mirror/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
b82d71c0f84a2e5ccaaa7571dfd5c69e0e2cfb4a
linux/net/ipv4
History
Nikolay Aleksandrov 1c743127cc net: nexthop: fix null pointer dereference when IPv6 is not enabled 
When we try to add an IPv6 nexthop and IPv6 is not enabled
(!CONFIG_IPV6) we'll hit a NULL pointer dereference[1] in the error path
of nh_create_ipv6() due to calling ipv6_stub->fib6_nh_release. The bug
has been present since the beginning of IPv6 nexthop gateway support.
Commit 1aefd3de7b ("ipv6: Add fib6_nh_init and release to stubs") tells
us that only fib6_nh_init has a dummy stub because fib6_nh_release should
not be called if fib6_nh_init returns an error, but the commit below added
a call to ipv6_stub->fib6_nh_release in its error path. To fix it return
the dummy stub's -EAFNOSUPPORT error directly without calling
ipv6_stub->fib6_nh_release in nh_create_ipv6()'s error path.

[1]
 Output is a bit truncated, but it clearly shows the error.
 BUG: kernel NULL pointer dereference, address: 000000000000000000
 #PF: supervisor instruction fetch in kernel modede
 #PF: error_code(0x0010) - not-present pagege
 PGD 0 P4D 0
 Oops: 0010 [#1] PREEMPT SMP NOPTI
 CPU: 4 PID: 638 Comm: ip Kdump: loaded Not tainted 5.16.0-rc1+ #446
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014
 RIP: 0010:0x0
 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
 RSP: 0018:ffff888109f5b8f0 EFLAGS: 00010286^Ac
 RAX: 0000000000000000 RBX: ffff888109f5ba28 RCX: 0000000000000000
 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881008a2860
 RBP: ffff888109f5b9d8 R08: 0000000000000000 R09: 0000000000000000
 R10: ffff888109f5b978 R11: ffff888109f5b948 R12: 00000000ffffff9f
 R13: ffff8881008a2a80 R14: ffff8881008a2860 R15: ffff8881008a2840
 FS:  00007f98de70f100(0000) GS:ffff88822bf00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: ffffffffffffffd6 CR3: 0000000100efc000 CR4: 00000000000006e0
 Call Trace:
  <TASK>
  nh_create_ipv6+0xed/0x10c
  rtm_new_nexthop+0x6d7/0x13f3
  ? check_preemption_disabled+0x3d/0xf2
  ? lock_is_held_type+0xbe/0xfd
  rtnetlink_rcv_msg+0x23f/0x26a
  ? check_preemption_disabled+0x3d/0xf2
  ? rtnl_calcit.isra.0+0x147/0x147
  netlink_rcv_skb+0x61/0xb2
  netlink_unicast+0x100/0x187
  netlink_sendmsg+0x37f/0x3a0
  ? netlink_unicast+0x187/0x187
  sock_sendmsg_nosec+0x67/0x9b
  ____sys_sendmsg+0x19d/0x1f9
  ? copy_msghdr_from_user+0x4c/0x5e
  ? rcu_read_lock_any_held+0x2a/0x78
  ___sys_sendmsg+0x6c/0x8c
  ? asm_sysvec_apic_timer_interrupt+0x12/0x20
  ? lockdep_hardirqs_on+0xd9/0x102
  ? sockfd_lookup_light+0x69/0x99
  __sys_sendmsg+0x50/0x6e
  do_syscall_64+0xcb/0xf2
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f98dea28914
 Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 48 8d 05 e9 5d 0c 00 8b 00 85 c0 75 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 41 89 d4 55 48 89 f5 53
 RSP: 002b:00007fff859f5e68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e2e
 RAX: ffffffffffffffda RBX: 00000000619cb810 RCX: 00007f98dea28914
 RDX: 0000000000000000 RSI: 00007fff859f5ed0 RDI: 0000000000000003
 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000008
 R10: fffffffffffffce6 R11: 0000000000000246 R12: 0000000000000001
 R13: 000055c0097ae520 R14: 000055c0097957fd R15: 00007fff859f63a0
 </TASK>
 Modules linked in: bridge stp llc bonding virtio_net

Cc: stable@vger.kernel.org
Fixes: 53010f991a ("nexthop: Add support for IPv6 gateways")
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-11-23 11:39:53 +00:00
..
bpfilter
net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces"
2020-08-10 12:06:44 -07:00
netfilter
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2021-10-18 14:05:25 +01:00
af_inet.c
net: introduce sk_forward_alloc_get()
2021-10-27 18:20:29 -07:00
ah4.c
Merge tag 'net-next-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2021-06-30 15:51:09 -07:00
arp.c
net: arp: introduce arp_evict_nocarrier sysctl parameter
2021-11-01 19:57:14 -07:00
bpf_tcp_ca.c
bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs
2021-11-15 20:35:58 -08:00
cipso_ipv4.c
NET: IPV4: fix error "do not initialise globals to 0"
2021-09-19 12:43:56 +01:00
datagram.c
net/ipv4/datagram.c: remove superfluous header files from datagram.c
2021-09-29 11:39:33 +01:00
devinet.c
net: return correct error code
2021-11-15 14:22:12 +00:00
esp4_offload.c
xfrm: remove description from xfrm_type struct
2021-06-09 09:38:52 +02:00
esp4.c
ipsec: Remove unneeded extra variable in esp4 esp_ssg_unref()
2021-07-20 16:14:23 +02:00
fib_frontend.c
net: Use nlmsg_unicast() instead of netlink_unicast()
2021-07-13 09:28:29 -07:00
fib_lookup.h
ipv4: Fix spelling mistakes
2021-06-07 14:08:30 -07:00
fib_notifier.c
net: ipv4: remove superfluous header files from fib_notifier.c
2021-09-28 17:32:56 -07:00
fib_rules.c
fib: use indirect call wrappers in the most common fib_rules_ops
2020-07-28 17:42:31 -07:00
fib_semantics.c
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
2021-09-24 14:07:10 +01:00
fib_trie.c
memcg: enable accounting for IP address and routing-related objects
2021-07-20 06:00:38 -07:00
fou.c
fou: remove sparse errors
2021-08-31 12:03:33 +01:00
gre_demux.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
gre_offload.c
ip_gre: add csum offload support for gre header
2021-01-29 20:39:14 -08:00
icmp.c
icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe
2021-10-14 07:54:47 -07:00
igmp.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2021-08-13 06:41:22 -07:00
inet_connection_sock.c
tcp: switch orphan_count to bare per-cpu counters
2021-10-15 11:28:34 +01:00
inet_diag.c
net: introduce sk_forward_alloc_get()
2021-10-27 18:20:29 -07:00
inet_fragment.c
inet: frags: batch fqdir destroy works
2020-12-12 15:08:54 -08:00
inet_hashtables.c
tcp: switch orphan_count to bare per-cpu counters
2021-10-15 11:28:34 +01:00
inet_timewait_sock.c
net: Use generic ns_common::count
2020-08-19 14:06:36 +02:00
inetpeer.c
inetpeer: use div64_ul() and clamp_val() calculate inet_peer_threshold
2021-03-01 13:32:12 -08:00
ip_forward.c
…
ip_fragment.c
…
ip_gre.c
ip: use dev_addr_set() in tunnels
2021-10-13 09:41:37 -07:00
ip_input.c
net: use indirect call helpers for dst_input
2021-02-03 14:51:39 -08:00
ip_options.c
net: clean up codestyle for net/ipv4
2020-08-25 06:28:02 -07:00
ip_output.c
net: ipv4: Fix the warning for dereference
2021-08-30 12:47:09 +01:00
ip_sockglue.c
ipv4: guard IP_MINTTL with a static key
2021-10-25 18:02:14 -07:00
ip_tunnel_core.c
net: ip_tunnel: clean up endianness conversions
2021-01-08 19:25:35 -08:00
ip_tunnel.c
ip: use dev_addr_set() in tunnels
2021-10-13 09:41:37 -07:00
ip_vti.c
ip: use dev_addr_set() in tunnels
2021-10-13 09:41:37 -07:00
ipcomp.c
Merge tag 'net-next-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2021-06-30 15:51:09 -07:00
ipconfig.c
net: ipconfig: Release the rtnl_lock while waiting for carrier
2021-10-28 14:36:41 +01:00
ipip.c
ip: use dev_addr_set() in tunnels
2021-10-13 09:41:37 -07:00
ipmr_base.c
…
ipmr.c
ipmr: Fix indentation issue
2021-07-07 20:52:25 -07:00
Kconfig
net: ipv4: remove duplicate "the the" phrase in Kconfig text
2020-08-18 16:02:16 -07:00
Makefile
bpf: Clean up sockmap related Kconfigs
2021-02-26 12:28:03 -08:00
metrics.c
treewide: rename nla_strlcpy to nla_strscpy.
2020-11-16 08:08:54 -08:00
netfilter.c
netfilter: Dissect flow after packet mangling
2021-04-18 22:04:16 +02:00
netlink.c
…
nexthop.c
net: nexthop: fix null pointer dereference when IPv6 is not enabled
2021-11-23 11:39:53 +00:00
ping.c
Revert "Revert "ipv4: fix memory leaks in ip_cmsg_send() callers""
2021-09-14 14:24:31 +01:00
proc.c
tcp: switch orphan_count to bare per-cpu counters
2021-10-15 11:28:34 +01:00
protocol.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
raw_diag.c
net: Use nlmsg_unicast() instead of netlink_unicast()
2021-07-13 09:28:29 -07:00
raw.c
Revert "Revert "ipv4: fix memory leaks in ip_cmsg_send() callers""
2021-09-14 14:24:31 +01:00
route.c
net/ipv4/route.c: remove superfluous header files from route.c
2021-09-20 13:09:06 +01:00
syncookies.c
net/ipv4/syncookies.c: remove superfluous header files from syncookies.c
2021-09-21 10:48:47 +01:00
sysctl_net_ipv4.c
tcp: remove sk_{tr}x_skb_cache
2021-09-23 12:50:26 +01:00
tcp_bbr.c
bpf: Enable TCP congestion control kfunc from modules
2021-10-05 17:07:41 -07:00
tcp_bic.c
tcp: fix stretch ACK bugs in BIC
2020-03-16 18:26:54 -07:00
tcp_bpf.c
bpf, sockmap: Fix race in ingress receive verdict with redirect to self
2021-11-09 00:58:26 +01:00
tcp_cdg.c
…
tcp_cong.c
net: Only allow init netns to set default tcp cong to a restricted algo
2021-05-04 11:58:28 -07:00
tcp_cubic.c
bpf: Enable TCP congestion control kfunc from modules
2021-10-05 17:07:41 -07:00
tcp_dctcp.c
bpf: Enable TCP congestion control kfunc from modules
2021-10-05 17:07:41 -07:00
tcp_dctcp.h
…
tcp_diag.c
inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data
2020-02-27 18:50:19 -08:00
tcp_fastopen.c
net/ipv4/tcp_fastopen.c: remove superfluous header files from tcp_fastopen.c
2021-09-20 13:09:06 +01:00
tcp_highspeed.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_htcp.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_hybla.c
…
tcp_illinois.c
…
tcp_input.c
tcp: adjust rcv_ssthresh according to sk_reserved_mem
2021-09-30 13:36:46 +01:00
tcp_ipv4.c
ipv4: guard IP_MINTTL with a static key
2021-10-25 18:02:14 -07:00
tcp_lp.c
ipv4: tcp_lp.c: Couple of typo fixes
2021-03-28 17:31:13 -07:00
tcp_metrics.c
Merge tag 'fixes-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux
2020-12-14 16:40:27 -08:00
tcp_minisocks.c
net/ipv4/tcp_minisocks.c: remove superfluous header files from tcp_minisocks.c
2021-09-20 13:09:06 +01:00
tcp_nv.c
net/ipv4/tcp_nv.c: remove superfluous header files from tcp_nv.c
2021-09-27 12:47:39 +01:00
tcp_offload.c
net, gro: Set inner transport header offset in tcp/udp GRO hook
2021-08-02 10:20:56 +01:00
tcp_output.c
tcp: Use BIT() for OPTION_* constants
2021-11-04 11:26:15 +00:00
tcp_rate.c
tcp: tracking packets with CE marks in BW rate sample
2021-09-24 14:16:40 +01:00
tcp_recovery.c
tcp: more accurately check DSACKs to grow RACK reordering window
2021-07-27 20:07:21 +01:00
tcp_scalable.c
net: ipv4: delete repeated words
2020-08-24 17:31:20 -07:00
tcp_timer.c
net: sock: introduce sk_error_report
2021-06-29 11:28:21 -07:00
tcp_ulp.c
bpf: sockmap: Only check ULP for TCP sockets
2020-03-09 22:34:58 +01:00
tcp_vegas.c
tcp: use semicolons rather than commas to separate statements
2020-10-13 17:11:52 -07:00
tcp_vegas.h
…
tcp_veno.c
Replace HTTP links with HTTPS ones: IPv*
2020-07-06 13:23:03 -07:00
tcp_westwood.c
…
tcp_yeah.c
tcp_yeah: check struct yeah size at compile time
2021-06-29 11:54:36 -07:00
tcp.c
tcp: Fix uninitialized access in skb frags array for Rx 0cp.
2021-11-12 20:13:28 -08:00
tunnel4.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
udp_bpf.c
net: Implement ->sock_is_readable() for UDP and AF_UNIX
2021-10-26 12:29:33 -07:00
udp_diag.c
net: Use nlmsg_unicast() instead of netlink_unicast()
2021-07-13 09:28:29 -07:00
udp_impl.h
net: pass a sockptr_t into ->setsockopt
2020-07-24 15:41:54 -07:00
udp_offload.c
fou: remove sparse errors
2021-08-31 12:03:33 +01:00
udp_tunnel_core.c
net/ipv4/udp_tunnel_core.c: remove superfluous header files from udp_tunnel_core.c
2021-09-21 10:17:20 +01:00
udp_tunnel_nic.c
udp_tunnel: Fix udp_tunnel_nic work-queue type
2021-09-13 12:38:45 +01:00
udp_tunnel_stub.c
udp_tunnel: add central NIC RX port offload infrastructure
2020-07-10 13:54:00 -07:00
udp.c
udp: Validate checksum in udp_read_sock()
2021-11-16 13:18:23 +01:00
udplite.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
xfrm4_input.c
xfrm: state: remove extract_input indirection from xfrm_state_afinfo
2020-05-06 09:40:08 +02:00
xfrm4_output.c
xfrm: fix unused variable warning if CONFIG_NETFILTER=n
2020-05-11 15:12:27 +02:00
xfrm4_policy.c
…
xfrm4_protocol.c
net: Remove the member netns_ok
2021-05-17 15:29:35 -07:00
xfrm4_state.c
xfrm: remove output_finish indirection from xfrm_state_afinfo
2020-05-06 09:40:08 +02:00
xfrm4_tunnel.c
net/ipv4/xfrm4_tunnel.c: remove superfluous header files from xfrm4_tunnel.c
2021-09-23 10:10:00 +02:00