linux/net
Yan Zhai 876e8ca836 net: fix NULL pointer in skb_segment_list
Commit 3a1296a38d ("net: Support GRO/GSO fraglist chaining.")
introduced UDP listifyed GRO. The segmentation relies on frag_list being
untouched when passing through the network stack. This assumption can be
broken sometimes, where frag_list itself gets pulled into linear area,
leaving frag_list being NULL. When this happens it can trigger
following NULL pointer dereference, and panic the kernel. Reverse the
test condition should fix it.

[19185.577801][    C1] BUG: kernel NULL pointer dereference, address:
...
[19185.663775][    C1] RIP: 0010:skb_segment_list+0x1cc/0x390
...
[19185.834644][    C1] Call Trace:
[19185.841730][    C1]  <TASK>
[19185.848563][    C1]  __udp_gso_segment+0x33e/0x510
[19185.857370][    C1]  inet_gso_segment+0x15b/0x3e0
[19185.866059][    C1]  skb_mac_gso_segment+0x97/0x110
[19185.874939][    C1]  __skb_gso_segment+0xb2/0x160
[19185.883646][    C1]  udp_queue_rcv_skb+0xc3/0x1d0
[19185.892319][    C1]  udp_unicast_rcv_skb+0x75/0x90
[19185.900979][    C1]  ip_protocol_deliver_rcu+0xd2/0x200
[19185.910003][    C1]  ip_local_deliver_finish+0x44/0x60
[19185.918757][    C1]  __netif_receive_skb_one_core+0x8b/0xa0
[19185.927834][    C1]  process_backlog+0x88/0x130
[19185.935840][    C1]  __napi_poll+0x27/0x150
[19185.943447][    C1]  net_rx_action+0x27e/0x5f0
[19185.951331][    C1]  ? mlx5_cq_tasklet_cb+0x70/0x160 [mlx5_core]
[19185.960848][    C1]  __do_softirq+0xbc/0x25d
[19185.968607][    C1]  irq_exit_rcu+0x83/0xb0
[19185.976247][    C1]  common_interrupt+0x43/0xa0
[19185.984235][    C1]  asm_common_interrupt+0x22/0x40
...
[19186.094106][    C1]  </TASK>

Fixes: 3a1296a38d ("net: Support GRO/GSO fraglist chaining.")
Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Yan Zhai <yan@cloudflare.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/Y9gt5EUizK1UImEP@debian
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-01-31 21:07:04 -08:00
..
6lowpan
9p xen: branch for v6.2-rc4 2023-01-12 17:02:20 -06:00
802 treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
8021q net: Remove the obsolte u64_stats_fetch_*_irq() users (net). 2022-10-28 20:13:54 -07:00
appletalk
atm driver core: make struct class.dev_uevent() take a const * 2022-11-24 17:12:15 +01:00
ax25 ax25: af_ax25: Remove unnecessary (void*) conversions 2022-11-16 13:31:03 +00:00
batman-adv Networking changes for 6.2. 2022-12-13 15:47:48 -08:00
bluetooth Bluetooth: Fix possible deadlock in rfcomm_sk_state_change 2023-01-17 15:59:02 -08:00
bpf New Feature: 2022-12-17 14:06:53 -06:00
bpfilter
bridge treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
caif caif: fix memory leak in cfctrl_linkup_request() 2023-01-05 10:19:36 +01:00
can Networking changes for 6.2. 2022-12-13 15:47:48 -08:00
ceph Treewide: Stop corrupting socket's task_frag 2022-12-19 17:28:49 -08:00
core net: fix NULL pointer in skb_segment_list 2023-01-31 21:07:04 -08:00
dcb net: dcb: move getapptrust to separate function 2022-11-15 15:27:43 +01:00
dccp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-11-29 13:04:52 -08:00
dns_resolver cred: Do not default to init_cred in prepare_kernel_cred() 2022-11-01 10:04:52 -07:00
dsa Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-12-13 09:49:29 +01:00
ethernet net: ethernet: use sysfs_emit() to instead of scnprintf() 2022-12-07 20:02:44 -08:00
ethtool Revert "Merge branch 'ethtool-mac-merge'" 2023-01-24 17:44:14 +01:00
hsr hsr: Use a single struct for self_node. 2022-12-01 20:26:22 -08:00
ieee802154 Merge tag 'ieee802154-for-net-next-2022-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next 2022-12-07 17:33:26 -08:00
ife
ipv4 bpf-for-netdev 2023-01-27 23:32:03 -08:00
ipv6 ipv6: fix reachability confirmation with proxy_ndp 2023-01-23 11:17:37 +00:00
iucv
kcm kcm: close race conditions on sk_receive_queue 2022-11-15 12:42:26 +01:00
key Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 2022-11-29 20:50:51 -08:00
l2tp l2tp: prevent lockdep issue in l2tp_tunnel_register() 2023-01-18 14:44:54 +00:00
l3mdev
lapb
llc
mac80211 Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" 2023-01-16 17:28:52 +02:00
mac802154 mac802154: Fix possible double free upon parsing error 2022-12-19 11:38:12 +01:00
mctp net: mctp: purge receive queues on sk destruction 2023-01-28 00:26:09 -08:00
mpls net: Remove the obsolte u64_stats_fetch_*_irq() users (net). 2022-10-28 20:13:54 -07:00
mptcp mptcp: netlink: respect v4/v6-only sockets 2023-01-13 21:55:45 -08:00
ncsi net/ncsi: Silence runtime memcpy() false positive warning 2022-12-06 17:29:14 -08:00
netfilter netfilter: conntrack: unify established states for SCTP paths 2023-01-24 09:52:52 +01:00
netlabel
netlink netlink: annotate data races around sk_state 2023-01-23 21:35:53 -08:00
netrom netrom: Fix use-after-free caused by accept on already connected socket 2023-01-30 07:30:47 +00:00
nfc net: nfc: Fix use-after-free in local_cleanup() 2023-01-13 20:53:44 -08:00
nsh
openvswitch net: openvswitch: release vport resources on failure 2022-12-21 17:48:12 -08:00
packet Networking changes for 6.2. 2022-12-13 15:47:48 -08:00
phonet
psample
qrtr net: qrtr: free memory on error path in radix_tree_insert() 2023-01-28 00:21:32 -08:00
rds rds: remove redundant variable total_payload_len 2022-11-04 10:09:50 +00:00
rfkill driver core: make struct class.dev_uevent() take a const * 2022-11-24 17:12:15 +01:00
rose net/rose: Fix to not accept on connected socket 2023-01-28 00:19:57 -08:00
rxrpc rxrpc: Fix wrong error return in rxrpc_connect_call() 2023-01-12 21:51:55 -08:00
sched net: sched: sch: Bounds check priority 2023-01-31 10:37:58 +01:00
sctp sctp: do not check hb_timer.expires when resetting hb_timer 2023-01-31 21:01:28 -08:00
smc use less confusing names for iov_iter direction initializers 2022-11-25 13:01:55 -05:00
strparser
sunrpc nfsd-6.2 fixes: 2023-01-10 15:03:06 -06:00
switchdev
tipc tipc: fix unexpected link reset due to discovery messages 2023-01-06 12:53:10 +00:00
tls net/tls: tls_is_tx_ready() checked list_entry 2023-01-30 21:06:08 -08:00
unix unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() 2022-12-15 11:35:18 +01:00
vmw_vsock Networking changes for 6.2. 2022-12-13 15:47:48 -08:00
wireless Driver Core changes for 6.2-rc1 2022-12-16 03:54:54 -08:00
x25 net/x25: Fix to not accept on connected socket 2023-01-25 09:51:04 +00:00
xdp bpf: Expand map key argument of bpf_redirect_map to u64 2022-11-15 09:00:27 -08:00
xfrm Treewide: Stop corrupting socket's task_frag 2022-12-19 17:28:49 -08:00
compat.c use less confusing names for iov_iter direction initializers 2022-11-25 13:01:55 -05:00
devres.c
Kconfig
Kconfig.debug
Makefile
socket.c Networking changes for 6.2. 2022-12-13 15:47:48 -08:00
sysctl_net.c