Feng Sun
2c1644cf6d
net: fix skb use after free in netpoll
...
After commit baeababb5b
("tun: return NET_XMIT_DROP for dropped packets"),
when tun_net_xmit drop packets, it will free skb and return NET_XMIT_DROP,
netpoll_send_skb_on_dev will run into following use after free cases:
1. retry netpoll_start_xmit with freed skb;
2. queue freed skb in npinfo->txq.
queue_process will also run into use after free case.
hit netpoll_send_skb_on_dev first case with following kernel log:
[ 117.864773] kernel BUG at mm/slub.c:306!
[ 117.864773] invalid opcode: 0000 [#1 ] SMP PTI
[ 117.864774] CPU: 3 PID: 2627 Comm: loop_printmsg Kdump: loaded Tainted: P OE 5.3.0-050300rc5-generic #201908182231
[ 117.864775] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 117.864775] RIP: 0010:kmem_cache_free+0x28d/0x2b0
[ 117.864781] Call Trace:
[ 117.864781] ? tun_net_xmit+0x21c/0x460
[ 117.864781] kfree_skbmem+0x4e/0x60
[ 117.864782] kfree_skb+0x3a/0xa0
[ 117.864782] tun_net_xmit+0x21c/0x460
[ 117.864782] netpoll_start_xmit+0x11d/0x1b0
[ 117.864788] netpoll_send_skb_on_dev+0x1b8/0x200
[ 117.864789] __br_forward+0x1b9/0x1e0 [bridge]
[ 117.864789] ? skb_clone+0x53/0xd0
[ 117.864790] ? __skb_clone+0x2e/0x120
[ 117.864790] deliver_clone+0x37/0x50 [bridge]
[ 117.864790] maybe_deliver+0x89/0xc0 [bridge]
[ 117.864791] br_flood+0x6c/0x130 [bridge]
[ 117.864791] br_dev_xmit+0x315/0x3c0 [bridge]
[ 117.864792] netpoll_start_xmit+0x11d/0x1b0
[ 117.864792] netpoll_send_skb_on_dev+0x1b8/0x200
[ 117.864792] netpoll_send_udp+0x2c6/0x3e8
[ 117.864793] write_msg+0xd9/0xf0 [netconsole]
[ 117.864793] console_unlock+0x386/0x4e0
[ 117.864793] vprintk_emit+0x17e/0x280
[ 117.864794] vprintk_default+0x29/0x50
[ 117.864794] vprintk_func+0x4c/0xbc
[ 117.864794] printk+0x58/0x6f
[ 117.864795] loop_fun+0x24/0x41 [printmsg_loop]
[ 117.864795] kthread+0x104/0x140
[ 117.864795] ? 0xffffffffc05b1000
[ 117.864796] ? kthread_park+0x80/0x80
[ 117.864796] ret_from_fork+0x35/0x40
Signed-off-by: Feng Sun <loyou85@gmail.com>
Signed-off-by: Xiaojun Zhao <xiaojunzhao141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-08-27 20:52:02 -07:00
arch
ARC updates for 5.3-rc7
2019-08-27 10:50:27 -07:00
block
block: remove REQ_NOWAIT_INLINE
2019-08-15 11:09:16 -06:00
certs
Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs"
2019-07-10 18:43:43 -07:00
crypto
USB / PHY patches for 5.3-rc1
2019-07-11 15:40:06 -07:00
Documentation
ARC updates for 5.3-rc7
2019-08-27 10:50:27 -07:00
drivers
Add genphy_c45_config_aneg() function to phy-c45.c
2019-08-27 20:21:15 -07:00
fs
NFS client bugfixes for Linux 5.3
2019-08-27 13:22:57 -07:00
include
Add genphy_c45_config_aneg() function to phy-c45.c
2019-08-27 20:21:15 -07:00
init
Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-19 10:42:02 -07:00
ipc
Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-19 10:42:02 -07:00
kernel
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2019-08-27 10:12:48 -07:00
lib
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2019-08-06 17:11:59 -07:00
LICENSES
LICENSES: Rename other to deprecated
2019-05-03 06:34:32 -06:00
mm
mm/kasan: fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y
2019-08-24 19:48:42 -07:00
net
net: fix skb use after free in netpoll
2019-08-27 20:52:02 -07:00
samples
auxdisplay: Fix a typo in cfag12864b-example.c
2019-08-08 20:00:18 +02:00
scripts
SPDX fixes for 5.3-rc5
2019-08-18 09:26:16 -07:00
security
KEYS: trusted: allow module init if TPM is inactive or deactivated
2019-08-13 19:59:23 +03:00
sound
sound fixes for 5.3-rc7
2019-08-27 10:42:03 -07:00
tools
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2019-08-27 10:12:48 -07:00
usr
kbuild: enable arch/s390/include/uapi/asm/zcrypt.h for uapi header test
2019-07-23 10:45:46 +02:00
virt
KVM/arm fixes for 5.3, take #3
2019-08-24 12:46:30 +01:00
.clang-format
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-04-17 11:26:25 -07:00
.cocciconfig
.get_maintainer.ignore
Opt out of scripts/get_maintainer.pl
2019-05-16 10:53:40 -07:00
.gitattributes
.gitignore
.gitignore: Add compilation database file
2019-07-27 12:18:19 +09:00
.mailmap
MAINTAINERS: Update my email address
2019-07-22 14:57:50 +01:00
COPYING
COPYING: use the new text with points to the license files
2018-03-23 12:41:45 -06:00
CREDITS
Remove references to dead website.
2019-07-19 12:22:04 -07:00
Kbuild
Kbuild updates for v5.1
2019-03-10 17:48:21 -07:00
Kconfig
docs: kbuild: convert docs to ReST and rename to *.rst
2019-06-14 14:21:21 -06:00
MAINTAINERS
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2019-08-27 10:12:48 -07:00
Makefile
Linux 5.3-rc6
2019-08-25 12:01:23 -07:00
README
Drop all 00-INDEX files from Documentation/
2018-09-09 15:08:58 -06:00