iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/ipv4
History
Nikolay Aleksandrov eeaac3634e net: nexthop: don't allow empty NHA_GROUP 
Currently the nexthop code will use an empty NHA_GROUP attribute, but it
requires at least 1 entry in order to function properly. Otherwise we
end up derefencing null or random pointers all over the place due to not
having any nh_grp_entry members allocated, nexthop code relies on having at
least the first member present. Empty NHA_GROUP doesn't make any sense so
just disallow it.
Also add a WARN_ON for any future users of nexthop_create_group().

 BUG: kernel NULL pointer dereference, address: 0000000000000080
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] SMP
 CPU: 0 PID: 558 Comm: ip Not tainted 5.9.0-rc1+ #93
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014
 RIP: 0010:fib_check_nexthop+0x4a/0xaa
 Code: 0f 84 83 00 00 00 48 c7 02 80 03 f7 81 c3 40 80 fe fe 75 12 b8 ea ff ff ff 48 85 d2 74 6b 48 c7 02 40 03 f7 81 c3 48 8b 40 10 <48> 8b 80 80 00 00 00 eb 36 80 78 1a 00 74 12 b8 ea ff ff ff 48 85
 RSP: 0018:ffff88807983ba00 EFLAGS: 00010213
 RAX: 0000000000000000 RBX: ffff88807983bc00 RCX: 0000000000000000
 RDX: ffff88807983bc00 RSI: 0000000000000000 RDI: ffff88807bdd0a80
 RBP: ffff88807983baf8 R08: 0000000000000dc0 R09: 000000000000040a
 R10: 0000000000000000 R11: ffff88807bdd0ae8 R12: 0000000000000000
 R13: 0000000000000000 R14: ffff88807bea3100 R15: 0000000000000001
 FS:  00007f10db393700(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000080 CR3: 000000007bd0f004 CR4: 00000000003706f0
 Call Trace:
  fib_create_info+0x64d/0xaf7
  fib_table_insert+0xf6/0x581
  ? __vma_adjust+0x3b6/0x4d4
  inet_rtm_newroute+0x56/0x70
  rtnetlink_rcv_msg+0x1e3/0x20d
  ? rtnl_calcit.isra.0+0xb8/0xb8
  netlink_rcv_skb+0x5b/0xac
  netlink_unicast+0xfa/0x17b
  netlink_sendmsg+0x334/0x353
  sock_sendmsg_nosec+0xf/0x3f
  ____sys_sendmsg+0x1a0/0x1fc
  ? copy_msghdr_from_user+0x4c/0x61
  ___sys_sendmsg+0x63/0x84
  ? handle_mm_fault+0xa39/0x11b5
  ? sockfd_lookup_light+0x72/0x9a
  __sys_sendmsg+0x50/0x6e
  do_syscall_64+0x54/0xbe
  entry_SYSCALL_64_after_hwframe+0x44/0xa9
 RIP: 0033:0x7f10dacc0bb7
 Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb cd 66 0f 1f 44 00 00 8b 05 9a 4b 2b 00 85 c0 75 2e 48 63 ff 48 63 d2 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 b1 f2 2a 00 f7 d8 64 89 02 48
 RSP: 002b:00007ffcbe628bf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 00007ffcbe628f80 RCX: 00007f10dacc0bb7
 RDX: 0000000000000000 RSI: 00007ffcbe628c60 RDI: 0000000000000003
 RBP: 000000005f41099c R08: 0000000000000001 R09: 0000000000000008
 R10: 00000000000005e9 R11: 0000000000000246 R12: 0000000000000000
 R13: 0000000000000000 R14: 00007ffcbe628d70 R15: 0000563a86c6e440
 Modules linked in:
 CR2: 0000000000000080

CC: David Ahern <dsahern@gmail.com>
Fixes: 430a049190de ("nexthop: Add support for nexthop groups")
Reported-by: syzbot+a61aa19b0c14c8770bd9@syzkaller.appspotmail.com
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-22 12:39:55 -07:00
..
bpfilter
net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces"
2020-08-10 12:06:44 -07:00
netfilter
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2020-08-05 20:13:21 -07:00
af_inet.c
net: remove compat_sock_common_{get,set}sockopt
2020-07-19 18:16:40 -07:00
ah4.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
arp.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
bpf_tcp_ca.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2020-03-30 19:52:37 -07:00
cipso_ipv4.c
net: ipv4: kerneldoc fixes
2020-07-13 17:20:39 -07:00
datagram.c
inet: stop leaking jiffies on the wire
2019-11-01 14:57:52 -07:00
devinet.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-05-31 17:48:46 -07:00
esp4_offload.c
net: Add MODULE_DESCRIPTION entries to network modules
2020-06-20 21:33:57 -07:00
esp4.c
ESP: Export esp_output_fill_trailer function
2020-02-19 13:52:32 +01:00
fib_frontend.c
ipv4: nexthop version of fib_info_nh_uses_dev
2020-05-26 16:06:07 -07:00
fib_lookup.h
net: add net available in build_state
2020-03-29 22:30:57 -07:00
fib_notifier.c
net: fib_notifier: propagate extack down to the notifier block callback
2019-10-04 11:10:56 -07:00
fib_rules.c
fib: use indirect call wrappers in the most common fib_rules_ops
2020-07-28 17:42:31 -07:00
fib_semantics.c
net: Fix the arp error in some cases
2020-06-18 20:21:51 -07:00
fib_trie.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-08-02 01:02:12 -07:00
fou.c
net: Add MODULE_DESCRIPTION entries to network modules
2020-06-20 21:33:57 -07:00
gre_demux.c
gre: fix uninit-value in __iptunnel_pull_header
2020-03-08 21:25:37 -07:00
gre_offload.c
net: gre: recompute gre csum for sctp over gre tunnels
2020-08-03 15:29:44 -07:00
icmp.c
icmp6: support rfc 4884
2020-07-24 17:12:41 -07:00
igmp.c
ip*_mc_gsfget(): lift copyout of struct group_filter into callers
2020-05-20 20:31:27 -04:00
inet_connection_sock.c
net: refactor bind_bucket fastreuse into helper
2020-08-11 15:49:08 -07:00
inet_diag.c
inet_diag: support for wider protocol numbers
2020-07-09 12:38:41 -07:00
inet_fragment.c
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
inet_hashtables.c
net: initialize fastreuse on inet_inherit_port
2020-08-11 15:49:08 -07:00
inet_timewait_sock.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
inetpeer.c
inetpeer: fix data-race in inet_putpeer / inet_putpeer
2019-11-07 16:15:56 -08:00
ip_forward.c
ipv4: Revert removal of rt_uses_gateway
2019-09-20 18:23:33 -07:00
ip_fragment.c
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
ip_gre.c
net: add a new ndo_tunnel_ioctl method
2020-05-19 15:45:11 -07:00
ip_input.c
bpf: Add socket assign support
2020-03-30 13:45:04 -07:00
ip_options.c
net/ipv4: merge ip_options_get and ip_options_get_from_user
2020-07-24 15:41:54 -07:00
ip_output.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-07-11 00:46:00 -07:00
ip_sockglue.c
icmp: prepare rfc 4884 for ipv6
2020-07-24 17:12:41 -07:00
ip_tunnel_core.c
Revert "ipv4: tunnel: fix compilation on ARCH=um"
2020-08-12 13:26:37 -07:00
ip_tunnel.c
ip_tunnel: fix use-after-free in ip_tunnel_lookup()
2020-06-18 20:12:34 -07:00
ip_vti.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next
2020-07-30 14:39:31 -07:00
ipcomp.c
ipcomp: assign if_id to child tunnel from parent tunnel
2020-07-09 12:55:37 +02:00
ipconfig.c
Documentation: nfsroot.rst: Fix references to nfsroot.rst
2020-03-02 13:11:46 -07:00
ipip.c
net: ipip: implement header_ops->parse_protocol for AF_PACKET
2020-06-30 12:29:39 -07:00
ipmr_base.c
net: fib_notifier: propagate extack down to the notifier block callback
2019-10-04 11:10:56 -07:00
ipmr.c
ipmr: Copy option to correct variable
2020-07-27 11:39:55 -07:00
Kconfig
net: ipv4: remove duplicate "the the" phrase in Kconfig text
2020-08-18 16:02:16 -07:00
Makefile
udp_tunnel: add central NIC RX port offload infrastructure
2020-07-10 13:54:00 -07:00
metrics.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
netfilter.c
netfilter: ipv4: remove useless export_symbol
2019-01-28 11:32:58 +01:00
netlink.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
nexthop.c
net: nexthop: don't allow empty NHA_GROUP
2020-08-22 12:39:55 -07:00
ping.c
ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
2020-07-07 15:26:37 -07:00
proc.c
tcp: add SNMP counter for no. of duplicate segments reported by DSACK
2020-07-17 12:54:30 -07:00
protocol.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
raw_diag.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-03-12 22:34:48 -07:00
raw.c
net: pass a sockptr_t into ->setsockopt
2020-07-24 15:41:54 -07:00
route.c
ipv4: route: Ignore output interface in FIB lookup for PMTU route
2020-08-04 13:01:45 -07:00
syncookies.c
tcp: fix build fong CONFIG_MPTCP=n
2020-08-01 11:46:29 -07:00
sysctl_net_ipv4.c
tcp: correct read of TFO keys on big endian systems
2020-08-10 12:12:35 -07:00
tcp_bbr.c
tcp_bbr: improve arithmetic division in bbr_update_bw()
2020-01-21 10:45:49 +01:00
tcp_bic.c
tcp: fix stretch ACK bugs in BIC
2020-03-16 18:26:54 -07:00
tcp_bpf.c
bpf: tcp: Recv() should return 0 when the peer socket is closed
2020-06-12 15:10:12 -07:00
tcp_cdg.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_cong.c
tcp: make sure listeners don't initialize congestion-control state
2020-07-09 13:07:45 -07:00
tcp_cubic.c
tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
2020-06-25 16:08:47 -07:00
tcp_dctcp.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp_dctcp.h
tcp: refactor DCTCP ECN ACK handling
2018-10-10 22:26:00 -07:00
tcp_diag.c
inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data
2020-02-27 18:50:19 -08:00
tcp_fastopen.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-08-13 20:03:11 -07:00
tcp_highspeed.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_htcp.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_hybla.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_illinois.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_input.c
tcp: apply a floor of 1 for RTT samples from TCP timestamps
2020-08-03 17:54:03 -07:00
tcp_ipv4.c
bpf: Refactor to provide aux info to bpf_iter_init_seq_priv_t
2020-07-25 20:16:32 -07:00
tcp_lp.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_metrics.c
net-tcp: Disable TCP ssthresh metrics cache by default
2019-12-09 20:17:48 -08:00
tcp_minisocks.c
mptcp: add new sock flag to deal with join subflows
2020-05-15 12:30:13 -07:00
tcp_nv.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_offload.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp_output.c
tcp: rename request_sock cookie_ts bit to syncookie
2020-07-31 16:55:32 -07:00
tcp_rate.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
tcp_recovery.c
tcp: introduce tcp_skb_timestamp_us() helper
2018-09-21 19:37:59 -07:00
tcp_scalable.c
tcp: fix stretch ACK bugs in Scalable
2020-03-16 18:26:54 -07:00
tcp_timer.c
net: ipv4: kerneldoc fixes
2020-07-13 17:20:39 -07:00
tcp_ulp.c
bpf: sockmap: Only check ULP for TCP sockets
2020-03-09 22:34:58 +01:00
tcp_vegas.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_vegas.h
…
tcp_veno.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_westwood.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_yeah.c
tcp: fix stretch ACK bugs in Yeah
2020-03-16 18:26:55 -07:00
tcp.c
tcp: correct read of TFO keys on big endian systems
2020-08-10 12:12:35 -07:00
tunnel4.c
tunnel4: add cb_handler to struct xfrm_tunnel
2020-07-09 12:51:36 +02:00
udp_bpf.c
bpf: Add sockmap hooks for UDP sockets
2020-03-09 22:34:58 +01:00
udp_diag.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-03-12 22:34:48 -07:00
udp_impl.h
net: pass a sockptr_t into ->setsockopt
2020-07-24 15:41:54 -07:00
udp_offload.c
udp: initialize is_flist with 0 in udp_gro_receive
2020-03-30 10:35:03 -07:00
udp_tunnel_core.c
udp_tunnel: add central NIC RX port offload infrastructure
2020-07-10 13:54:00 -07:00
udp_tunnel_nic.c
udp_tunnel: add the ability to hard-code IANA VXLAN
2020-08-03 10:13:54 -07:00
udp_tunnel_stub.c
udp_tunnel: add central NIC RX port offload infrastructure
2020-07-10 13:54:00 -07:00
udp.c
udp, bpf: Ignore connections in reuseport group after BPF sk lookup
2020-07-31 02:00:48 +02:00
udplite.c
net/ipv4: remove compat_ip_{get,set}sockopt
2020-07-19 18:16:41 -07:00
xfrm4_input.c
xfrm: state: remove extract_input indirection from xfrm_state_afinfo
2020-05-06 09:40:08 +02:00
xfrm4_output.c
xfrm: fix unused variable warning if CONFIG_NETFILTER=n
2020-05-11 15:12:27 +02:00
xfrm4_policy.c
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2019-12-24 22:28:54 -08:00
xfrm4_protocol.c
xfrm: add route lookup to xfrm4_rcv_encap
2019-12-09 09:59:07 +01:00
xfrm4_state.c
xfrm: remove output_finish indirection from xfrm_state_afinfo
2020-05-06 09:40:08 +02:00
xfrm4_tunnel.c
xfrm: remove type and offload_type map from xfrm_state_afinfo
2019-06-06 08:34:50 +02:00