Vlad Buslov 60e9babfda net: sched: verify that q!=NULL before setting q->flags ... commit 503d81d428 upstream. In function int tc_new_tfilter() q pointer can be NULL when adding filter on a shared block. With recent change that resets TCQ_F_CAN_BYPASS after filter creation, following NULL pointer dereference happens in case parent block is shared: [ 212.925060] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 212.925445] #PF: supervisor write access in kernel mode [ 212.925709] #PF: error_code(0x0002) - not-present page [ 212.925965] PGD 8000000827923067 P4D 8000000827923067 PUD 827924067 PMD 0 [ 212.926302] Oops: 0002 [#1] SMP KASAN PTI [ 212.926539] CPU: 18 PID: 2617 Comm: tc Tainted: G B 5.2.0+ #512 [ 212.926938] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017 [ 212.927364] RIP: 0010:tc_new_tfilter+0x698/0xd40 [ 212.927633] Code: 74 0d 48 85 c0 74 08 48 89 ef e8 03 aa 62 00 48 8b 84 24 a0 00 00 00 48 8d 78 10 48 89 44 24 18 e8 4d 0c 6b ff 48 8b 44 24 18 <83> 60 10 f b 48 85 ed 0f 85 3d fe ff ff e9 4f fe ff ff e8 81 26 f8 [ 212.928607] RSP: 0018:ffff88884fd5f5d8 EFLAGS: 00010296 [ 212.928905] RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000 [ 212.929201] RDX: 0000000000000007 RSI: 0000000000000004 RDI: 0000000000000297 [ 212.929402] RBP: ffff88886bedd600 R08: ffffffffb91d4b51 R09: fffffbfff7616e4d [ 212.929609] R10: fffffbfff7616e4c R11: ffffffffbb0b7263 R12: ffff88886bc61040 [ 212.929803] R13: ffff88884fd5f950 R14: ffffc900039c5000 R15: ffff88835e927680 [ 212.929999] FS: 00007fe7c50b6480(0000) GS:ffff88886f980000(0000) knlGS:0000000000000000 [ 212.930235] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 212.930394] CR2: 0000000000000010 CR3: 000000085bd04002 CR4: 00000000001606e0 [ 212.930588] Call Trace: [ 212.930682] ? tc_del_tfilter+0xa40/0xa40 [ 212.930811] ? __lock_acquire+0x5b5/0x2460 [ 212.930948] ? find_held_lock+0x85/0xa0 [ 212.931081] ? tc_del_tfilter+0xa40/0xa40 [ 212.931201] rtnetlink_rcv_msg+0x4ab/0x5f0 [ 212.931332] ? rtnl_dellink+0x490/0x490 [ 212.931454] ? lockdep_hardirqs_on+0x260/0x260 [ 212.931589] ? netlink_deliver_tap+0xab/0x5a0 [ 212.931717] ? match_held_lock+0x1b/0x240 [ 212.931844] netlink_rcv_skb+0xd0/0x200 [ 212.931958] ? rtnl_dellink+0x490/0x490 [ 212.932079] ? netlink_ack+0x440/0x440 [ 212.932205] ? netlink_deliver_tap+0x161/0x5a0 [ 212.932335] ? lock_downgrade+0x360/0x360 [ 212.932457] ? lock_acquire+0xe5/0x210 [ 212.932579] netlink_unicast+0x296/0x350 [ 212.932705] ? netlink_attachskb+0x390/0x390 [ 212.932834] ? _copy_from_iter_full+0xe0/0x3a0 [ 212.932976] netlink_sendmsg+0x394/0x600 [ 212.937998] ? netlink_unicast+0x350/0x350 [ 212.943033] ? move_addr_to_kernel.part.0+0x90/0x90 [ 212.948115] ? netlink_unicast+0x350/0x350 [ 212.953185] sock_sendmsg+0x96/0xa0 [ 212.958099] ___sys_sendmsg+0x482/0x520 [ 212.962881] ? match_held_lock+0x1b/0x240 [ 212.967618] ? copy_msghdr_from_user+0x250/0x250 [ 212.972337] ? lock_downgrade+0x360/0x360 [ 212.976973] ? rwlock_bug.part.0+0x60/0x60 [ 212.981548] ? __mod_node_page_state+0x1f/0xa0 [ 212.986060] ? match_held_lock+0x1b/0x240 [ 212.990567] ? find_held_lock+0x85/0xa0 [ 212.994989] ? do_user_addr_fault+0x349/0x5b0 [ 212.999387] ? lock_downgrade+0x360/0x360 [ 213.003713] ? find_held_lock+0x85/0xa0 [ 213.007972] ? __fget_light+0xa1/0xf0 [ 213.012143] ? sockfd_lookup_light+0x91/0xb0 [ 213.016165] __sys_sendmsg+0xba/0x130 [ 213.020040] ? __sys_sendmsg_sock+0xb0/0xb0 [ 213.023870] ? handle_mm_fault+0x337/0x470 [ 213.027592] ? page_fault+0x8/0x30 [ 213.031316] ? lockdep_hardirqs_off+0xbe/0x100 [ 213.034999] ? mark_held_locks+0x24/0x90 [ 213.038671] ? do_syscall_64+0x1e/0xe0 [ 213.042297] do_syscall_64+0x74/0xe0 [ 213.045828] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 213.049354] RIP: 0033:0x7fe7c527c7b8 [ 213.052792] Code: 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 65 8f 0c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f 0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 89 54 [ 213.060269] RSP: 002b:00007ffc3f7908a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 213.064144] RAX: ffffffffffffffda RBX: 000000005d34716f RCX: 00007fe7c527c7b8 [ 213.068094] RDX: 0000000000000000 RSI: 00007ffc3f790910 RDI: 0000000000000003 [ 213.072109] RBP: 0000000000000000 R08: 0000000000000001 R09: 00007fe7c5340cc0 [ 213.076113] R10: 0000000000404ec2 R11: 0000000000000246 R12: 0000000000000080 [ 213.080146] R13: 0000000000480640 R14: 0000000000000080 R15: 0000000000000000 [ 213.084147] Modules linked in: act_gact cls_flower sch_ingress nfsv3 nfs_acl nfs lockd grace fscache bridge stp llc sunrpc intel_rapl_msr intel_rapl_common [<1;69;32Msb_edac rdma_ucm rdma_cm x86_pkg_temp_thermal iw_cm intel_powerclamp ib_cm coretemp kvm_intel kvm irqbypass mlx5_ib ib_uverbs ib_core crct10dif_pclmul crc32_pc lmul crc32c_intel ghash_clmulni_intel mlx5_core intel_cstate intel_uncore iTCO_wdt igb iTCO_vendor_support mlxfw mei_me ptp ses intel_rapl_perf mei pcspkr ipmi _ssif i2c_i801 joydev enclosure pps_core lpc_ich ioatdma wmi dca ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter acpi_pad ast i2c_algo_bit drm_vram_helpe r ttm drm_kms_helper drm mpt3sas raid_class scsi_transport_sas [ 213.112326] CR2: 0000000000000010 [ 213.117429] ---[ end trace adb58eb0a4ee6283 ]--- Verify that q pointer is not NULL before setting the 'flags' field. Fixes: 3f05e6886a ("net_sched: unset TCQ_F_CAN_BYPASS when adding filters") Signed-off-by: Vlad Buslov <vladbu@mellanox.com> Acked-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> Cc: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-07-28 08:29:30 +02:00
..
6lowpan
9p	9p/virtio: Add cleanup path in p9_virtio_init	2019-07-26 09:14:25 +02:00
802
8021q	vlan: disable SIOCSHWTSTAMP in container	2019-05-16 19:41:30 +02:00
appletalk	appletalk: Fix use-after-free in atalk_proc_exit	2019-04-20 09:16:05 +02:00
atm	net: atm: Fix potential Spectre v1 vulnerabilities	2019-04-27 09:36:30 +02:00
ax25	ax25: fix inconsistent lock state in ax25_destroy_timer	2019-06-22 08:15:13 +02:00
batman-adv	batman-adv: Fix duplicated OGMs on NETDEV_UP	2019-07-26 09:14:03 +02:00
bluetooth	Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug	2019-07-26 09:14:30 +02:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	net: bpfilter: use get_pid_task instead of pid_task	2018-10-17 22:03:40 -07:00
bridge	net: bridge: stp: don't cache eth dest pointer before skb pull	2019-07-28 08:29:27 +02:00
caif	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
can	can: af_can: Fix error path of can_init()	2019-07-14 08:11:07 +02:00
ceph	libceph: wait for latest osdmap in ceph_monc_blacklist_add()	2019-03-27 14:14:39 +09:00
core	tcp: fix tcp_set_congestion_control() use from bpf hook	2019-07-28 08:29:26 +02:00
dcb	net: dcb: Add priority-to-DSCP map getters	2018-07-27 13:17:50 -07:00
dccp	dccp: do not use ipv6 header for ipv4 flow	2019-04-03 06:26:15 +02:00
decnet	decnet: fix using plain integer as NULL warning	2018-08-09 14:11:24 -07:00
dns_resolver	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
dsa	net: dsa: Fix error cleanup path in dsa_init_module	2019-05-16 19:41:29 +02:00
ethernet
hsr	net/hsr: fix possible crash in add_timer()	2019-03-19 13:12:38 +01:00
ieee802154	ieee802154: lowpan_header_create check must check daddr	2019-01-09 17:38:31 +01:00
ife
ipv4	tcp: Reset bytes_acked and bytes_received when disconnecting	2019-07-28 08:29:26 +02:00
ipv6	ipv6: Unlink sibling route in case of failure	2019-07-28 08:29:24 +02:00
iucv	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:38:40 +02:00
key	af_key: fix leaks in key_pol_get_resp and dump_sp.	2019-07-26 09:14:01 +02:00
l2tp	l2tp: use rcu_dereference_sk_user_data() in l2tp_udp_encap_recv()	2019-05-05 14:42:37 +02:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:15:13 +02:00
llc	llc: fix skb leak in llc_build_and_send_ui_pkt()	2019-06-04 08:02:31 +02:00
mac80211	mac80211: do not start any work during reconfigure flow	2019-07-14 08:11:11 +02:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-08-06 11:21:37 +02:00
mpls	mpls: Return error for RTA_GATEWAY attribute	2019-03-10 07:17:19 +01:00
ncsi	net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler	2018-08-22 21:39:08 -07:00
netfilter	net: make skb_dst_force return true when dst is refcounted	2019-07-28 08:29:24 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-03-10 07:17:18 +01:00
netlink	genetlink: Fix a memory leak on error path	2019-04-03 06:26:15 +02:00
netrom	netrom: hold sock when setting skb->destructor	2019-07-28 08:29:27 +02:00
nfc	nfc: fix potential illegal memory access	2019-07-28 08:29:25 +02:00
nsh	nsh: set mac len based on inner packet	2018-07-12 16:55:29 -07:00
openvswitch	net: openvswitch: fix csum updates for MPLS actions	2019-07-28 08:29:24 +02:00
packet	net/packet: fix memory leak in packet_set_ring()	2019-07-03 13:14:47 +02:00
phonet	phonet: fix building with clang	2019-03-23 20:09:51 +01:00
psample
qrtr
rds	rds: Fix warning.	2019-07-10 09:53:46 +02:00
rfkill	Here are quite a large number of fixes, notably:	2018-09-03 22:12:02 -07:00
rose	net/rose: fix unbound loop in rose_loopback_timer()	2019-05-02 09:59:00 +02:00
rxrpc	rxrpc: Fix send on a connected, but unbound socket	2019-07-28 08:29:25 +02:00
sched	net: sched: verify that q!=NULL before setting q->flags	2019-07-28 08:29:30 +02:00
sctp	sctp: not bind the socket in sctp_connect	2019-07-28 08:29:27 +02:00
smc	net/smc: move unhash before release of clcsock	2019-07-10 09:53:44 +02:00
strparser	net: strparser: partially revert "strparser: Call skb_unclone conditionally"	2019-05-16 19:41:27 +02:00
sunrpc	net :sunrpc :clnt :Fix xps refcount imbalance on the error path	2019-07-14 08:11:15 +02:00
switchdev
tipc	tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb	2019-07-03 13:14:49 +02:00
tls	net/tls: make sure offload also gets the keys wiped	2019-07-28 08:29:27 +02:00
unix	missing barriers in some of unix_sock ->addr and ->path accesses	2019-03-19 13:12:41 +01:00
vmw_vsock	vsock/virtio: set SOCK_DONE on peer shutdown	2019-06-22 08:15:14 +02:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he()	2019-07-14 08:11:04 +02:00
x25	net/x25: fix a race in x25_bind()	2019-03-19 13:12:40 +01:00
xdp	xsk: Properly terminate assignment in xskq_produce_flush_desc	2019-07-26 09:14:12 +02:00
xfrm	ipsec: select crypto ciphers for xfrm_algo	2019-07-26 09:14:10 +02:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:38:33 +01:00
Kconfig	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
Makefile
socket.c	net: socket: set sock->sk to NULL after calling proto_ops::release()	2019-03-10 07:17:18 +01:00
sysctl_net.c