Pavel Tikhomirov
7e356ee376
net: sched: sch_teql: fix null-pointer dereference ...
commit 1ffbc7ea91606e4abd10eb60de5367f1c86daf5e upstream.
Reproduce:
modprobe sch_teql
tc qdisc add dev teql0 root teql0
This leads to (for instance in Centos 7 VM) OOPS:
[ 532.366633] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8
[ 532.366733] IP: [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[ 532.366825] PGD 80000001376d5067 PUD 137e37067 PMD 0
[ 532.366906] Oops: 0000 [#1 ] SMP
[ 532.366987] Modules linked in: sch_teql ...
[ 532.367945] CPU: 1 PID: 3026 Comm: tc Kdump: loaded Tainted: G ------------ T 3.10.0-1062.7.1.el7.x86_64 #1
[ 532.368041] Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.2 04/01/2014
[ 532.368125] task: ffff8b7d37d31070 ti: ffff8b7c9fdbc000 task.ti: ffff8b7c9fdbc000
[ 532.368224] RIP: 0010:[<ffffffffc06124a8>] [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[ 532.368320] RSP: 0018:ffff8b7c9fdbf8e0 EFLAGS: 00010286
[ 532.368394] RAX: ffffffffc0612490 RBX: ffff8b7cb1565e00 RCX: ffff8b7d35ba2000
[ 532.368476] RDX: ffff8b7d35ba2000 RSI: 0000000000000000 RDI: ffff8b7cb1565e00
[ 532.368557] RBP: ffff8b7c9fdbf8f8 R08: ffff8b7d3fd1f140 R09: ffff8b7d3b001600
[ 532.368638] R10: ffff8b7d3b001600 R11: ffffffff84c7d65b R12: 00000000ffffffd8
[ 532.368719] R13: 0000000000008000 R14: ffff8b7d35ba2000 R15: ffff8b7c9fdbf9a8
[ 532.368800] FS: 00007f6a4e872740(0000) GS:ffff8b7d3fd00000(0000) knlGS:0000000000000000
[ 532.368885] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 532.368961] CR2: 00000000000000a8 CR3: 00000001396ee000 CR4: 00000000000206e0
[ 532.369046] Call Trace:
[ 532.369159] [<ffffffff84c8192e>] qdisc_create+0x36e/0x450
[ 532.369268] [<ffffffff846a9b49>] ? ns_capable+0x29/0x50
[ 532.369366] [<ffffffff849afde2>] ? nla_parse+0x32/0x120
[ 532.369442] [<ffffffff84c81b4c>] tc_modify_qdisc+0x13c/0x610
[ 532.371508] [<ffffffff84c693e7>] rtnetlink_rcv_msg+0xa7/0x260
[ 532.372668] [<ffffffff84907b65>] ? sock_has_perm+0x75/0x90
[ 532.373790] [<ffffffff84c69340>] ? rtnl_newlink+0x890/0x890
[ 532.374914] [<ffffffff84c8da7b>] netlink_rcv_skb+0xab/0xc0
[ 532.376055] [<ffffffff84c63708>] rtnetlink_rcv+0x28/0x30
[ 532.377204] [<ffffffff84c8d400>] netlink_unicast+0x170/0x210
[ 532.378333] [<ffffffff84c8d7a8>] netlink_sendmsg+0x308/0x420
[ 532.379465] [<ffffffff84c2f3a6>] sock_sendmsg+0xb6/0xf0
[ 532.380710] [<ffffffffc034a56e>] ? __xfs_filemap_fault+0x8e/0x1d0 [xfs]
[ 532.381868] [<ffffffffc034a75c>] ? xfs_filemap_fault+0x2c/0x30 [xfs]
[ 532.383037] [<ffffffff847ec23a>] ? __do_fault.isra.61+0x8a/0x100
[ 532.384144] [<ffffffff84c30269>] ___sys_sendmsg+0x3e9/0x400
[ 532.385268] [<ffffffff847f3fad>] ? handle_mm_fault+0x39d/0x9b0
[ 532.386387] [<ffffffff84d88678>] ? __do_page_fault+0x238/0x500
[ 532.387472] [<ffffffff84c31921>] __sys_sendmsg+0x51/0x90
[ 532.388560] [<ffffffff84c31972>] SyS_sendmsg+0x12/0x20
[ 532.389636] [<ffffffff84d8dede>] system_call_fastpath+0x25/0x2a
[ 532.390704] [<ffffffff84d8de21>] ? system_call_after_swapgs+0xae/0x146
[ 532.391753] Code: 00 00 00 00 00 00 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 53 48 8b b7 48 01 00 00 48 89 fb <48> 8b 8e a8 00 00 00 48 85 c9 74 43 48 89 ca eb 0f 0f 1f 80 00
[ 532.394036] RIP [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[ 532.395127] RSP <ffff8b7c9fdbf8e0>
[ 532.396179] CR2: 00000000000000a8
Null pointer dereference happens on master->slaves dereference in
teql_destroy() as master is null-pointer.
When qdisc_create() calls teql_qdisc_init() it imediately fails after
check "if (m->dev == dev)" because both devices are teql0, and it does
not set qdisc_priv(sch)->m leaving it zero on error path, then
qdisc_create() imediately calls teql_destroy() which does not expect
zero master pointer and we get OOPS.
Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-16 11:59:07 +02:00
2019-10-29 09:15:12 +01:00
2018-04-13 19:48:33 +02:00
2017-03-22 12:43:34 +01:00
2018-03-22 09:17:42 +01:00
2018-01-17 09:38:54 +01:00
2019-08-11 12:22:18 +02:00
2017-08-30 10:21:42 +02:00
2016-09-19 21:55:28 -04:00
2020-01-29 10:24:33 +01:00
2016-07-25 21:49:19 -07:00
2019-11-28 18:28:04 +01:00
2016-09-19 22:04:14 -04:00
2018-06-26 08:08:06 +08:00
2016-07-25 21:49:19 -07:00
2018-04-13 19:48:35 +02:00
2018-08-24 13:12:37 +02:00
2016-10-03 21:40:50 -04:00
2017-01-15 13:42:53 +01:00
2016-11-28 10:47:35 -05:00
2016-11-28 10:47:35 -05:00
2016-11-28 10:47:35 -05:00
2016-11-28 10:47:35 -05:00
2020-03-11 07:53:05 +01:00
2016-09-19 22:04:14 -04:00
2020-02-28 15:42:44 +01:00
2020-04-02 17:20:29 +02:00
2020-02-14 16:30:58 -05:00
2021-01-30 13:27:16 +01:00
2018-09-15 09:42:55 +02:00
2020-02-05 13:05:42 +00:00
2016-09-19 21:55:28 -04:00
2016-09-19 21:55:28 -04:00
2021-03-17 16:10:14 +01:00
2016-06-25 12:19:35 -04:00
2018-07-22 14:27:36 +02:00
2019-10-07 18:53:24 +02:00
2021-03-30 14:41:42 +02:00
2019-08-11 12:22:17 +02:00
2016-06-25 12:19:35 -04:00
2019-10-07 18:53:23 +02:00
2016-09-19 01:47:18 -04:00
2020-05-20 08:15:24 +02:00
2020-03-20 09:07:40 +01:00
2020-06-30 15:38:37 -04:00
2021-03-30 14:41:42 +02:00
2016-08-08 16:06:47 -07:00
2019-11-10 11:23:31 +01:00
2018-09-15 09:43:02 +02:00
2016-06-07 16:59:53 -07:00
2019-12-05 15:35:30 +01:00
2019-12-05 15:35:30 +01:00
2019-12-05 15:35:30 +01:00
2020-01-29 10:24:34 +01:00
2016-09-19 01:47:18 -04:00
2016-06-25 12:19:35 -04:00
2020-01-12 11:24:27 +01:00
2016-09-23 06:52:31 -04:00
2021-03-30 14:41:42 +02:00
2019-11-10 11:23:31 +01:00
2021-03-30 14:41:42 +02:00
2019-02-20 10:18:28 +01:00
2021-04-16 11:59:07 +02:00
7e356ee376