github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-06 21:45:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
ba7bfcdff1
linux/drivers
History
Taehee Yoo ba7bfcdff1 bonding: fix null dereference in bond_ipsec_add_sa() 
[ Upstream commit 105cd17a86 ]

If bond doesn't have real device, bond->curr_active_slave is null.
But bond_ipsec_add_sa() dereferences bond->curr_active_slave without
null checking.
So, null-ptr-deref would occur.

Test commands:
    ip link add bond0 type bond
    ip link set bond0 up
    ip x s add proto esp dst 14.1.1.1 src 15.1.1.1 spi \
0x07 mode transport reqid 0x07 replay-window 32 aead 'rfc4106(gcm(aes))' \
0x44434241343332312423222114131211f4f3f2f1 128 sel src 14.0.0.52/24 \
dst 14.0.0.70/24 proto tcp offload dev bond0 dir in

Splat looks like:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 4 PID: 680 Comm: ip Not tainted 5.13.0-rc3+ #1168
RIP: 0010:bond_ipsec_add_sa+0xc4/0x2e0 [bonding]
Code: 85 21 02 00 00 4d 8b a6 48 0c 00 00 e8 75 58 44 ce 85 c0 0f 85 14
01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02
00 0f 85 fc 01 00 00 48 8d bb e0 02 00 00 4d 8b 2c 24 48
RSP: 0018:ffff88810946f508 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88810b4e8040 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8fe34280 RDI: ffff888115abe100
RBP: ffff88810946f528 R08: 0000000000000003 R09: fffffbfff2287e11
R10: 0000000000000001 R11: ffff888115abe0c8 R12: 0000000000000000
R13: ffffffffc0aea9a0 R14: ffff88800d7d2000 R15: ffff88810b4e8330
FS:  00007efc5552e680(0000) GS:ffff888119c00000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c2530dbf40 CR3: 0000000103056004 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 xfrm_dev_state_add+0x2a9/0x770
 ? memcpy+0x38/0x60
 xfrm_add_sa+0x2278/0x3b10 [xfrm_user]
 ? xfrm_get_policy+0xaa0/0xaa0 [xfrm_user]
 ? register_lock_class+0x1750/0x1750
 xfrm_user_rcv_msg+0x331/0x660 [xfrm_user]
 ? rcu_read_lock_sched_held+0x91/0xc0
 ? xfrm_user_state_lookup.constprop.39+0x320/0x320 [xfrm_user]
 ? find_held_lock+0x3a/0x1c0
 ? mutex_lock_io_nested+0x1210/0x1210
 ? sched_clock_cpu+0x18/0x170
 netlink_rcv_skb+0x121/0x350
 ? xfrm_user_state_lookup.constprop.39+0x320/0x320 [xfrm_user]
 ? netlink_ack+0x9d0/0x9d0
 ? netlink_deliver_tap+0x17c/0xa50
 xfrm_netlink_rcv+0x68/0x80 [xfrm_user]
 netlink_unicast+0x41c/0x610
 ? netlink_attachskb+0x710/0x710
 netlink_sendmsg+0x6b9/0xb70
[ ...]

Fixes: 18cb261afd ("bonding: support hardware encryption offload to slaves")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-28 14:35:33 +02:00
..
accessibility
acpi ACPI: video: Add quirk for the Dell Vostro 3350 2021-07-20 16:05:49 +02:00
amba amba: Fix resource leak for drivers without .remove 2021-03-04 11:38:02 +01:00
android
ata ata: ahci_sunxi: Disable DIPM 2021-07-19 09:44:59 +02:00
atm atm: nicstar: register the interrupt handler in the right place 2021-07-19 09:44:52 +02:00
auxdisplay auxdisplay: ht16k33: Fix refresh rate handling 2021-03-04 11:38:00 +01:00
base drivers: base: Fix device link removal 2021-06-03 09:00:34 +02:00
bcma
block virtio-blk: Fix memory leak among suspend/resume procedure 2021-07-20 16:05:49 +02:00
bluetooth Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc. 2021-07-19 09:44:54 +02:00
bus bus: mhi: Wait for M2 state during system resume 2021-07-14 16:55:42 +02:00
cdrom cdrom: gdrom: initialize global variable at init time 2021-05-26 12:06:55 +02:00
char virtio_console: Assure used length from device is limited 2021-07-20 16:05:49 +02:00
clk clk: tegra: Ensure that PLLU configuration is applied properly 2021-07-19 09:44:43 +02:00
clocksource clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround 2021-07-19 09:44:59 +02:00
connector
counter counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register 2021-03-25 09:04:16 +01:00
cpufreq cpufreq: Make cpufreq_online() call driver->offline() on errors 2021-07-14 16:56:13 +02:00
cpuidle cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration 2021-05-14 09:50:16 +02:00
crypto crypto: qce - fix error return code in qce_skcipher_async_req_handle() 2021-07-14 16:56:54 +02:00
dax device-dax: Fix default return code of range_parse() 2021-03-04 11:38:15 +01:00
dca
devfreq PM / devfreq: Add missing error code in devfreq_add_device() 2021-07-14 16:56:11 +02:00
dio
dma dmaengine: fsl-qdma: check dma_set_mask return value 2021-07-20 16:05:38 +02:00
dma-buf dma-buf/sync_file: Don't leak fences on merge failure 2021-07-25 14:36:20 +02:00
edac EDAC/Intel: Do not load EDAC driver when running as a guest 2021-07-14 16:56:00 +02:00
eisa
extcon extcon: intel-mrfld: Sync hardware and software state on init 2021-07-19 09:45:00 +02:00
firewire firewire: nosy: Fix a use-after-free bug in nosy_ioctl() 2021-04-07 15:00:11 +02:00
firmware firmware: turris-mox-rwtm: add marvell,armada-3700-rwtm-firmware compatible string 2021-07-25 14:36:17 +02:00
fpga fpga: stratix10-soc: Add missing fpga_mgr_free() call 2021-07-19 09:44:59 +02:00
fsi fsi: Add missing MODULE_DEVICE_TABLE 2021-07-20 16:05:42 +02:00
gnss
gpio gpio: pca953x: Add support for the On Semi pca9655 2021-07-20 16:05:43 +02:00
gpu drm/panel: nt35510: Do not fail if DSI read fails 2021-07-25 14:36:21 +02:00
greybus
hid HID: wacom: Correct base usage for capacitive ExpressKey status bits 2021-07-14 16:56:01 +02:00
hsi HSI: core: fix resource leaks in hsi_add_client_from_dt() 2021-05-14 09:50:28 +02:00
hv drivers: hv: Fix missing error code in vmbus_connect() 2021-07-14 16:55:59 +02:00
hwmon hwmon: (max31790) Fix fan speed reporting for fan7..12 2021-07-14 16:56:08 +02:00
hwspinlock
hwtracing intel_th: Wait until port is in reset before programming it 2021-07-20 16:05:46 +02:00
i2c i2c: core: Disable client irq on reboot/shutdown 2021-07-20 16:05:46 +02:00
i3c Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" 2021-05-14 09:50:05 +02:00
ide ide/falconide: Fix module unload 2021-03-04 11:38:21 +01:00
idle
iio iio: magn: bmc150: Balance runtime pm + use pm_runtime_resume_and_get() 2021-07-20 16:05:39 +02:00
infiniband RDMA/cma: Fix rdma_resolve_route() memory leak 2021-07-19 09:44:53 +02:00
input Input: hideep - fix the uninitialized use in hideep_nvm_unlock() 2021-07-20 16:05:44 +02:00
interconnect interconnect: qcom: Add missing MODULE_DEVICE_TABLE 2021-06-03 09:00:46 +02:00
iommu iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation 2021-07-20 16:05:43 +02:00
ipack ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe 2021-07-19 09:45:01 +02:00
irqchip irqchip/gic-v3: Workaround inconsistent PMR setting on NMI entry 2021-06-23 14:42:49 +02:00
isdn mISDN: fix possible use-after-free in HFC_cleanup() 2021-07-19 09:44:38 +02:00
leds leds: turris-omnia: add missing MODULE_DEVICE_TABLE 2021-07-20 16:05:45 +02:00
lightnvm
macintosh macintosh/adb-iop: Use big-endian autopoll mask 2021-03-04 11:37:42 +01:00
mailbox mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion 2021-07-14 16:56:53 +02:00
mcb
md dm writecache: write at least 4k when committing 2021-07-19 09:45:02 +02:00
media media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K 2021-07-19 09:45:02 +02:00
memory memory: tegra: Fix compilation warnings on 64bit platforms 2021-07-25 14:36:14 +02:00
memstick memstick: rtsx_usb_ms: fix UAF 2021-07-14 16:55:53 +02:00
message
mfd mfd: cpcap: Fix cpcap dmamask not set warnings 2021-07-20 16:05:42 +02:00
misc misc: alcor_pci: fix inverted branch condition 2021-07-20 16:05:50 +02:00
mmc mmc: core: Allow UHS-I voltage switch for SDSC cards if supported 2021-07-19 09:44:59 +02:00
most
mtd mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume() 2021-07-14 16:56:47 +02:00
mux
net bonding: fix null dereference in bond_ipsec_add_sa() 2021-07-28 14:35:33 +02:00
nfc nfc: pn533: prevent potential memory corruption 2021-05-14 09:50:32 +02:00
ntb
nubus
nvdimm libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC 2021-04-21 13:00:55 +02:00
nvme nvme-tcp: can't set sk_user_data without write_lock 2021-07-20 16:05:53 +02:00
nvmem nvmem: core: add a missing of_node_put 2021-07-19 09:45:00 +02:00
of of: Fix truncation of memory sizes on 32-bit platforms 2021-07-14 16:56:46 +02:00
opp opp: Correct debug message in _opp_add_static_v2() 2021-03-04 11:37:27 +01:00
oprofile
parisc
parport
pci PCI: tegra194: Fix tegra_pcie_ep_raise_msi_irq() ill-defined shift 2021-07-20 16:05:52 +02:00
pcmcia
perf perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number 2021-07-14 16:56:08 +02:00
phy phy: intel: Fix for warnings due to EMMC clock 175Mhz change in FIP 2021-07-20 16:05:46 +02:00
pinctrl pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq() 2021-07-19 09:45:02 +02:00
platform platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard() 2021-07-14 16:56:00 +02:00
pnp
power power: supply: rt5033_battery: Fix device tree enumeration 2021-07-20 16:05:50 +02:00
powercap
pps
ps3
ptp ptp: improve max_adj check against unreasonable values 2021-06-23 14:42:45 +02:00
pwm pwm: imx1: Don't disable clocks at device remove time 2021-07-20 16:05:52 +02:00
rapidio rapidio: handle create_workqueue() failure 2021-05-26 12:06:52 +02:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-14 08:42:12 +02:00
regulator regulator: hi655x: Fix pass wrong pointer to config.driver_data 2021-07-14 16:56:09 +02:00
remoteproc remoteproc: k3-r5: Fix an error message 2021-07-20 16:05:50 +02:00
reset reset: ti-syscon: fix to_ti_syscon_reset_data macro 2021-07-25 14:36:11 +02:00
rpmsg rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() 2021-05-19 10:13:02 +02:00
rtc rtc: max77686: Do not enforce (incorrect) interrupt trigger type 2021-07-25 14:36:16 +02:00
s390 s390/sclp_vt220: fix console name to match device 2021-07-20 16:05:42 +02:00
sbus
scsi scsi: qedf: Add check to synchronize abort and flush 2021-07-25 14:36:16 +02:00
sfi
sh
siox
slimbus
soc soc/tegra: fuse: Fix Tegra234-only builds 2021-07-25 14:36:15 +02:00
soundwire soundwire: stream: Fix test for DP prepare complete 2021-07-14 16:56:47 +02:00
spi spi: spi-sun6i: Fix chipselect/clock bug 2021-07-14 16:56:10 +02:00
spmi spmi: spmi-pmic-arb: Fix hw_irq overflow 2021-03-04 11:38:40 +01:00
ssb ssb: Fix error return code in ssb_bus_scan() 2021-07-14 16:56:21 +02:00
staging staging: rtl8723bs: fix macro value for 2.4Ghz only device 2021-07-20 16:05:45 +02:00
target scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd() 2021-07-14 16:56:53 +02:00
tc
tee optee: use export_uuid() to copy client UUID 2021-06-10 13:39:21 +02:00
thermal thermal/core/thermal_of: Stop zone device before unregistering it 2021-07-25 14:36:17 +02:00
thunderbolt thunderbolt: Bond lanes only when dual_link_port != NULL in alloc_dev_default() 2021-07-14 16:56:44 +02:00
tty serial: tty: uartlite: fix console setup 2021-07-20 16:05:42 +02:00
uio uio_hv_generic: Fix a memory leak in error handling paths 2021-05-26 12:06:52 +02:00
usb usb: cdns3: Enable TDL_CHK only for OUT ep 2021-07-25 14:36:18 +02:00
vdpa vdpa/mlx5: Clear vq ready indication upon device reset 2021-07-20 16:05:53 +02:00
vfio vfio/pci: Handle concurrent vma faults 2021-07-14 16:56:50 +02:00
vhost vhost-vdpa: fix vm_flags for virtqueue doorbell mapping 2021-05-11 14:47:12 +02:00
video backlight: lm3630a: Fix return code of .update_status() callback 2021-07-20 16:05:45 +02:00
virt nitro_enclaves: Fix stale file descriptors on failed usercopy 2021-05-11 14:47:11 +02:00
virtio
visorbus visorbus: fix error return code in visorchipset_init() 2021-07-14 16:56:41 +02:00
vlynq
vme
w1 w1: ds2438: fixing bug that would always get page0 2021-07-20 16:05:39 +02:00
watchdog watchdog: jz4740: Fix return value check in jz4740_wdt_probe() 2021-07-20 16:05:51 +02:00
xen xen/events: reset active flag for lateeoi events later 2021-07-11 12:53:31 +02:00
zorro
Kconfig
Makefile