From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Ian Kumlien <ian.kumlien@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 21/59] flow_dissector: Update pptp handling to avoid null pointer deref.
Date: Fri, 13 Jan 2017 13:01:28 +0100 [thread overview]
Message-ID: <20170113113840.170071947@linuxfoundation.org> (raw)
In-Reply-To: <20170113113839.364876751@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Kumlien <ian.kumlien@gmail.com>
[ Upstream commit d0af683407a26a4437d8fa6e283ea201f2ae8146 ]
__skb_flow_dissect can be called with a skb or a data packet, either
can be NULL. All calls seems to have been moved to __skb_header_pointer
except the pptp handling which is still calling skb_header_pointer.
skb_header_pointer will use skb->data and thus:
[ 109.556866] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
[ 109.557102] IP: [<ffffffff88dc02f8>] __skb_flow_dissect+0xa88/0xce0
[ 109.557263] PGD 0
[ 109.557338]
[ 109.557484] Oops: 0000 [#1] SMP
[ 109.557562] Modules linked in: chaoskey
[ 109.557783] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.9.0 #79
[ 109.557867] Hardware name: Supermicro A1SRM-LN7F/LN5F/A1SRM-LN7F-2758, BIOS 1.0c 11/04/2015
[ 109.557957] task: ffff94085c27bc00 task.stack: ffffb745c0068000
[ 109.558041] RIP: 0010:[<ffffffff88dc02f8>] [<ffffffff88dc02f8>] __skb_flow_dissect+0xa88/0xce0
[ 109.558203] RSP: 0018:ffff94087fc83d40 EFLAGS: 00010206
[ 109.558286] RAX: 0000000000000130 RBX: ffffffff8975bf80 RCX: ffff94084fab6800
[ 109.558373] RDX: 0000000000000010 RSI: 000000000000000c RDI: 0000000000000000
[ 109.558460] RBP: 0000000000000b88 R08: 0000000000000000 R09: 0000000000000022
[ 109.558547] R10: 0000000000000008 R11: ffff94087fc83e04 R12: 0000000000000000
[ 109.558763] R13: ffff94084fab6800 R14: ffff94087fc83e04 R15: 000000000000002f
[ 109.558979] FS: 0000000000000000(0000) GS:ffff94087fc80000(0000) knlGS:0000000000000000
[ 109.559326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.559539] CR2: 0000000000000080 CR3: 0000000281809000 CR4: 00000000001026e0
[ 109.559753] Stack:
[ 109.559957] 000000000000000c ffff94084fab6822 0000000000000001 ffff94085c2b5fc0
[ 109.560578] 0000000000000001 0000000000002000 0000000000000000 0000000000000000
[ 109.561200] 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[ 109.561820] Call Trace:
[ 109.562027] <IRQ>
[ 109.562108] [<ffffffff88dfb4fa>] ? eth_get_headlen+0x7a/0xf0
[ 109.562522] [<ffffffff88c5a35a>] ? igb_poll+0x96a/0xe80
[ 109.562737] [<ffffffff88dc912b>] ? net_rx_action+0x20b/0x350
[ 109.562953] [<ffffffff88546d68>] ? __do_softirq+0xe8/0x280
[ 109.563169] [<ffffffff8854704a>] ? irq_exit+0xaa/0xb0
[ 109.563382] [<ffffffff8847229b>] ? do_IRQ+0x4b/0xc0
[ 109.563597] [<ffffffff8902d4ff>] ? common_interrupt+0x7f/0x7f
[ 109.563810] <EOI>
[ 109.563890] [<ffffffff88d57530>] ? cpuidle_enter_state+0x130/0x2c0
[ 109.564304] [<ffffffff88d57520>] ? cpuidle_enter_state+0x120/0x2c0
[ 109.564520] [<ffffffff8857eacf>] ? cpu_startup_entry+0x19f/0x1f0
[ 109.564737] [<ffffffff8848d55a>] ? start_secondary+0x12a/0x140
[ 109.564950] Code: 83 e2 20 a8 80 0f 84 60 01 00 00 c7 04 24 08 00
00 00 66 85 d2 0f 84 be fe ff ff e9 69 fe ff ff 8b 34 24 89 f2 83 c2
04 66 85 c0 <41> 8b 84 24 80 00 00 00 0f 49 d6 41 8d 31 01 d6 41 2b 84
24 84
[ 109.569959] RIP [<ffffffff88dc02f8>] __skb_flow_dissect+0xa88/0xce0
[ 109.570245] RSP <ffff94087fc83d40>
[ 109.570453] CR2: 0000000000000080
Fixes: ab10dccb1160 ("rps: Inspect PPTP encapsulated by GRE to get flow hash")
Signed-off-by: Ian Kumlien <ian.kumlien@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/flow_dissector.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -445,8 +445,9 @@ ip_proto_again:
if (hdr->flags & GRE_ACK)
offset += sizeof(((struct pptp_gre_header *)0)->ack);
- ppp_hdr = skb_header_pointer(skb, nhoff + offset,
- sizeof(_ppp_hdr), _ppp_hdr);
+ ppp_hdr = __skb_header_pointer(skb, nhoff + offset,
+ sizeof(_ppp_hdr),
+ data, hlen, _ppp_hdr);
if (!ppp_hdr)
goto out_bad;
next prev parent reply other threads:[~2017-01-13 12:15 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20170113120315epcas3p230e25f6a27069614fecfb95292c2ba78@epcas3p2.samsung.com>
2017-01-13 12:01 ` [PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 01/59] net: vrf: Fix NAT within a VRF Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 02/59] net: vrf: Drop conntrack data after pass through VRF device on Tx Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 03/59] sctp: sctp_transport_lookup_process should rcu_read_unlock when transport is null Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 04/59] inet: fix IP(V6)_RECVORIGDSTADDR for udp sockets Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 05/59] ipv6: handle -EFAULT from skb_copy_bits Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 06/59] net, sched: fix soft lockup in tc_classify Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 07/59] net: stmmac: Fix race between stmmac_drv_probe and stmmac_open Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 08/59] net/sched: cls_flower: Fix missing addr_type in classify Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 09/59] net/mlx5: Check FW limitations on log_max_qp before setting it Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 10/59] net/mlx5: Cancel recovery work in remove flow Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 11/59] net/mlx5: Avoid shadowing numa_node Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 12/59] net/mlx5: Mask destination mac value in ethtool steering rules Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 13/59] net/mlx5: Prevent setting multicast macs for VFs Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 14/59] net/mlx5e: Dont sync netdev state when not registered Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 15/59] net/mlx5e: Disable netdev after close Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 16/59] rtnl: stats - add missing netlink message size checks Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 17/59] net: fix incorrect original ingress device index in PKTINFO Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 18/59] net: ipv4: dst for local input routes should use l3mdev if relevant Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 19/59] drop_monitor: add missing call to genlmsg_end Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 20/59] drop_monitor: consider inserted data in genlmsg_end Greg Kroah-Hartman
2017-01-13 12:01 ` Greg Kroah-Hartman [this message]
2017-01-13 12:01 ` [PATCH 4.9 22/59] igmp: Make igmp group member RFC 3376 compliant Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 23/59] ipv4: Do not allow MAIN to be alias for new LOCAL w/ custom rules Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 24/59] net: vrf: Add missing Rx counters Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 25/59] bpf: change back to orig prog on too many passes Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 26/59] net: dsa: bcm_sf2: Do not clobber b53_switch_ops Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 27/59] net: dsa: bcm_sf2: Utilize nested MDIO read/write Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 28/59] r8152: split rtl8152_suspend function Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 29/59] r8152: fix rx issue for runtime suspend Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 30/59] net: dsa: Ensure validity of dst->ds[0] Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 31/59] net: add the AF_QIPCRTR entries to family name tables Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 32/59] gro: Enter slow-path if there is no tailroom Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 33/59] gro: use min_t() in skb_gro_reset_offset() Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 34/59] gro: Disable frag0 optimization on IPv6 ext headers Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 35/59] net/mlx5e: Remove WARN_ONCE from adaptive moderation code Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 36/59] net: ipv4: Fix multipath selection with vrf Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 37/59] net: vrf: do not allow table id 0 Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 38/59] HID: hid-cypress: validate length of report Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 39/59] ALSA: firewire-tascam: Fix to handle error from initialization of stream data Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 40/59] powerpc: Fix build warning on 32-bit PPC Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 41/59] tools/virtio: fix READ_ONCE() Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 42/59] arm64: dts: mt8173: Fix auxadc node Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 43/59] ARM64: dts: bcm2837-rpi-3-b: remove incorrect pwr LED Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 45/59] ARM: pxa: fix pxa25x interrupt init Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 46/59] ARM: zynq: Reserve correct amount of non-DMA RAM Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 47/59] ARM: qcom_defconfig: Fix MDM9515 LCC and GCC config Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 48/59] svcrdma: Clear xpt_bc_xps in xprt_setup_rdma_bc() error exit arm Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 49/59] bus: arm-ccn: Prevent hotplug callback leak Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 50/59] ARM: OMAP5: Fix mpuss_early_init Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 51/59] ARM: OMAP5: Fix build for PM code Greg Kroah-Hartman
2017-01-13 12:01 ` [PATCH 4.9 52/59] ARM: OMAP4+: Fix bad fallthrough for cpuidle Greg Kroah-Hartman
2017-01-13 12:02 ` [PATCH 4.9 53/59] ARM: 8631/1: clkdev: Detect errors in clk_hw_register_clkdev() for mass registration Greg Kroah-Hartman
2017-01-13 12:02 ` [PATCH 4.9 54/59] ARM: omap2+: am437x: rollback to use omap3_gptimer_timer_init() Greg Kroah-Hartman
2017-01-13 12:02 ` [PATCH 4.9 56/59] ALSA: usb-audio: Add a quirk for Plantronics BT600 Greg Kroah-Hartman
2017-01-13 12:02 ` [PATCH 4.9 58/59] rtlwifi: Fix enter/exit power_save Greg Kroah-Hartman
2017-01-13 12:02 ` [PATCH 4.9 59/59] rtlwifi: rtl_usb: Fix missing entry in USB drivers private data Greg Kroah-Hartman
2017-01-13 20:20 ` [PATCH 4.9 00/59] 4.9.4-stable review Guenter Roeck
2017-01-14 7:23 ` Greg Kroah-Hartman
2017-01-13 21:58 ` Shuah Khan
2017-01-14 7:24 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170113113840.170071947@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=ian.kumlien@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome