Taehee Yoo
a98c6f4478
sch_dsmark: fix a NULL deref in qdisc_reset() ...
[ Upstream commit 9b76eade16423ef06829cccfe3e100cfce31afcd ]
If Qdisc_ops->init() is failed, Qdisc_ops->reset() would be called.
When dsmark_init(Qdisc_ops->init()) is failed, it possibly doesn't
initialize dsmark_qdisc_data->q. But dsmark_reset(Qdisc_ops->reset())
uses dsmark_qdisc_data->q pointer wihtout any null checking.
So, panic would occur.
Test commands:
sysctl net.core.default_qdisc=dsmark -w
ip link add dummy0 type dummy
ip link add vw0 link dummy0 type virt_wifi
ip link set vw0 up
Splat looks like:
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 3 PID: 684 Comm: ip Not tainted 5.12.0+ #910
RIP: 0010:qdisc_reset+0x2b/0x680
Code: 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 41 57 41 56 41 55 41 54
55 48 89 fd 48 83 c7 18 53 48 89 fa 48 c1 ea 03 48 83 ec 20 <80> 3c 02
00 0f 85 09 06 00 00 4c 8b 65 18 0f 1f 44 00 00 65 8b 1d
RSP: 0018:ffff88800fda6bf8 EFLAGS: 00010282
RAX: dffffc0000000000 RBX: ffff8880050ed800 RCX: 0000000000000000
RDX: 0000000000000003 RSI: ffffffff99e34100 RDI: 0000000000000018
RBP: 0000000000000000 R08: fffffbfff346b553 R09: fffffbfff346b553
R10: 0000000000000001 R11: fffffbfff346b552 R12: ffffffffc0824940
R13: ffff888109e83800 R14: 00000000ffffffff R15: ffffffffc08249e0
FS: 00007f5042287680(0000) GS:ffff888119800000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ae1f4dbd90 CR3: 0000000006760002 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
? rcu_read_lock_bh_held+0xa0/0xa0
dsmark_reset+0x3d/0xf0 [sch_dsmark]
qdisc_reset+0xa9/0x680
qdisc_destroy+0x84/0x370
qdisc_create_dflt+0x1fe/0x380
attach_one_default_qdisc.constprop.41+0xa4/0x180
dev_activate+0x4d5/0x8c0
? __dev_open+0x268/0x390
__dev_open+0x270/0x390
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-03 08:38:12 +02:00
2020-01-27 14:50:41 +01:00
2020-11-05 11:08:44 +01:00
2021-01-17 14:04:19 +01:00
2021-04-07 12:48:49 +02:00
2020-10-01 13:14:43 +02:00
2020-07-31 18:37:48 +02:00
2021-04-14 08:22:33 +02:00
2021-06-03 08:38:08 +02:00
2020-01-27 14:50:51 +01:00
2021-05-22 10:59:40 +02:00
2019-11-10 11:27:48 +01:00
2020-11-24 13:27:22 +01:00
2020-11-05 11:08:53 +01:00
2021-06-03 08:38:12 +02:00
2021-01-23 15:49:56 +01:00
2021-04-07 12:48:47 +02:00
2020-01-04 19:13:37 +01:00
2020-04-23 10:30:24 +02:00
2021-06-03 08:38:11 +02:00
2020-01-09 10:19:09 +01:00
2021-05-22 10:59:24 +02:00
2021-04-28 13:16:49 +02:00
2021-05-22 10:59:39 +02:00
2021-06-03 08:38:12 +02:00
2020-12-08 10:18:52 +01:00
2019-04-17 08:38:40 +02:00
2021-02-13 13:51:14 +01:00
2020-07-22 09:31:59 +02:00
2021-02-10 09:21:06 +01:00
2020-10-01 13:14:26 +02:00
2021-06-03 08:38:04 +02:00
2021-04-14 08:22:36 +02:00
2021-03-17 16:43:43 +01:00
2021-04-14 08:22:35 +02:00
2021-05-22 10:59:47 +02:00
2021-03-17 16:43:44 +01:00
2020-07-22 09:31:58 +02:00
2020-04-29 16:31:21 +02:00
2021-06-03 08:38:02 +02:00
2021-06-03 08:38:11 +02:00
2020-10-07 08:00:08 +02:00
2019-11-10 11:27:48 +01:00
2019-12-05 09:21:30 +01:00
2021-03-30 14:37:03 +02:00
2021-02-23 15:00:58 +01:00
2020-01-12 12:17:17 +01:00
2020-12-08 10:18:52 +01:00
2021-02-10 09:21:06 +01:00
2021-06-03 08:38:12 +02:00
2021-05-22 10:59:43 +02:00
2021-05-22 10:59:44 +02:00
2019-05-16 19:41:27 +02:00
2021-04-07 12:48:47 +02:00
2021-06-03 08:38:08 +02:00
2020-12-08 10:18:52 +01:00
2020-10-01 13:14:32 +02:00
2021-05-22 10:59:37 +02:00
2021-06-03 08:38:03 +02:00
2020-12-08 10:18:54 +01:00
2021-05-22 10:59:48 +02:00
2021-04-14 08:22:34 +02:00
2020-08-21 11:05:32 +02:00
2020-08-19 08:15:03 +02:00
a98c6f4478