github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-18 03:27:14 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
fdfbaec592
linux/drivers
History
Vasiliy Kovalev 136cfaca22 gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() 
The gtp_net_ops pernet operations structure for the subsystem must be
registered before registering the generic netlink family.

Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug:

general protection fault, probably for non-canonical address
0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014
RIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]
Code: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86
      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>
      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74
RSP: 0018:ffff888014107220 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000
FS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
 <TASK>
 ? show_regs+0x90/0xa0
 ? die_addr+0x50/0xd0
 ? exc_general_protection+0x148/0x220
 ? asm_exc_general_protection+0x22/0x30
 ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]
 ? __alloc_skb+0x1dd/0x350
 ? __pfx___alloc_skb+0x10/0x10
 genl_dumpit+0x11d/0x230
 netlink_dump+0x5b9/0xce0
 ? lockdep_hardirqs_on_prepare+0x253/0x430
 ? __pfx_netlink_dump+0x10/0x10
 ? kasan_save_track+0x10/0x40
 ? __kasan_kmalloc+0x9b/0xa0
 ? genl_start+0x675/0x970
 __netlink_dump_start+0x6fc/0x9f0
 genl_family_rcv_msg_dumpit+0x1bb/0x2d0
 ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10
 ? genl_op_from_small+0x2a/0x440
 ? cap_capable+0x1d0/0x240
 ? __pfx_genl_start+0x10/0x10
 ? __pfx_genl_dumpit+0x10/0x10
 ? __pfx_genl_done+0x10/0x10
 ? security_capable+0x9d/0xe0

Cc: stable@vger.kernel.org
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Fixes: 459aa660eb ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Link: https://lore.kernel.org/r/20240214162733.34214-1-kovalev@altlinux.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-02-21 14:15:22 -08:00
..
accel accel/ivpu: Add job status for jobs aborted by the driver 2024-02-06 13:37:34 +01:00
accessibility
acpi cxl/cper: Fix errant CPER prints for CXL events 2024-02-03 18:31:17 +01:00
amba
android binder: signal epoll threads of self-work 2024-01-31 14:08:28 -08:00
ata ahci: Extend ASM1061 43-bit DMA address quirk to other ASM106x parts 2024-01-31 12:09:34 +01:00
atm atm: idt77252: fix a memleak in open_card_ubr0 2024-02-03 12:46:13 +00:00
auxdisplay drm-next for 6.8: 2024-01-12 11:32:19 -08:00
base regmap: kunit: Ensure that changed bytes are actually different 2024-02-12 13:55:51 +00:00
bcma
block block-6.8-2024-02-10 2024-02-10 08:02:48 -08:00
bluetooth USB / Thunderbolt changes for 6.8-rc1 2024-01-18 11:43:55 -08:00
bus Char/Misc and other Driver changes for 6.8-rc1 2024-01-17 16:47:17 -08:00
cache
cdrom
cdx cdx: Unlock on error path in rescan_store() 2024-01-04 17:01:14 +01:00
char TTY/Serial changes for 6.8-rc1 2024-01-18 11:37:24 -08:00
clk clk: qcom: gcc-x1e80100: Replace of_device.h with explicit includes 2024-01-19 08:17:28 -06:00
clocksource clocksource/drivers/ep93xx: Fix error handling during probe 2023-12-27 15:37:11 +01:00
comedi
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-13 11:15:44 +01:00
counter
cpufreq cpufreq/amd-pstate: Fix setting scaling max/min freq values 2024-01-22 20:35:58 +01:00
cpuidle cpuidle: haltpoll: Do not enable interrupts when entering idle 2023-12-29 18:08:18 +01:00
crypto crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked 2024-02-02 18:08:12 +08:00
cxl EFI fixes for v6.8 #1 2024-02-09 10:40:50 -08:00
dax New code for 6.8: 2024-01-10 08:45:22 -08:00
dca
devfreq
dio
dma dmaengine: at_hdmac: add missing kernel-doc style description 2024-02-02 17:16:55 +01:00
dma-buf dma-buf: heaps: Don't track CMA dma-buf pages under RssFile 2024-01-31 19:54:58 +05:30
dpll dpll: fix possible deadlock during netlink dump operation 2024-02-08 18:29:21 -08:00
edac Driver core changes for 6.8-rc1 2024-01-18 09:48:40 -08:00
eisa
extcon
firewire firewire: core: send bus reset promptly on gap count error 2024-02-07 08:20:02 +09:00
firmware EFI fixes for v6.8 #1 2024-02-09 10:40:50 -08:00
fpga Char/Misc and other Driver changes for 6.8-rc1 2024-01-17 16:47:17 -08:00
fsi
gnss TTY/Serial changes for 6.8-rc1 2024-01-18 11:37:24 -08:00
gpio gpio: remove GPIO device from the list unconditionally in error path 2024-02-08 10:33:03 +01:00
gpu Merge tag 'drm-msm-fixes-2024-02-07' of https://gitlab.freedesktop.org/drm/msm into drm-fixes 2024-02-09 11:32:38 +10:00
greybus TTY/Serial changes for 6.8-rc1 2024-01-18 11:37:24 -08:00
hid HID: wacom: generic: Avoid reporting a serial of '0' to userspace 2024-02-13 11:40:23 +01:00
hsi
hte
hv
hwmon hwmon: (coretemp) Enlarge per package core count limit 2024-02-04 06:43:45 -08:00
hwspinlock
hwtracing
i2c This cycle, I2C removes the currently unused CLASS_DDC support 2024-01-18 17:29:01 -08:00
i3c i3c: master: cdns: Update maximum prescaler value for i2c clock 2024-01-08 00:51:36 +01:00
idle Power management updates for 6.8-rc1 2024-01-09 16:32:11 -08:00
iio TTY/Serial changes for 6.8-rc1 2024-01-18 11:37:24 -08:00
infiniband RDMA v6.8 merge window 2024-01-12 13:52:21 -08:00
input Input updates for v6.8-rc2 2024-02-02 12:52:44 -08:00
interconnect Char/Misc and other Driver changes for 6.8-rc1 2024-01-17 16:47:17 -08:00
iommu iommu: Allow ops->default_domain to work when !CONFIG_IOMMU_DMA 2024-02-01 13:16:17 +01:00
ipack TTY/Serial changes for 6.8-rc1 2024-01-18 11:37:24 -08:00
irqchip header cleanups for 6.8 2024-01-10 16:43:55 -08:00
isdn
leds - New Drivers 2024-01-17 15:25:27 -08:00
macintosh
mailbox mediatek: add CMDQ support for mt8188 2024-01-17 15:39:32 -08:00
mcb
md dm-crypt, dm-verity: disable tasklets 2024-02-02 12:33:50 -05:00
media media: vb2: refactor setting flags and caps, fix missing cap 2024-01-24 17:27:51 +01:00
memory IOMMU Updates for Linux v6.8 2024-01-18 15:16:57 -08:00
memstick
message
mfd TTY/Serial changes for 6.8-rc1 2024-01-18 11:37:24 -08:00
misc misc: open-dice: Fix spurious lockdep warning 2024-01-30 16:20:54 -08:00
mmc mmc: slot-gpio: Allow non-sleeping GPIO ro 2024-02-06 12:35:44 +01:00
most
mtd This pull request contains updates for UBI and UBIFS: 2024-01-17 10:27:13 -08:00
mux mux: mmio: use reg property when parent device is not a syscon 2024-01-04 17:01:14 +01:00
net gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() 2024-02-21 14:15:22 -08:00
nfc
ntb
nubus nubus: Make nubus_bus_type static and constant 2024-01-03 13:33:59 +01:00
nvdimm virtio: features, fixes 2024-01-18 16:44:03 -08:00
nvme nvme: use ns->head->pi_size instead of t10_pi_tuple structure size 2024-02-07 15:49:36 -08:00
nvmem Char/Misc and other Driver changes for 6.8-rc1 2024-01-17 16:47:17 -08:00
of Devicetree fixes for v6.8: 2024-02-15 10:19:55 -08:00
opp OPP: Rename 'rate_clk_single' 2024-01-05 15:55:41 +05:30
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-07 22:59:16 +01:00
parport
pci pci-v6.8-fixes-2 2024-02-09 10:37:59 -08:00
pcmcia
peci
perf ACPI updates for 6.8-rc1 2024-01-09 16:12:44 -08:00
phy phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP 2024-01-30 22:41:11 +05:30
pinctrl pinctrl: amd: Add IRQF_ONESHOT to the interrupt request 2024-01-31 10:06:07 +01:00
platform platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet 2024-01-26 20:21:47 +01:00
pmdomain pmdomain: mediatek: fix race conditions with genpd 2024-01-23 13:19:15 +01:00
pnp More ACPI updates for 6.8-rc1 2024-01-17 14:37:40 -08:00
power Revert "power: supply: qcom_battmgr: Register the power supplies after PDR is up" 2024-01-26 22:45:58 +01:00
powercap
pps
ps3
ptp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-01-04 18:06:46 -08:00
pwm pwm: jz4740: Don't use dev_err_probe() in .request() 2024-01-12 18:25:05 +01:00
rapidio rapidio/tsi721: fix kernel-doc warnings 2023-12-20 15:02:57 -08:00
ras
regulator regulator (max5970): Fix IRQ handler 2024-01-30 15:27:16 +00:00
remoteproc
reset SoC: driver updates for 6.8 2024-01-11 11:31:46 -08:00
rpmsg
rtc rtc: nuvoton: Compatible with NCT3015Y-R and NCT3018Y-R 2024-01-18 01:05:33 +01:00
s390 s390/qeth: Fix potential loss of L3-IP@ in case of network issues 2024-02-08 12:10:09 +01:00
sbus
scsi scsi: lpfc: Use unsigned type for num_sge 2024-02-05 16:19:11 -05:00
sh maple: make maple_bus_type static and const 2024-01-04 14:37:17 +01:00
siox
slimbus
soc soc: apple: mailbox: error pointers are negative integers 2024-01-30 11:34:49 -08:00
soundwire soundwire updates for 6.7 2024-01-18 17:08:31 -08:00
spi spi-mxs: Fix chipselect glitch 2024-02-13 15:48:22 +00:00
spmi
ssb
staging This cycle, I2C removes the currently unused CLASS_DDC support 2024-01-18 17:29:01 -08:00
target SCSI misc on 20240120 2024-01-20 09:42:32 -08:00
tc
tee Another moderately busy cycle for documentation, including: 2024-01-11 19:46:52 -08:00
thermal thermal: intel: powerclamp: Remove dead code for target mwait value 2024-01-22 11:59:22 +01:00
thunderbolt USB / Thunderbolt changes for 6.8-rc1 2024-01-18 11:43:55 -08:00
tty serial: max310x: prevent infinite while() loop in port startup 2024-01-27 19:09:10 -08:00
ufs scsi: ufs: core: Remove the ufshcd_release() in ufshcd_err_handling_prepare() 2024-02-05 16:31:18 -05:00
uio uio: Fix use-after-free in uio_open 2024-01-04 17:03:47 +01:00
usb USB-serial device ids for 6.8-rc3 2024-02-02 08:36:38 -08:00
vdpa virtio: features, fixes 2024-01-18 16:44:03 -08:00
vfio VFIO updates for v6.8-rc1 2024-01-18 15:57:25 -08:00
vhost virtio: features, fixes 2024-01-18 16:44:03 -08:00
video fbdev: stifb: Fix crash in stifb_blank() 2024-01-23 09:13:24 +01:00
virt Char/Misc and other Driver changes for 6.8-rc1 2024-01-17 16:47:17 -08:00
virtio virtio: features, fixes 2024-01-18 16:44:03 -08:00
w1
watchdog linux-watchdog 6.8-rc1 tag 2024-01-12 13:32:30 -08:00
xen xen/events: close evtchn after mapping cleanup 2024-02-13 10:12:47 +01:00
zorro
Kconfig
Makefile fbdev/intelfb: Remove driver 2024-01-12 12:38:37 +01:00