linux/drivers/net
Zefan Li 7e6932300a dlci: validate the net device in dlci_del()
commit 578a1310f2 upstream.

We triggered an oops while running trinity with 3.4 kernel:

BUG: unable to handle kernel paging request at 0000000100000d07
IP: [<ffffffffa0109738>] dlci_ioctl+0xd8/0x2d4 [dlci]
PGD 640c0d067 PUD 0
Oops: 0000 [#1] PREEMPT SMP
CPU 3
...
Pid: 7302, comm: trinity-child3 Not tainted 3.4.24.09+ 40 Huawei Technologies Co., Ltd. Tecal RH2285          /BC11BTSA
RIP: 0010:[<ffffffffa0109738>]  [<ffffffffa0109738>] dlci_ioctl+0xd8/0x2d4 [dlci]
...
Call Trace:
  [<ffffffff8137c5c3>] sock_ioctl+0x153/0x280
  [<ffffffff81195494>] do_vfs_ioctl+0xa4/0x5e0
  [<ffffffff8118354a>] ? fget_light+0x3ea/0x490
  [<ffffffff81195a1f>] sys_ioctl+0x4f/0x80
  [<ffffffff81478b69>] system_call_fastpath+0x16/0x1b
...

It's because the net device is not a dlci device.

Reported-by: Li Jinyue <lijinyue@huawei.com>
Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-07-03 10:59:04 -07:00
..
appletalk Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
arcnet arcnet: rimi: Fix device name in debug output 2012-04-17 22:22:43 -04:00
bonding bonding: rlb mode of bond should not alter ARP originating via bridge 2013-06-27 11:27:33 -07:00
caif caif: fix NULL pointer check 2012-08-09 08:31:50 -07:00
can can: sja1000: fix handling on dt properties on little endian systems 2013-04-25 21:19:54 -07:00
cris Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
dsa
ethernet 8139cp: reset BQL when ring tx ring cleared 2013-06-27 11:27:31 -07:00
fddi
hamradio Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
hippi Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
hyperv net/hyperv: Adding cancellation to ensure rndis filter is closed 2012-04-21 15:38:10 -04:00
irda irda: sir_dev: Fix copy/paste typo 2013-01-11 09:06:27 -08:00
phy icplus: fix interrupt for IC+ 101A/G and 1001LF 2012-04-19 15:34:18 -04:00
plip Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
ppp pppoe: drop PPPOX_ZOMBIEs in pppoe_release 2012-10-13 05:38:44 +09:00
slip Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
team team: check return value of team_get_port_by_index_rcu() for NULL 2013-06-27 11:27:32 -07:00
tokenring Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
usb net: qmi_wwan: prevent duplicate mac address on link (firmware bug workaround) 2013-05-19 10:54:43 -07:00
vmxnet3 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-03-05 21:16:26 -05:00
wan dlci: validate the net device in dlci_del() 2013-07-03 10:59:04 -07:00
wimax i2400m: add Intel 6150 device IDs 2013-01-17 08:50:46 -08:00
wireless ath9k: Use minstrel rate control by default 2013-06-20 11:58:44 -07:00
xen-netback xen-netback: remove skb in xen_netbk_alloc_page 2013-06-07 12:49:35 -07:00
dummy.c dummy: fix rcu_sched self-detected stalls 2012-07-16 09:03:47 -07:00
eql.c eql: dont rely on HZ=100 2012-03-27 22:45:26 -04:00
ifb.c
Kconfig
LICENSE.SRC
loopback.c net: loopback: fix a dst refcounting issue 2013-02-14 10:49:04 -08:00
macvlan.c macvlan: fix passthru mode race between dev removal and rx path 2013-05-19 10:54:47 -07:00
macvtap.c macvtap: zerocopy: set SKBTX_DEV_ZEROCOPY only when skb is built successfully 2012-10-02 10:30:34 -07:00
Makefile
mdio.c
mii.c
netconsole.c netconsole: don't call __netpoll_cleanup() while atomic 2013-03-28 12:11:52 -07:00
rionet.c rapidio/rionet: fix multicast packet transmit logic 2012-10-13 05:38:39 +09:00
sb1000.c
Space.c
sungem_phy.c
tun.c tun: add a missing nf_reset() in tun_net_xmit() 2013-03-20 13:05:01 -07:00
veth.c
virtio_net.c virtio_net: invoke softirqs after __napi_schedule 2012-05-17 12:16:38 +03:00
xen-netfront.c xen/netfront: teardown the device before unregistering it. 2012-07-16 09:03:49 -07:00