]>
Commit | Line | Data |
---|---|---|
835a39eb TL |
1 | From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
2 | From: Juerg Haefliger <juerg.haefliger@canonical.com> | |
3 | Date: Fri, 18 Jan 2019 13:40:02 +0100 | |
4 | Subject: [PATCH] UBUNTU: SAUCE: fan: Fix NULL pointer dereference | |
5 | ||
6 | BugLink: https://bugs.launchpad.net/bugs/1811803 | |
7 | ||
8 | Fix a NULL pointer dereference in fan code that can easily be triggered | |
9 | by running: | |
10 | $ sudo ip link add foo type ipip | |
11 | ||
12 | Which leads to: | |
13 | [ 1.330067] BUG: unable to handle kernel NULL pointer dereference at 0000000000000108 | |
14 | [ 1.330792] IP: [<ffffffff817e8132>] ipip_netlink_fan.isra.7+0x12/0x280 | |
15 | [ 1.331399] PGD 800000003fb94067 PUD 3fb93067 PMD 0 | |
16 | [ 1.331882] Oops: 0000 [#1] SMP | |
17 | [ 1.332200] Modules linked in: | |
18 | [ 1.332492] CPU: 0 PID: 137 Comm: ip Not tainted 4.4.167+ #5 | |
19 | [ 1.333001] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1ubuntu1 04/01/2014 | |
20 | [ 1.333740] task: ffff88003c38a640 ti: ffff88003fb5c000 task.ti: ffff88003fb5c000 | |
21 | [ 1.334375] RIP: 0010:[<ffffffff817e8132>] [<ffffffff817e8132>] ipip_netlink_fan.isra.7+0x12/0x280 | |
22 | [ 1.335193] RSP: 0018:ffff88003fb5f778 EFLAGS: 00010246 | |
23 | [ 1.335671] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 | |
24 | [ 1.336305] RDX: ffff88003fb5f7f0 RSI: ffff88003fa3f840 RDI: 0000000000000000 | |
25 | [ 1.336940] RBP: ffff88003fb5f7a0 R08: 000000000000000a R09: 0000000000000092 | |
26 | [ 1.337587] R10: 0000000000000000 R11: 00000000000001ad R12: ffff88003fa3f000 | |
27 | [ 1.338267] R13: ffff88003fb5f9d0 R14: ffff88003fa3f840 R15: ffffffff81f4b240 | |
28 | [ 1.338904] FS: 00007f535979b700(0000) GS:ffff88003e400000(0000) knlGS:0000000000000000 | |
29 | [ 1.339590] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | |
30 | [ 1.340066] CR2: 0000000000000108 CR3: 000000003fb60000 CR4: 0000000000000670 | |
31 | [ 1.340750] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 | |
32 | [ 1.341341] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 | |
33 | [ 1.341909] Stack: | |
34 | [ 1.342080] 0000000000000000 ffff88003fa3f000 ffff88003fb5f9d0 ffff88003fa3f840 | |
35 | [ 1.342725] ffffffff81f4b240 ffff88003fb5f828 ffffffff817e8515 0000000381356f0e | |
36 | [ 1.343334] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 | |
37 | [ 1.343943] Call Trace: | |
38 | [ 1.344141] [<ffffffff817e8515>] ipip_newlink+0xa5/0xc0 | |
39 | [ 1.344553] [<ffffffff81782f5b>] ? __netlink_ns_capable+0x3b/0x40 | |
40 | [ 1.345029] [<ffffffff817651fd>] rtnl_newlink+0x6fd/0x8b0 | |
41 | [ 1.345699] [<ffffffff811f92b1>] ? kmem_cache_alloc+0x1a1/0x1f0 | |
42 | [ 1.346165] [<ffffffff8119abd5>] ? mempool_alloc_slab+0x15/0x20 | |
43 | [ 1.346630] [<ffffffff81436463>] ? validate_nla+0x93/0x1a0 | |
44 | [ 1.347060] [<ffffffff81436680>] ? nla_parse+0xa0/0x100 | |
45 | [ 1.347474] [<ffffffff81436732>] ? nla_strlcpy+0x52/0x60 | |
46 | [ 1.347891] [<ffffffff81762099>] ? rtnl_link_ops_get+0x39/0x50 | |
47 | [ 1.348347] [<ffffffff81764c76>] ? rtnl_newlink+0x176/0x8b0 | |
48 | [ 1.348784] [<ffffffff8176373c>] rtnetlink_rcv_msg+0xec/0x230 | |
49 | [ 1.349237] [<ffffffff811fce3b>] ? __kmalloc_node_track_caller+0x24b/0x310 | |
50 | [ 1.349774] [<ffffffff8173e397>] ? __alloc_skb+0x87/0x1d0 | |
51 | [ 1.350198] [<ffffffff81763650>] ? rtnetlink_rcv+0x30/0x30 | |
52 | [ 1.350628] [<ffffffff81786da6>] netlink_rcv_skb+0xa6/0xc0 | |
53 | [ 1.351059] [<ffffffff81763648>] rtnetlink_rcv+0x28/0x30 | |
54 | [ 1.351476] [<ffffffff81786770>] netlink_unicast+0x190/0x240 | |
55 | [ 1.351919] [<ffffffff81786b5a>] netlink_sendmsg+0x33a/0x3b0 | |
56 | [ 1.352363] [<ffffffff813af211>] ? aa_sock_msg_perm+0x61/0x150 | |
57 | [ 1.352820] [<ffffffff81734bde>] sock_sendmsg+0x3e/0x50 | |
58 | [ 1.353235] [<ffffffff817356a7>] ___sys_sendmsg+0x287/0x2a0 | |
59 | [ 1.353672] [<ffffffff8120ed2b>] ? mem_cgroup_try_charge+0x6b/0x1e0 | |
60 | [ 1.354162] [<ffffffff811cb9ed>] ? handle_mm_fault+0xecd/0x1b80 | |
61 | [ 1.354625] [<ffffffff81239fc7>] ? __alloc_fd+0xc7/0x190 | |
62 | [ 1.355044] [<ffffffff81736021>] __sys_sendmsg+0x51/0x90 | |
63 | [ 1.355525] [<ffffffff81736072>] SyS_sendmsg+0x12/0x20 | |
64 | [ 1.355933] [<ffffffff81866e1b>] entry_SYSCALL_64_fastpath+0x22/0xcb | |
65 | [ 1.356426] Code: 50 01 00 00 01 eb d3 49 8d 94 24 b8 08 00 00 eb ac e8 83 cf 89 ff 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 <48> 8b 9f 08 01 00 00 48 85 db 74 1e 8b 02 85 c0 75 25 44 0f b7 | |
66 | [ 1.358557] RIP [<ffffffff817e8132>] ipip_netlink_fan.isra.7+0x12/0x280 | |
67 | [ 1.359086] RSP <ffff88003fb5f778> | |
68 | [ 1.359359] CR2: 0000000000000108 | |
69 | [ 1.359637] ---[ end trace 7820fbc7ced5dd6e ]--- | |
70 | ||
71 | Signed-off-by: Juerg Haefliger <juergh@canonical.com> | |
72 | Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> | |
73 | --- | |
74 | net/ipv4/ipip.c | 2 +- | |
75 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
76 | ||
77 | diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c | |
78 | index 147ff0466c2b..85c5e07fd619 100644 | |
79 | --- a/net/ipv4/ipip.c | |
80 | +++ b/net/ipv4/ipip.c | |
81 | @@ -720,7 +720,7 @@ static int ipip_netlink_fan(struct nlattr *data[], struct ip_tunnel *t, | |
82 | struct nlattr *attr; | |
83 | int rem, rv; | |
84 | ||
85 | - if (!data[IFLA_IPTUN_FAN_MAP]) | |
86 | + if (data == NULL || !data[IFLA_IPTUN_FAN_MAP]) | |
87 | return 0; | |
88 | ||
89 | if (parms->iph.daddr) |