag readable over netlink 2019-12-20 21:18:42 -08:00
netlink_compat.c tipc: fix uninit skb->data in tipc_nl_compat_dumpit() 2020-08-16 21:03:19 -07:00
netlink.c tipc: add support for broadcast rcv stats dumping 2020-05-26 15:16:52 -07:00
netlink.h net: tipc: allocate attrs locally instead of using genl_family_attrbuf in compat_dumpit() 2019-10-06 15:44:47 +02:00
node.c tipc: fix NULL pointer dereference in tipc_named_rcv 2020-10-09 18:29:06 -07:00
node.h tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
socket.c tipc: fix shutdown() of connection oriented socket 2020-09-10 12:21:39 -07:00
socket.h tipc: call tsk_set_importance from tipc_topsrv_create_listener 2020-05-28 11:11:46 -07:00
subscr.c
subscr.h tipc: fix failed service subscription deletion 2020-05-13 12:33:19 -07:00
sysctl.c tipc: enable broadcast retrans via unicast 2020-05-26 15:16:52 -07:00
topsrv.c tipc: call tsk_set_importance from tipc_topsrv_create_listener 2020-05-28 11:11:46 -07:00
topsrv.h
trace.c tipc: remove unneeded semicolon in trace.c 2019-01-17 22:04:43 -08:00
trace.h tipc: add support for broadcast rcv stats dumping 2020-05-26 15:16:52 -07:00
udp_media.c ipv6: some fixes for ipv6_dev_find() 2020-08-18 15:58:53 -07:00
udp_media.h tipc: implement configuration of UDP media MTU 2018-04-20 11:04:05 -04:00