iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/ipv6
History
Jianguo Wu 9a3bc8d16e seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors 
input_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for
PREROUTING hook, in PREROUTING hook, we should passing a valid indev,
and a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer
dereference, as below:

    [74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090
    [74830.655633] #PF: supervisor read access in kernel mode
    [74830.657888] #PF: error_code(0x0000) - not-present page
    [74830.659500] PGD 0 P4D 0
    [74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI
    ...
    [74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
    [74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]
    ...
    [74830.689725] Call Trace:
    [74830.690402]  <IRQ>
    [74830.690953]  ? show_trace_log_lvl+0x1c4/0x2df
    [74830.692020]  ? show_trace_log_lvl+0x1c4/0x2df
    [74830.693095]  ? ipt_do_table+0x286/0x710 [ip_tables]
    [74830.694275]  ? __die_body.cold+0x8/0xd
    [74830.695205]  ? page_fault_oops+0xac/0x140
    [74830.696244]  ? exc_page_fault+0x62/0x150
    [74830.697225]  ? asm_exc_page_fault+0x22/0x30
    [74830.698344]  ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]
    [74830.699540]  ipt_do_table+0x286/0x710 [ip_tables]
    [74830.700758]  ? ip6_route_input+0x19d/0x240
    [74830.701752]  nf_hook_slow+0x3f/0xb0
    [74830.702678]  input_action_end_dx4+0x19b/0x1e0
    [74830.703735]  ? input_action_end_t+0xe0/0xe0
    [74830.704734]  seg6_local_input_core+0x2d/0x60
    [74830.705782]  lwtunnel_input+0x5b/0xb0
    [74830.706690]  __netif_receive_skb_one_core+0x63/0xa0
    [74830.707825]  process_backlog+0x99/0x140
    [74830.709538]  __napi_poll+0x2c/0x160
    [74830.710673]  net_rx_action+0x296/0x350
    [74830.711860]  __do_softirq+0xcb/0x2ac
    [74830.713049]  do_softirq+0x63/0x90

input_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally
trigger a NULL dereference in rpfilter_mt()->rpfilter_is_loopback():

    static bool
    rpfilter_is_loopback(const struct sk_buff *skb,
          	       const struct net_device *in)
    {
            // in is NULL
            return skb->pkt_type == PACKET_LOOPBACK ||
          	 in->flags & IFF_LOOPBACK;
    }

Fixes: 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane")
Signed-off-by: Jianguo Wu <wujianguo@chinatelecom.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2024-06-19 16:26:42 +02:00
..
ila
ila: block BH in ila_output()
2024-06-03 18:50:09 -07:00
netfilter
netfilter: use NF_DROP instead of -NF_DROP
2024-05-06 16:29:21 +02:00
addrconf_core.c
ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
2024-01-30 12:43:18 +01:00
addrconf.c
net: ipv{6,4}: Remove the now superfluous sentinel elements from ctl_table array
2024-05-03 13:29:42 +01:00
addrlabel.c
ipv6: remove RTNL protection from ip6addrlbl_dump()
2024-04-08 11:01:05 +01:00
af_inet6.c
net: introduce include/net/rps.h
2024-03-07 21:12:43 -08:00
ah6.c
net: fill in MODULE_DESCRIPTION()s for ipv6 modules
2024-02-09 14:12:01 -08:00
anycast.c
ipv6: anycast: use call_rcu_hurry() in aca_put()
2024-05-01 11:46:21 +01:00
calipso.c
netlabel: remove impossible return value in netlbl_bitmap_walk
2024-02-28 19:37:34 -08:00
datagram.c
ipv6: annotate data-races around np->ucast_oif
2023-12-11 10:59:17 +00:00
esp6_offload.c
xfrm: Support GRO for IPv6 ESP in UDP encapsulation
2023-10-06 07:31:14 +02:00
esp6.c
ipsec-next-2024-05-03
2024-05-06 19:14:56 -07:00
exthdrs_core.c
ipv6: Fix out-of-bounds access in ipv6_find_tlv()
2023-05-24 08:43:39 +01:00
exthdrs_offload.c
net: gso: add HBH extension header offload support
2024-01-05 08:11:49 -08:00
exthdrs.c
net: ipv6: exthdrs: get rid of ipv6_skb_net()
2024-03-11 15:15:08 -07:00
fib6_notifier.c
…
fib6_rules.c
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
2024-05-08 18:50:53 -07:00
fou6.c
…
icmp.c
net: ipv{6,4}: Remove the now superfluous sentinel elements from ctl_table array
2024-05-03 13:29:42 +01:00
inet6_connection_sock.c
net: implement lockless SO_PRIORITY
2023-10-01 19:09:54 +01:00
inet6_hashtables.c
tcp: get rid of twsk_unique()
2024-05-09 20:25:55 -07:00
ioam6_iptunnel.c
ipv6: ioam: block BH from ioam6_output()
2024-06-03 18:50:08 -07:00
ioam6.c
ipv6/addrconf: annotate data-races around devconf fields (II)
2024-03-01 08:42:33 +00:00
ip6_checksum.c
…
ip6_fib.c
ipv6: fix possible race in __fib6_drop_pcpu_from()
2024-06-06 13:05:54 +02:00
ip6_flowlabel.c
ipv6: move np->repflow to atomic flags
2023-09-15 10:33:48 +01:00
ip6_gre.c
net: ip6_gre: Remove generic .ndo_get_stats64
2024-04-15 11:32:13 +01:00
ip6_icmp.c
…
ip6_input.c
ipv6/addrconf: annotate data-races around devconf fields (II)
2024-03-01 08:42:33 +00:00
ip6_offload.c
net: gro: initialize network_offset in network layer
2024-05-27 16:46:59 -07:00
ip6_offload.h
…
ip6_output.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-05-09 10:01:01 -07:00
ip6_tunnel.c
net: annotate writes on dev->mtu from ndo_change_mtu()
2024-05-07 16:19:14 -07:00
ip6_udp_tunnel.c
net: fill in MODULE_DESCRIPTION()s for ipv6 modules
2024-02-09 14:12:01 -08:00
ip6_vti.c
net: annotate writes on dev->mtu from ndo_change_mtu()
2024-05-07 16:19:14 -07:00
ip6mr.c
ipv6: introduce dst_rt6_info() helper
2024-04-29 13:32:01 +01:00
ipcomp6.c
xfrm: ipcomp: add extack to ipcomp{4,6}_init_state
2022-09-29 07:18:00 +02:00
ipv6_sockglue.c
inet: Add getsockopt support for IP_ROUTER_ALERT and IPV6_ROUTER_ALERT
2024-03-06 12:37:06 +00:00
Kconfig
ipv6: fix indentation of a config attribute
2023-08-16 10:03:08 +01:00
Makefile
net/tcp: Introduce TCP_AO setsockopt()s
2023-10-27 10:35:44 +01:00
mcast_snoop.c
…
mcast.c
ipv6/addrconf: annotate data-races around devconf fields (II)
2024-03-01 08:42:33 +00:00
mip6.c
net: fill in MODULE_DESCRIPTION()s for ipv6 modules
2024-02-09 14:12:01 -08:00
ndisc.c
ipv6: introduce dst_rt6_info() helper
2024-04-29 13:32:01 +01:00
netfilter.c
netfilter: Use flowlabel flow key when re-routing mangled packets
2024-06-11 18:46:04 +02:00
output_core.c
ipv6: annotate data-races around cnf.hop_limit
2024-03-01 08:42:31 +00:00
ping.c
ipv6: introduce dst_rt6_info() helper
2024-04-29 13:32:01 +01:00
proc.c
net: fix IPSTATS_MIB_OUTPKGS increment in OutForwDatagrams.
2023-10-20 12:01:00 +01:00
protocol.c
…
raw.c
ipv6: introduce dst_rt6_info() helper
2024-04-29 13:32:01 +01:00
reassembly.c
net: ipv6: fix wrong start position when receive hop-by-hop fragment
2024-05-10 10:04:06 +01:00
route.c
ipv6: prevent possible NULL dereference in rt6_probe()
2024-06-17 18:04:23 -07:00
rpl_iptunnel.c
net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
2024-06-03 18:50:08 -07:00
rpl.c
ipv6: rpl: Remove pskb(_may)?_pull() in ipv6_rpl_srh_rcv().
2023-06-19 11:32:58 -07:00
seg6_hmac.c
ipv6: sr: fix memleak in seg6_hmac_init_algo
2024-05-21 13:16:25 +02:00
seg6_iptunnel.c
ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
2024-06-03 18:50:08 -07:00
seg6_local.c
seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
2024-06-19 16:26:42 +02:00
seg6.c
ipv6: sr: fix invalid unregister error path
2024-05-10 19:27:46 -07:00
sit.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
syncookies.c
tcp: annotate data-races around tp->window_clamp
2024-04-05 22:32:37 -07:00
sysctl_net_ipv6.c
net: ipv{6,4}: Remove the now superfluous sentinel elements from ctl_table array
2024-05-03 13:29:42 +01:00
tcp_ao.c
net/tcp: Wire up l3index to TCP-AO
2023-10-27 10:35:46 +01:00
tcp_ipv6.c
tcp: fix race in tcp_v6_syn_recv_sock()
2024-06-10 13:11:22 +01:00
tcpv6_offload.c
net: gro: use cb instead of skb->network_header
2024-05-13 14:44:06 -07:00
tunnel6.c
net: fill in MODULE_DESCRIPTION()s for ipv6 modules
2024-02-09 14:12:01 -08:00
udp_impl.h
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2022-10-12 17:50:37 -07:00
udp_offload.c
net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb
2024-05-02 11:02:48 +02:00
udp.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-05-02 12:06:25 -07:00
udplite.c
udplite: remove UDPLITE_BIT
2023-09-14 16:16:36 +02:00
xfrm6_input.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-05-09 10:01:01 -07:00
xfrm6_output.c
ipv6: drop feature RTAX_FEATURE_ALLFRAG
2023-10-25 18:04:29 -07:00
xfrm6_policy.c
xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
2024-06-17 18:04:46 -07:00
xfrm6_protocol.c
…
xfrm6_state.c
…
xfrm6_tunnel.c
ipsec-next-2024-03-06
2024-03-08 10:56:05 +00:00