Feng Sun
a794b0ea63
net: fix skb use after free in netpoll ...
[ Upstream commit 2c1644cf6d46a8267d79ed95cb9b563839346562 ]
After commit baeababb5b85d5c4e6c917efe2a1504179438d3b
("tun: return NET_XMIT_DROP for dropped packets"),
when tun_net_xmit drop packets, it will free skb and return NET_XMIT_DROP,
netpoll_send_skb_on_dev will run into following use after free cases:
1. retry netpoll_start_xmit with freed skb;
2. queue freed skb in npinfo->txq.
queue_process will also run into use after free case.
hit netpoll_send_skb_on_dev first case with following kernel log:
[ 117.864773] kernel BUG at mm/slub.c:306!
[ 117.864773] invalid opcode: 0000 [#1 ] SMP PTI
[ 117.864774] CPU: 3 PID: 2627 Comm: loop_printmsg Kdump: loaded Tainted: P OE 5.3.0-050300rc5-generic #201908182231
[ 117.864775] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 117.864775] RIP: 0010:kmem_cache_free+0x28d/0x2b0
[ 117.864781] Call Trace:
[ 117.864781] ? tun_net_xmit+0x21c/0x460
[ 117.864781] kfree_skbmem+0x4e/0x60
[ 117.864782] kfree_skb+0x3a/0xa0
[ 117.864782] tun_net_xmit+0x21c/0x460
[ 117.864782] netpoll_start_xmit+0x11d/0x1b0
[ 117.864788] netpoll_send_skb_on_dev+0x1b8/0x200
[ 117.864789] __br_forward+0x1b9/0x1e0 [bridge]
[ 117.864789] ? skb_clone+0x53/0xd0
[ 117.864790] ? __skb_clone+0x2e/0x120
[ 117.864790] deliver_clone+0x37/0x50 [bridge]
[ 117.864790] maybe_deliver+0x89/0xc0 [bridge]
[ 117.864791] br_flood+0x6c/0x130 [bridge]
[ 117.864791] br_dev_xmit+0x315/0x3c0 [bridge]
[ 117.864792] netpoll_start_xmit+0x11d/0x1b0
[ 117.864792] netpoll_send_skb_on_dev+0x1b8/0x200
[ 117.864792] netpoll_send_udp+0x2c6/0x3e8
[ 117.864793] write_msg+0xd9/0xf0 [netconsole]
[ 117.864793] console_unlock+0x386/0x4e0
[ 117.864793] vprintk_emit+0x17e/0x280
[ 117.864794] vprintk_default+0x29/0x50
[ 117.864794] vprintk_func+0x4c/0xbc
[ 117.864794] printk+0x58/0x6f
[ 117.864795] loop_fun+0x24/0x41 [printmsg_loop]
[ 117.864795] kthread+0x104/0x140
[ 117.864795] ? 0xffffffffc05b1000
[ 117.864796] ? kthread_park+0x80/0x80
[ 117.864796] ret_from_fork+0x35/0x40
Signed-off-by: Feng Sun <loyou85@gmail.com>
Signed-off-by: Xiaojun Zhao <xiaojunzhao141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-09-10 10:31:04 +01:00
2018-10-03 17:01:42 -07:00
2019-08-04 09:33:28 +02:00
2019-05-16 19:43:46 +02:00
2019-04-20 09:07:53 +02:00
2019-04-27 09:34:40 +02:00
2019-06-22 08:17:21 +02:00
2019-08-04 09:33:15 +02:00
2019-08-04 09:33:32 +02:00
2019-09-06 10:19:31 +02:00
2019-05-08 07:19:07 +02:00
2019-07-10 09:55:33 +02:00
2019-08-11 12:22:15 +02:00
2019-09-10 10:31:04 +01:00
2018-09-19 22:47:15 +02:00
2019-04-03 06:24:14 +02:00
2018-02-25 11:05:44 +01:00
2018-07-22 14:27:39 +02:00
2019-02-12 19:45:00 +01:00
2017-02-18 15:11:43 +01:00
2019-03-19 13:14:08 +01:00
2019-05-02 09:32:06 +02:00
2019-08-25 10:51:42 +02:00
2019-08-25 10:51:42 +02:00
2017-05-25 15:44:41 +02:00
2018-09-15 09:43:01 +02:00
2018-03-31 18:11:34 +02:00
2019-04-17 08:36:44 +02:00
2019-08-04 09:33:16 +02:00
2019-08-11 12:22:17 +02:00
2016-09-10 23:12:53 -07:00
2019-06-22 08:17:22 +02:00
2019-06-11 12:22:33 +02:00
2019-09-06 10:19:52 +02:00
2018-09-09 20:01:19 +02:00
2018-03-11 16:21:34 +01:00
2016-10-20 11:23:08 -04:00
2019-08-25 10:51:51 +02:00
2019-03-13 14:04:53 -07:00
2018-08-09 12:17:59 +02:00
2019-08-04 09:33:35 +02:00
2019-08-04 09:33:34 +02:00
2019-08-04 09:33:33 +02:00
2019-08-25 10:51:51 +02:00
2019-03-23 13:19:44 +01:00
2018-08-24 13:12:36 +02:00
2019-06-11 12:22:46 +02:00
2018-05-16 10:08:43 +02:00
2019-04-03 06:24:14 +02:00
2019-08-04 09:33:34 +02:00
2019-08-11 12:22:18 +02:00
2019-08-25 10:51:52 +02:00
2018-04-29 11:32:02 +02:00
2019-07-21 09:05:57 +02:00
2016-10-19 10:58:04 -04:00
2019-08-11 12:22:17 +02:00
2019-03-19 13:14:10 +01:00
2019-05-25 18:26:44 +02:00
2019-09-06 10:19:52 +02:00
2019-03-19 13:14:09 +01:00
2019-08-04 09:33:20 +02:00
2019-01-09 16:16:41 +01:00
2019-08-25 10:51:40 +02:00
2016-10-06 09:52:23 -07:00
a794b0ea63