Haishuang Yan
9c86336c15
ip6_vti: fix a null pointer deference when destroy vti6 tunnel
If load ip6_vti module and create a network namespace when set
fb_tunnels_only_for_init_net to 1, then exit the namespace will
cause following crash:
[ 6601.677036] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[ 6601.679057] PGD 8000000425eca067 P4D 8000000425eca067 PUD 424292067 PMD 0
[ 6601.680483] Oops: 0000 [#1] SMP PTI
[ 6601.681223] CPU: 7 PID: 93 Comm: kworker/u16:1 Kdump: loaded Tainted: G E 4.18.0+ #3
[ 6601.683153] Hardware name: Fedora Project OpenStack Nova, BIOS seabios-1.7.5-11.el7 04/01/2014
[ 6601.684919] Workqueue: netns cleanup_net
[ 6601.685742] RIP: 0010:vti6_exit_batch_net+0x87/0xd0 [ip6_vti]
[ 6601.686932] Code: 7b 08 48 89 e6 e8 b9 ea d3 dd 48 8b 1b 48 85 db 75 ec 48 83 c5 08 48 81 fd 00 01 00 00 75 d5 49 8b 84 24 08 01 00 00 48 89 e6 <48> 8b 78 08 e8 90 ea d3 dd 49 8b 45 28 49 39 c6 4c 8d 68 d8 75 a1
[ 6601.690735] RSP: 0018:ffffa897c2737de0 EFLAGS: 00010246
[ 6601.691846] RAX: 0000000000000000 RBX: 0000000000000000 RCX: dead000000000200
[ 6601.693324] RDX: 0000000000000015 RSI: ffffa897c2737de0 RDI: ffffffff9f2ea9e0
[ 6601.694824] RBP: 0000000000000100 R08: 0000000000000000 R09: 0000000000000000
[ 6601.696314] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8dc323c07e00
[ 6601.697812] R13: ffff8dc324a63100 R14: ffffa897c2737e30 R15: ffffa897c2737e30
[ 6601.699345] FS: 0000000000000000(0000) GS:ffff8dc33fdc0000(0000) knlGS:0000000000000000
[ 6601.701068] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6601.702282] CR2: 0000000000000008 CR3: 0000000424966002 CR4: 00000000001606e0
[ 6601.703791] Call Trace:
[ 6601.704329] cleanup_net+0x1b4/0x2c0
[ 6601.705268] process_one_work+0x16c/0x370
[ 6601.706145] worker_thread+0x49/0x3e0
[ 6601.706942] kthread+0xf8/0x130
[ 6601.707626] ? rescuer_thread+0x340/0x340
[ 6601.708476] ? kthread_bind+0x10/0x10
[ 6601.709266] ret_from_fork+0x35/0x40
Reproduce:
modprobe ip6_vti
echo 1 > /proc/sys/net/core/fb_tunnels_only_for_init_net
unshare -n
exit
This because ip6n->tnls_wc[0] point to fallback device in default, but
in non-default namespace, ip6n->tnls_wc[0] will be NULL, so add the NULL
check comparatively.
Fixes: e2948e5af8 ("ip6_vti: fix creating fallback tunnel device for vti6")
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-08-19 19:55:58 -07:00
..
2018-07-06 12:32:12 +02:00
2018-08-17 17:27:58 -07:00
2018-07-24 14:10:43 -07:00
2018-06-28 10:40:47 -07:00
2018-08-15 15:04:25 -07:00
2018-07-24 14:10:42 -07:00
2018-07-20 21:17:12 -07:00
2018-08-15 15:04:25 -07:00
2018-08-03 00:47:32 +02:00
2018-08-15 15:04:25 -07:00
2018-08-06 10:33:44 -07:00
2018-07-30 09:10:25 -07:00
2018-06-28 10:40:47 -07:00
2018-08-19 11:51:45 -07:00
2018-07-27 13:17:50 -07:00
2018-08-09 11:52:36 -07:00
2018-08-09 14:11:24 -07:00
2018-07-24 14:10:43 -07:00
2018-08-09 11:52:36 -07:00
2018-06-26 11:33:04 +09:00
2018-08-06 11:21:15 +02:00
2018-08-19 11:26:39 -07:00
2018-08-19 19:55:58 -07:00
2018-08-08 09:39:36 -07:00
2018-07-24 14:10:43 -07:00
2018-07-27 09:33:37 -07:00
2018-08-13 20:45:49 -07:00
2018-08-09 11:52:36 -07:00
2018-08-15 15:04:25 -07:00
2018-08-06 11:21:37 +02:00
2018-07-24 14:10:42 -07:00
2018-06-20 07:26:58 +09:00
2018-08-16 19:37:11 +02:00
2018-08-05 13:04:31 -07:00
2018-06-28 10:40:47 -07:00
2018-07-30 09:10:25 -07:00
2018-07-12 16:55:29 -07:00
2018-08-02 10:55:32 -07:00
2018-08-13 09:21:05 -07:00
2018-06-28 10:40:47 -07:00
2018-07-05 20:20:03 +09:00
2018-08-16 14:21:29 -06:00
2018-07-05 23:21:10 +02:00
2018-06-28 10:40:47 -07:00
2018-08-15 15:04:25 -07:00
2018-08-19 10:46:21 -07:00
2018-08-11 12:25:15 -07:00
2018-08-16 14:21:29 -06:00
2018-08-01 10:00:06 -07:00
2018-08-16 14:21:29 -06:00
2018-08-09 11:52:36 -07:00
2018-08-18 10:02:49 -07:00
2018-08-03 16:44:19 -07:00
2018-08-07 12:39:13 -07:00
2018-07-24 14:10:42 -07:00
2018-07-24 19:21:58 -07:00
2018-07-24 14:10:42 -07:00
2018-08-05 13:04:31 -07:00
2018-08-02 10:55:32 -07:00
2018-08-06 10:42:48 -07:00
2018-07-24 14:10:43 -07:00
2018-06-28 13:36:39 +09:00
2018-08-15 15:04:25 -07:00