iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net
History
Vegard Nossum 4be4511af7 tipc: fix NULL pointer dereference in shutdown() 
[ Upstream commit d2fbdf76b85bcdfe57b8ef2ba09d20e8ada79abd ]

tipc_msg_create() can return a NULL skb and if so, we shouldn't try to
call tipc_node_xmit_skb() on it.

    general protection fault: 0000 [#1] PREEMPT SMP KASAN
    CPU: 3 PID: 30298 Comm: trinity-c0 Not tainted 4.7.0-rc7+ #19
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
    task: ffff8800baf09980 ti: ffff8800595b8000 task.ti: ffff8800595b8000
    RIP: 0010:[<ffffffff830bb46b>]  [<ffffffff830bb46b>] tipc_node_xmit_skb+0x6b/0x140
    RSP: 0018:ffff8800595bfce8  EFLAGS: 00010246
    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003023b0e0
    RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffffffff83d12580
    RBP: ffff8800595bfd78 R08: ffffed000b2b7f32 R09: 0000000000000000
    R10: fffffbfff0759725 R11: 0000000000000000 R12: 1ffff1000b2b7f9f
    R13: ffff8800595bfd58 R14: ffffffff83d12580 R15: dffffc0000000000
    FS:  00007fcdde242700(0000) GS:ffff88011af80000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007fcddde1db10 CR3: 000000006874b000 CR4: 00000000000006e0
    DR0: 00007fcdde248000 DR1: 00007fcddd73d000 DR2: 00007fcdde248000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000090602
    Stack:
     0000000000000018 0000000000000018 0000000041b58ab3 ffffffff83954208
     ffffffff830bb400 ffff8800595bfd30 ffffffff8309d767 0000000000000018
     0000000000000018 ffff8800595bfd78 ffffffff8309da1a 00000000810ee611
    Call Trace:
     [<ffffffff830c84a3>] tipc_shutdown+0x553/0x880
     [<ffffffff825b4a3b>] SyS_shutdown+0x14b/0x170
     [<ffffffff8100334c>] do_syscall_64+0x19c/0x410
     [<ffffffff83295ca5>] entry_SYSCALL64_slow_path+0x25/0x25
    Code: 90 00 b4 0b 83 c7 00 f1 f1 f1 f1 4c 8d 6d e0 c7 40 04 00 00 00 f4 c7 40 08 f3 f3 f3 f3 48 89 d8 48 c1 e8 03 c7 45 b4 00 00 00 00 <80> 3c 30 00 75 78 48 8d 7b 08 49 8d 75 c0 48 b8 00 00 00 00 00
    RIP  [<ffffffff830bb46b>] tipc_node_xmit_skb+0x6b/0x140
     RSP <ffff8800595bfce8>
    ---[ end trace 57b0484e351e71f1 ]---

I feel like we should maybe return -ENOMEM or -ENOBUFS, but I'm not sure
userspace is equipped to handle that. Anyway, this is better than a GPF
and looks somewhat consistent with other tipc_msg_create() callers.

Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-09-30 10:18:36 +02:00
..
6lowpan
6lowpan: put mcast compression in an own function
2015-10-21 00:49:25 +02:00
9p
IB/cma: Add support for network namespaces
2015-10-28 12:32:48 -04:00
802
…
8021q
vlan: Do not put vlan headers back on bridge and macvlan ports
2015-11-17 14:38:35 -05:00
appletalk
net: Pass kern from net_proto_family.create to sk_alloc
2015-05-11 10:50:17 -04:00
atm
atm: deal with setting entry before mkip was called
2015-09-17 22:13:32 -07:00
ax25
AX.25: Close socket connection on session completion
2016-07-11 09:31:12 -07:00
batman-adv
batman-adv: Reduce refcnt of removed router when updating route
2016-05-11 11:21:18 +02:00
bluetooth
Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU
2016-08-20 18:09:19 +02:00
bridge
Bridge: Fix ipv6 mc snooping if bridge has no ipv6 address
2016-07-11 09:31:11 -07:00
caif
net: caif: fix misleading indentation
2016-09-30 10:18:35 +02:00
can
can: avoid using timeval for uapi
2015-10-13 17:42:34 +02:00
ceph
libceph: apply new_state before new_up_client on incrementals
2016-08-10 11:49:29 +02:00
core
bonding: Fix bonding crash
2016-09-30 10:18:36 +02:00
dcb
net/dcb: make dcbnl.c explicitly non-modular
2015-10-09 07:52:27 -07:00
dccp
tcp/dccp: remove obsolete WARN_ON() in icmp handlers
2016-04-20 15:42:04 +09:00
decnet
decnet: Do not build routes to devices without decnet private data.
2016-05-18 17:06:35 -07:00
dns_resolver
net: dns_resolver: convert time_t to time64_t
2015-11-18 16:27:46 -05:00
dsa
net: dsa: use switchdev obj for VLAN add/del ops
2015-11-01 15:56:11 -05:00
ethernet
net: help compiler generate better code in eth_get_headlen
2015-09-28 22:51:15 -07:00
hsr
net/hsr: fix a warning message
2015-11-23 14:56:15 -05:00
ieee802154
net: fix percpu memory leaks
2015-11-02 22:47:14 -05:00
ipv4
vti: flush x-netns xfrm cache when vti interface is removed
2016-09-30 10:18:36 +02:00
ipv6
tcp: properly scale window in tcp_v[46]_reqsk_send_ack()
2016-09-30 10:18:34 +02:00
ipx
net: Pass kern from net_proto_family.create to sk_alloc
2015-05-11 10:50:17 -04:00
irda
net/irda: handle iriap_register_lsap() allocation failure
2016-09-30 10:18:36 +02:00
iucv
af_iucv: Validate socket address length in iucv_sock_bind()
2016-03-03 15:07:03 -08:00
key
af_key: fix two typos
2015-10-23 03:05:19 -07:00
l2tp
l2tp: fix configuration passed to setup_udp_tunnel_sock()
2016-06-24 10:18:17 -07:00
l3mdev
net: Add netif_is_l3_slave
2015-10-07 04:27:43 -07:00
lapb
…
llc
net: fix infoleak in llc
2016-05-18 17:06:40 -07:00
mac80211
mac80211: fix purging multicast PS buffer queue
2016-09-07 08:32:41 +02:00
mac802154
mac802154: llsec: use kzfree
2015-10-21 00:49:24 +02:00
mpls
mpls: find_outdev: check for err ptr in addition to NULL check
2016-04-20 15:42:07 +09:00
netfilter
netfilter: x_tables: check for size overflow
2016-09-15 08:27:50 +02:00
netlabel
netlabel: add address family checks to netlbl_{sock,req}_delattr()
2016-08-20 18:09:22 +02:00
netlink
netlink: Fix dump skb leak/double free
2016-06-24 10:18:16 -07:00
netrom
netfilter: Remove spurios included of netfilter.h
2015-06-18 21:14:32 +02:00
nfc
net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA
2015-12-01 15:45:05 -05:00
openvswitch
vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices
2016-06-24 10:18:18 -07:00
packet
packet: Use symmetric hash for PACKET_FANOUT_HASH.
2016-07-27 09:47:31 -07:00
phonet
phonet: properly unshare skbs in phonet_rcv()
2016-01-31 11:29:00 -08:00
rds
rds: fix an infoleak in rds_inc_info_copy
2016-09-15 08:27:51 +02:00
rfkill
rfkill: fix rfkill_fop_read wait_event usage
2016-03-03 15:07:26 -08:00
rose
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-06-24 02:58:51 -07:00
rxrpc
net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA
2015-12-01 15:45:05 -05:00
sched
net_sched: fix mirrored packets checksum
2016-07-27 09:47:31 -07:00
sctp
sctp: lack the check for ports in sctp_v6_cmp_addr
2016-04-20 15:41:58 +09:00
sunrpc
SUNRPC: allow for upcalls for same uid but different gss service
2016-09-07 08:32:36 +02:00
switchdev
switchdev: pass pointer to fib_info instead of copy
2016-06-24 10:18:16 -07:00
tipc
tipc: fix NULL pointer dereference in shutdown()
2016-09-30 10:18:36 +02:00
unix
af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock'
2016-09-30 10:18:36 +02:00
vmw_vsock
VSOCK: do not disconnect socket when peer has shutdown SEND only
2016-05-18 17:06:41 -07:00
wimax
net:wimax: Fix doucble word "the the" in networking.xml
2015-08-09 22:43:52 -07:00
wireless
Revert "wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel"
2016-09-24 10:07:41 +02:00
x25
net: fix a kernel infoleak in x25 module
2016-05-18 17:06:43 -07:00
xfrm
xfrm: Fix crash observed during device unregistration and decryption
2016-04-20 15:42:05 +09:00
compat.c
…
Kconfig
net: Introduce L3 Master device abstraction
2015-09-29 20:40:32 -07:00
Makefile
net: Introduce L3 Master device abstraction
2015-09-29 20:40:32 -07:00
socket.c
net: Fix use after free in the recvmmsg exit path
2016-04-20 15:42:03 +09:00
sysctl_net.c
net: Use ns_capable_noaudit() when determining net sysctl permissions
2016-09-15 08:27:50 +02:00