Eric Dumazet
a3afaa5033
sched: etf: do not assume all sockets are full blown
[ Upstream commit a1211bf9a7774706722ba3b18c6157d980319f79 ]
skb->sk does not always point to a full blown socket,
we need to use sk_fullsock() before accessing fields which
only make sense on full socket.
BUG: KASAN: use-after-free in report_sock_error+0x286/0x300 net/sched/sch_etf.c:141
Read of size 1 at addr ffff88805eb9b245 by task syz-executor.5/9630
CPU: 1 PID: 9630 Comm: syz-executor.5 Not tainted 5.7.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382
__kasan_report.cold+0x35/0x4d mm/kasan/report.c:511
kasan_report+0x33/0x50 mm/kasan/common.c:625
report_sock_error+0x286/0x300 net/sched/sch_etf.c:141
etf_enqueue_timesortedlist+0x389/0x740 net/sched/sch_etf.c:170
__dev_xmit_skb net/core/dev.c:3710 [inline]
__dev_queue_xmit+0x154a/0x30a0 net/core/dev.c:4021
neigh_hh_output include/net/neighbour.h:499 [inline]
neigh_output include/net/neighbour.h:508 [inline]
ip6_finish_output2+0xfb5/0x25b0 net/ipv6/ip6_output.c:117
__ip6_finish_output+0x442/0xab0 net/ipv6/ip6_output.c:143
ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:153
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip6_output+0x239/0x810 net/ipv6/ip6_output.c:176
dst_output include/net/dst.h:435 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip6_xmit+0xe1a/0x2090 net/ipv6/ip6_output.c:280
tcp_v6_send_synack+0x4e7/0x960 net/ipv6/tcp_ipv6.c:521
tcp_rtx_synack+0x10d/0x1a0 net/ipv4/tcp_output.c:3916
inet_rtx_syn_ack net/ipv4/inet_connection_sock.c:669 [inline]
reqsk_timer_handler+0x4c2/0xb40 net/ipv4/inet_connection_sock.c:763
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1405
expire_timers kernel/time/timer.c:1450 [inline]
__run_timers kernel/time/timer.c:1774 [inline]
__run_timers kernel/time/timer.c:1741 [inline]
run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1787
__do_softirq+0x26c/0x9f7 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x192/0x1d0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:546 [inline]
smp_apic_timer_interrupt+0x19e/0x600 arch/x86/kernel/apic/apic.c:1140
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
</IRQ>
RIP: 0010:des_encrypt+0x157/0x9c0 lib/crypto/des.c:792
Code: 85 22 06 00 00 41 31 dc 41 8b 4d 04 44 89 e2 41 83 e4 3f 4a 8d 3c a5 60 72 72 88 81 e2 3f 3f 3f 3f 48 89 f8 48 c1 e8 03 31 d9 <0f> b6 34 28 48 89 f8 c1 c9 04 83 e0 07 83 c0 03 40 38 f0 7c 09 40
RSP: 0018:ffffc90003b5f6c0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e4e55 RBX: 00000000d2f846d0 RCX: 00000000d2f846d0
RDX: 0000000012380612 RSI: ffffffff839863ca RDI: ffffffff887272a8
RBP: dffffc0000000000 R08: ffff888091d0a380 R09: 0000000000800081
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000012
R13: ffff8880a8ae8078 R14: 00000000c545c93e R15: 0000000000000006
cipher_crypt_one crypto/cipher.c:75 [inline]
crypto_cipher_encrypt_one+0x124/0x210 crypto/cipher.c:82
crypto_cbcmac_digest_update+0x1b5/0x250 crypto/ccm.c:830
crypto_shash_update+0xc4/0x120 crypto/shash.c:119
shash_ahash_update+0xa3/0x110 crypto/shash.c:246
crypto_ahash_update include/crypto/hash.h:547 [inline]
hash_sendmsg+0x518/0xad0 crypto/algif_hash.c:102
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:672
____sys_sendmsg+0x308/0x7e0 net/socket.c:2362
___sys_sendmsg+0x100/0x170 net/socket.c:2416
__sys_sendmmsg+0x195/0x480 net/socket.c:2506
__do_sys_sendmmsg net/socket.c:2535 [inline]
__se_sys_sendmmsg net/socket.c:2532 [inline]
__x64_sys_sendmmsg+0x99/0x100 net/socket.c:2532
do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x45c829
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f6d9528ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000004fc080 RCX: 000000000045c829
RDX: 0000000000000001 RSI: 0000000020002640 RDI: 0000000000000004
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000008d7 R14: 00000000004cb7aa R15: 00007f6d9528f6d4
Fixes: 4b15c70753 ("net/sched: Make etf report drops on error_queue")
Fixes: 25db26a913 ("net/sched: Introduce the ETF Qdisc")
Signed-off-by: Eric Dumazet <[email protected]>
Reported-by: syzbot <[email protected]>
Cc: Vinicius Costa Gomes <[email protected]>
Reviewed-by: Vinicius Costa Gomes <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
2020-04-29 16:33:09 +02:00 |
| .. |
|
act_api.c
|
net: avoid potential infinite loop in tc_ctl_action()
|
2019-10-15 20:20:22 -07:00 |
|
act_bpf.c
|
net_sched: fix a NULL pointer deref in ipt action
|
2019-08-27 15:05:58 -07:00 |
|
act_connmark.c
|
net_sched: fix a NULL pointer deref in ipt action
|
2019-08-27 15:05:58 -07:00 |
|
act_csum.c
|
net_sched: fix a NULL pointer deref in ipt action
|
2019-08-27 15:05:58 -07:00 |
|
act_ct.c
|
net/sched: act_ct: Fix leak of ct zone template on replace
|
2020-04-01 11:01:36 +02:00 |
|
act_ctinfo.c
|
net: sched: act_ctinfo: fix memory leak
|
2020-01-23 08:22:52 +01:00 |
|
act_gact.c
|
net_sched: fix a NULL pointer deref in ipt action
|
2019-08-27 15:05:58 -07:00 |
|
act_ife.c
|
net/sched: act_ife: initalize ife->metalist earlier
|
2020-01-23 08:22:50 +01:00 |
|
act_ipt.c
|
net_sched: fix a NULL pointer deref in ipt action
|
2019-08-27 15:05:58 -07:00 |
|
act_meta_mark.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
act_meta_skbprio.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
act_meta_skbtcindex.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
act_mirred.c
|
net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build
|
2020-04-01 11:02:18 +02:00 |
|
act_mpls.c
|
net: Fixed updating of ethertype in skb_mpls_push()
|
2019-12-18 16:08:56 +01:00 |
|
act_nat.c
|
net_sched: fix a NULL pointer deref in ipt action
|
2019-08-27 15:05:58 -07:00 |
|
act_pedit.c
|
net/sched: act_pedit: fix WARN() in the traffic path
|
2019-11-19 18:57:16 -08:00 |
|
act_police.c
|
net_sched: act_police: add 2 new attributes to support police 64bit rate and peakrate
|
2019-09-06 15:02:16 +02:00 |
|
act_sample.c
|
net/sched: act_sample: don't push mac header on ip6gre ingress
|
2019-09-20 17:01:59 -07:00 |
|
act_simple.c
|
net_sched: fix a NULL pointer deref in ipt action
|
2019-08-27 15:05:58 -07:00 |
|
act_skbedit.c
|
net_sched: fix a NULL pointer deref in ipt action
|
2019-08-27 15:05:58 -07:00 |
|
act_skbmod.c
|
net_sched: fix a NULL pointer deref in ipt action
|
2019-08-27 15:05:58 -07:00 |
|
act_tunnel_key.c
|
net: sched: ensure opts_len <= IP_TUNNEL_OPTS_MAX in act_tunnel_key
|
2019-11-18 17:17:07 -08:00 |
|
act_vlan.c
|
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
|
2019-09-02 11:20:17 -07:00 |
|
cls_api.c
|
net_sched: use validated TCA_KIND attribute in tc_new_tfilter()
|
2020-01-29 16:45:21 +01:00 |
|
cls_basic.c
|
net_sched: fix ops->bind_class() implementations
|
2020-02-01 09:34:38 +00:00 |
|
cls_bpf.c
|
net_sched: fix ops->bind_class() implementations
|
2020-02-01 09:34:38 +00:00 |
|
cls_cgroup.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
cls_flow.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
cls_flower.c
|
net: sched: correct flower port blocking
|
2020-03-05 16:43:32 +01:00 |
|
cls_fw.c
|
net_sched: fix ops->bind_class() implementations
|
2020-02-01 09:34:38 +00:00 |
|
cls_matchall.c
|
net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS
|
2020-02-24 08:36:22 +01:00 |
|
cls_route.c
|
net_sched: cls_route: remove the right filter from hashtable
|
2020-04-01 11:01:36 +02:00 |
|
cls_rsvp.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
cls_rsvp.h
|
cls_rsvp: fix rsvp_policy
|
2020-02-11 04:35:03 -08:00 |
|
cls_rsvp6.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
cls_tcindex.c
|
net_sched: fix a missing refcnt in tcindex_init()
|
2020-04-13 10:48:04 +02:00 |
|
cls_u32.c
|
net_sched: fix ops->bind_class() implementations
|
2020-02-01 09:34:38 +00:00 |
|
em_canid.c
|
|
|
|
em_cmp.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
em_ipset.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
|
2019-06-19 17:09:55 +02:00 |
|
em_ipt.c
|
net: sched: em_ipt: add support for addrtype matching
|
2019-06-29 11:15:12 -07:00 |
|
em_meta.c
|
tcp: annotate sk->sk_wmem_queued lockless reads
|
2019-10-13 10:13:08 -07:00 |
|
em_nbyte.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
em_text.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
em_u32.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
ematch.c
|
net_sched: ematch: reject invalid TCF_EM_SIMPLE
|
2020-02-01 09:34:38 +00:00 |
|
Kconfig
|
net/sched: Set default of CONFIG_NET_TC_SKB_EXT to N
|
2019-09-27 20:08:28 +02:00 |
|
Makefile
|
net/sched: Introduce action ct
|
2019-07-09 12:11:59 -07:00 |
|
sch_api.c
|
net_sched: walk through all child classes in tc_bind_tclass()
|
2020-02-01 09:34:39 +00:00 |
|
sch_atm.c
|
|
|
|
sch_blackhole.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
sch_cake.c
|
sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO
|
2020-01-17 19:49:02 +01:00 |
|
sch_cbq.c
|
sch_cbq: validate TCA_CBQ_WRROPT to avoid crash
|
2019-09-30 11:07:46 -07:00 |
|
sch_cbs.c
|
net: cbs: Fix software cbs to consider packet sending time
|
2020-04-01 11:01:33 +02:00 |
|
sch_choke.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
|
2019-06-19 17:09:55 +02:00 |
|
sch_codel.c
|
net: sched: Fix a possible null-pointer dereference in dequeue_func()
|
2019-07-29 09:46:58 -07:00 |
|
sch_drr.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
|
2019-06-19 17:09:55 +02:00 |
|
sch_dsmark.c
|
sch_dsmark: fix potential NULL deref in dsmark_init()
|
2019-10-04 18:28:30 -07:00 |
|
sch_etf.c
|
sched: etf: do not assume all sockets are full blown
|
2020-04-29 16:33:09 +02:00 |
|
sch_fifo.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
sch_fq.c
|
net: fq: add missing attribute validation for orphan mask
|
2020-03-18 07:17:45 +01:00 |
|
sch_fq_codel.c
|
fq_codel: remove set but not used variables 'prev_ecn_mark' and 'prev_drop_count'
|
2019-08-08 22:32:19 -07:00 |
|
sch_generic.c
|
net/sched: annotate lockless accesses to qdisc->empty
|
2020-01-09 10:20:02 +01:00 |
|
sch_gred.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
sch_hfsc.c
|
|
|
|
sch_hhf.c
|
net/flow_dissector: switch to siphash
|
2019-10-23 20:13:22 -07:00 |
|
sch_htb.c
|
net: sched: sch_htb: don't call qdisc_put() while holding tree lock
|
2019-09-27 12:13:55 +02:00 |
|
sch_ingress.c
|
net: flow_offload: rename TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_*
|
2019-07-09 14:38:50 -07:00 |
|
sch_mq.c
|
net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues
|
2019-12-18 16:08:24 +01:00 |
|
sch_mqprio.c
|
net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues
|
2019-12-18 16:08:24 +01:00 |
|
sch_multiq.c
|
net: sched: fix tc -s class show no bstats on class with nolock subqueues
|
2019-12-04 22:30:54 +01:00 |
|
sch_netem.c
|
net: netem: correct the parent's backlog when corrupted packet was dropped
|
2019-10-19 12:12:36 -07:00 |
|
sch_pie.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 235
|
2019-06-19 17:09:07 +02:00 |
|
sch_plug.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
sch_prio.c
|
net: sch_prio: When ungrafting, replace with FIFO
|
2020-01-12 12:21:49 +01:00 |
|
sch_qfq.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
|
2019-06-19 17:09:55 +02:00 |
|
sch_red.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
sch_sfb.c
|
net/flow_dissector: switch to siphash
|
2019-10-23 20:13:22 -07:00 |
|
sch_sfq.c
|
net/flow_dissector: switch to siphash
|
2019-10-23 20:13:22 -07:00 |
|
sch_skbprio.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
sch_taprio.c
|
net: taprio: add missing attribute validation for txtime delay
|
2020-03-18 07:17:45 +01:00 |
|
sch_tbf.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |
|
sch_teql.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
|
2019-05-30 11:26:32 -07:00 |