linux/net/core
Feng Sun 6a2bd82616 net: fix skb use after free in netpoll
[ Upstream commit 2c1644cf6d ]

After commit baeababb5b
("tun: return NET_XMIT_DROP for dropped packets"),
when tun_net_xmit drop packets, it will free skb and return NET_XMIT_DROP,
netpoll_send_skb_on_dev will run into following use after free cases:
1. retry netpoll_start_xmit with freed skb;
2. queue freed skb in npinfo->txq.
queue_process will also run into use after free case.

hit netpoll_send_skb_on_dev first case with following kernel log:

[  117.864773] kernel BUG at mm/slub.c:306!
[  117.864773] invalid opcode: 0000 [#1] SMP PTI
[  117.864774] CPU: 3 PID: 2627 Comm: loop_printmsg Kdump: loaded Tainted: P           OE     5.3.0-050300rc5-generic #201908182231
[  117.864775] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[  117.864775] RIP: 0010:kmem_cache_free+0x28d/0x2b0
[  117.864781] Call Trace:
[  117.864781]  ? tun_net_xmit+0x21c/0x460
[  117.864781]  kfree_skbmem+0x4e/0x60
[  117.864782]  kfree_skb+0x3a/0xa0
[  117.864782]  tun_net_xmit+0x21c/0x460
[  117.864782]  netpoll_start_xmit+0x11d/0x1b0
[  117.864788]  netpoll_send_skb_on_dev+0x1b8/0x200
[  117.864789]  __br_forward+0x1b9/0x1e0 [bridge]
[  117.864789]  ? skb_clone+0x53/0xd0
[  117.864790]  ? __skb_clone+0x2e/0x120
[  117.864790]  deliver_clone+0x37/0x50 [bridge]
[  117.864790]  maybe_deliver+0x89/0xc0 [bridge]
[  117.864791]  br_flood+0x6c/0x130 [bridge]
[  117.864791]  br_dev_xmit+0x315/0x3c0 [bridge]
[  117.864792]  netpoll_start_xmit+0x11d/0x1b0
[  117.864792]  netpoll_send_skb_on_dev+0x1b8/0x200
[  117.864792]  netpoll_send_udp+0x2c6/0x3e8
[  117.864793]  write_msg+0xd9/0xf0 [netconsole]
[  117.864793]  console_unlock+0x386/0x4e0
[  117.864793]  vprintk_emit+0x17e/0x280
[  117.864794]  vprintk_default+0x29/0x50
[  117.864794]  vprintk_func+0x4c/0xbc
[  117.864794]  printk+0x58/0x6f
[  117.864795]  loop_fun+0x24/0x41 [printmsg_loop]
[  117.864795]  kthread+0x104/0x140
[  117.864795]  ? 0xffffffffc05b1000
[  117.864796]  ? kthread_park+0x80/0x80
[  117.864796]  ret_from_fork+0x35/0x40

Signed-off-by: Feng Sun <loyou85@gmail.com>
Signed-off-by: Xiaojun Zhao <xiaojunzhao141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-09-10 10:33:38 +01:00
..
datagram.c net: datagram: fix unbounded loop in __skb_try_recv_datagram() 2019-04-03 06:26:16 +02:00
dev_addr_lists.c net: change the comment of dev_mc_init 2018-04-19 12:58:20 -04:00
dev_ioctl.c net: remove redundant input checks in SIOCSIFTXQLEN case of dev_ifsioc 2018-07-24 11:36:15 -07:00
dev.c net: fix ifindex collision during namespace removal 2019-08-09 17:52:31 +02:00
devlink.c devlink: Add helper function for safely copy string param 2018-10-10 10:19:10 -07:00
drop_monitor.c
dst_cache.c net: core: dst_cache_set_ip6: Rename 'addr' parameter to 'saddr' for consistency 2018-03-05 12:52:45 -05:00
dst.c netfilter: nf_tables: add tunnel support 2018-08-03 21:12:12 +02:00
ethtool.c ethtool: check the return value of get_regs_len 2019-06-11 12:20:57 +02:00
failover.c failover: allow name change on IFF_UP slave interfaces 2019-04-27 09:36:30 +02:00
fib_notifier.c net: Fix fib notifer to return errno 2018-03-29 14:10:30 -04:00
fib_rules.c Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied" 2019-06-11 12:20:50 +02:00
filter.c tcp: fix tcp_set_congestion_control() use from bpf hook 2019-07-28 08:29:26 +02:00
flow_dissector.c flow_dissector: do not dissect l4 ports for fragments 2018-11-23 08:17:02 +01:00
gen_estimator.c net: core: protect rate estimator statistics pointer with lock 2018-08-11 12:37:10 -07:00
gen_stats.c net: sched: put back q.qlen into a single location 2019-03-10 07:17:16 +01:00
gro_cells.c gro_cells: make sure device is up in gro_cells_receive() 2019-03-19 13:12:38 +01:00
hwbm.c
link_watch.c
lwt_bpf.c bpf: in __bpf_redirect_no_mac pull mac only if present 2019-01-22 21:40:35 +01:00
lwtunnel.c
Makefile net: Introduce generic failover module 2018-05-28 22:59:54 -04:00
neighbour.c net: neigh: fix multiple neigh timer scheduling 2019-07-28 08:29:24 +02:00
net_namespace.c netns: provide pure entropy for net_hash_mix() 2019-04-17 08:38:40 +02:00
net-procfs.c proc: introduce proc_create_net{,_data} 2018-05-16 07:24:30 +02:00
net-sysfs.c net-sysfs: call dev_hold if kobject_init_and_add success 2019-04-03 06:26:17 +02:00
net-sysfs.h
net-traces.c net/ipv6: Udate fib6_table_lookup tracepoint 2018-05-24 23:01:15 -04:00
netclassid_cgroup.c cgroup, netclassid: add a preemption point to write_classid 2018-11-13 11:08:31 -08:00
netevent.c
netpoll.c net: fix skb use after free in netpoll 2019-09-10 10:33:38 +01:00
netprio_cgroup.c
page_pool.c net/page_pool: Fix inconsistent lock state warning 2018-07-19 23:23:01 -07:00
pktgen.c pktgen: do not sleep with the thread lock held. 2019-06-11 12:20:49 +02:00
ptp_classifier.c
request_sock.c
rtnetlink.c rtnetlink: always put IFLA_LINK for links with a link-netnsid 2019-05-25 18:23:21 +02:00
scm.c
secure_seq.c infiniband: i40iw, nes: don't use wall time for TCP sequence numbers 2018-07-11 12:10:19 -06:00
skbuff.c bpf: sockmap, fix use after free from sleep in psock backlog workqueue 2019-07-14 08:11:05 +02:00
sock_diag.c net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() 2018-08-14 10:01:24 -07:00
sock_reuseport.c bpf: Enable BPF_PROG_TYPE_SK_REUSEPORT bpf prog in reuseport selection 2018-08-11 01:58:46 +02:00
sock.c net: remove duplicate fetch in sock_getsockopt 2019-07-03 13:14:47 +02:00
stream.c tcp: make sure EPOLLOUT wont be missed 2019-09-06 10:22:07 +02:00
sysctl_net_core.c bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K 2019-07-10 09:53:47 +02:00
timestamping.c
tso.c
utils.c net: Remove some unneeded semicolon 2018-08-04 13:05:39 -07:00
xdp.c net/xdp: Fix suspicious RCU usage warning 2018-08-16 21:55:21 +02:00