Pavel Tikhomirov cdcf3829f4 net: sched: sch_teql: fix null-pointer dereference ... commit 1ffbc7ea91 upstream. Reproduce: modprobe sch_teql tc qdisc add dev teql0 root teql0 This leads to (for instance in Centos 7 VM) OOPS: [ 532.366633] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 [ 532.366733] IP: [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.366825] PGD 80000001376d5067 PUD 137e37067 PMD 0 [ 532.366906] Oops: 0000 [#1] SMP [ 532.366987] Modules linked in: sch_teql ... [ 532.367945] CPU: 1 PID: 3026 Comm: tc Kdump: loaded Tainted: G ------------ T 3.10.0-1062.7.1.el7.x86_64 #1 [ 532.368041] Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.2 04/01/2014 [ 532.368125] task: ffff8b7d37d31070 ti: ffff8b7c9fdbc000 task.ti: ffff8b7c9fdbc000 [ 532.368224] RIP: 0010:[<ffffffffc06124a8>] [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.368320] RSP: 0018:ffff8b7c9fdbf8e0 EFLAGS: 00010286 [ 532.368394] RAX: ffffffffc0612490 RBX: ffff8b7cb1565e00 RCX: ffff8b7d35ba2000 [ 532.368476] RDX: ffff8b7d35ba2000 RSI: 0000000000000000 RDI: ffff8b7cb1565e00 [ 532.368557] RBP: ffff8b7c9fdbf8f8 R08: ffff8b7d3fd1f140 R09: ffff8b7d3b001600 [ 532.368638] R10: ffff8b7d3b001600 R11: ffffffff84c7d65b R12: 00000000ffffffd8 [ 532.368719] R13: 0000000000008000 R14: ffff8b7d35ba2000 R15: ffff8b7c9fdbf9a8 [ 532.368800] FS: 00007f6a4e872740(0000) GS:ffff8b7d3fd00000(0000) knlGS:0000000000000000 [ 532.368885] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 532.368961] CR2: 00000000000000a8 CR3: 00000001396ee000 CR4: 00000000000206e0 [ 532.369046] Call Trace: [ 532.369159] [<ffffffff84c8192e>] qdisc_create+0x36e/0x450 [ 532.369268] [<ffffffff846a9b49>] ? ns_capable+0x29/0x50 [ 532.369366] [<ffffffff849afde2>] ? nla_parse+0x32/0x120 [ 532.369442] [<ffffffff84c81b4c>] tc_modify_qdisc+0x13c/0x610 [ 532.371508] [<ffffffff84c693e7>] rtnetlink_rcv_msg+0xa7/0x260 [ 532.372668] [<ffffffff84907b65>] ? sock_has_perm+0x75/0x90 [ 532.373790] [<ffffffff84c69340>] ? rtnl_newlink+0x890/0x890 [ 532.374914] [<ffffffff84c8da7b>] netlink_rcv_skb+0xab/0xc0 [ 532.376055] [<ffffffff84c63708>] rtnetlink_rcv+0x28/0x30 [ 532.377204] [<ffffffff84c8d400>] netlink_unicast+0x170/0x210 [ 532.378333] [<ffffffff84c8d7a8>] netlink_sendmsg+0x308/0x420 [ 532.379465] [<ffffffff84c2f3a6>] sock_sendmsg+0xb6/0xf0 [ 532.380710] [<ffffffffc034a56e>] ? __xfs_filemap_fault+0x8e/0x1d0 [xfs] [ 532.381868] [<ffffffffc034a75c>] ? xfs_filemap_fault+0x2c/0x30 [xfs] [ 532.383037] [<ffffffff847ec23a>] ? __do_fault.isra.61+0x8a/0x100 [ 532.384144] [<ffffffff84c30269>] ___sys_sendmsg+0x3e9/0x400 [ 532.385268] [<ffffffff847f3fad>] ? handle_mm_fault+0x39d/0x9b0 [ 532.386387] [<ffffffff84d88678>] ? __do_page_fault+0x238/0x500 [ 532.387472] [<ffffffff84c31921>] __sys_sendmsg+0x51/0x90 [ 532.388560] [<ffffffff84c31972>] SyS_sendmsg+0x12/0x20 [ 532.389636] [<ffffffff84d8dede>] system_call_fastpath+0x25/0x2a [ 532.390704] [<ffffffff84d8de21>] ? system_call_after_swapgs+0xae/0x146 [ 532.391753] Code: 00 00 00 00 00 00 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 53 48 8b b7 48 01 00 00 48 89 fb <48> 8b 8e a8 00 00 00 48 85 c9 74 43 48 89 ca eb 0f 0f 1f 80 00 [ 532.394036] RIP [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.395127] RSP <ffff8b7c9fdbf8e0> [ 532.396179] CR2: 00000000000000a8 Null pointer dereference happens on master->slaves dereference in teql_destroy() as master is null-pointer. When qdisc_create() calls teql_qdisc_init() it imediately fails after check "if (m->dev == dev)" because both devices are teql0, and it does not set qdisc_priv(sch)->m leaving it zero on error path, then qdisc_create() imediately calls teql_destroy() which does not expect zero master pointer and we get OOPS. Fixes: 87b60cfacf ("net_sched: fix error recovery at qdisc creation") Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-04-14 08:42:02 +02:00
..
6lowpan
9p	net: 9p: advance iov on empty read	2021-04-07 15:00:08 +02:00
802
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 14:16:55 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 15:00:08 +02:00
atm	net: atm: fix update of position index in lec_seq_next	2020-10-31 12:26:30 -07:00
ax25
batman-adv	batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field	2021-04-14 08:41:59 +02:00
bluetooth	Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data	2021-03-07 12:34:10 +01:00
bpf	bpf: Reject too big ctx_size_in for raw_tp test run	2021-01-27 11:55:07 +01:00
bpfilter	Revert "bpfilter: Fix build error with CONFIG_BPFILTER_UMH"	2020-10-15 12:33:24 -07:00
bridge	net: bridge: don't notify switchdev for local FDB addresses	2021-03-30 14:32:04 +02:00
caif
can	net: introduce CAN specific pointer in the struct net_device	2021-04-07 15:00:07 +02:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-10-12 15:29:27 +02:00
core	bpf, sockmap: Fix incorrect fwd_alloc accounting	2021-04-14 08:42:01 +02:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 16:04:01 +01:00
dccp	ipv6: weaken the v4mapped source check	2021-03-30 14:32:01 +02:00
decnet
dns_resolver
dsa	net: dsa: tag_mtk: fix 802.1ad VLAN egress	2021-03-17 17:06:22 +01:00
ethernet
ethtool	ethtool: fix incorrect datatype in set_eee ops	2021-04-14 08:41:58 +02:00
hsr	net: hsr: add support for EntryForgetTime	2021-03-07 12:34:07 +01:00
ieee802154	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
ife
ipv4	Revert "netfilter: x_tables: Update remaining dereference to RCU"	2021-03-30 14:32:06 +02:00
ipv6	net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh	2021-04-14 08:41:57 +02:00
iucv	net/af_iucv: remove WARN_ONCE on malformed RX packets	2021-03-07 12:34:05 +01:00
kcm
key	af_key: relax availability checks for skb size calculation	2021-02-13 13:55:02 +01:00
l2tp	net: l2tp: reduce log level of messages in receive path, add counter instead	2021-03-17 17:06:11 +01:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:29:14 +01:00
llc
mac80211	mac80211: choose first enabled channel for monitor	2021-04-10 13:36:08 +02:00
mac802154
mpls	net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0	2021-03-17 17:06:11 +01:00
mptcp	ipv6: weaken the v4mapped source check	2021-03-30 14:32:01 +02:00
ncsi	net/ncsi: Use real net-device for response handler	2021-01-12 20:18:10 +01:00
netfilter	netfilter: nftables: skip hook overlap logic if flowtable is stale	2021-04-10 13:36:08 +02:00
netlabel	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-17 17:06:15 +01:00
netlink	netlink: export policy in extended ACK	2020-10-09 20:22:32 -07:00
netrom
nfc	nfc: Avoid endless loops caused by repeated llcp_sock_connect()	2021-04-14 08:41:57 +02:00
nsh
openvswitch	net: openvswitch: fix TTL decrement exception action execution	2021-02-23 15:53:23 +01:00
packet	net: fix proc_fs init handling in af_packet and tls	2021-02-23 15:53:23 +01:00
phonet
psample	net: psample: Fix netlink skb length with tunnel info	2021-03-07 12:34:07 +01:00
qrtr	net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()	2021-03-30 14:31:58 +02:00
rds	RDMA: Lift ibdev_to_node from rds to common code	2021-02-26 10:12:59 +01:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-12 09:18:06 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix clearance of Tx/Rx ring when releasing a call	2021-02-17 11:02:28 +01:00
sched	net: sched: sch_teql: fix null-pointer dereference	2021-04-14 08:42:02 +02:00
sctp	net: fix iteration for sctp transport seq_files	2021-02-17 11:02:29 +01:00
smc	net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid()	2020-11-19 10:59:19 -08:00
strparser
sunrpc	rpc: fix NULL dereference on kmalloc failure	2021-04-07 15:00:04 +02:00
switchdev	net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP	2021-02-07 15:37:12 +01:00
tipc	tipc: better validate user input in tipc_nl_retrieve_key()	2021-03-30 14:31:59 +02:00
tls	net: fix proc_fs init handling in af_packet and tls	2021-02-23 15:53:23 +01:00
unix	networking changes for the 5.10 merge window	2020-10-15 18:42:13 -07:00
vmw_vsock	selinux: vsock: Set SID for socket returned by accept()	2021-03-30 14:32:03 +02:00
wimax	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
wireless	wext: fix NULL-ptr-dereference with cfg80211's lack of commit()	2021-02-03 23:28:38 +01:00
x25	net/x25: prevent a couple of overflows	2020-12-02 17:26:36 -08:00
xdp	xsk: Clear pool even for inactive queues	2021-01-27 11:55:10 +01:00
xfrm	xfrm/compat: Cleanup WARN()s that can be user-triggered	2021-04-14 08:41:56 +02:00
compat.c	iov_iter: transparently handle compat iovecs in import_iovec	2020-10-03 00:02:13 -04:00
devres.c
Kconfig	drop_monitor: Convert to using devlink tracepoint	2020-09-30 18:01:26 -07:00
Makefile
socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-05 18:40:01 -07:00
sysctl_net.c