https://github.com/torvalds/linux
Revision f8017317cb0b279b8ab98b0f3901a2e0ac880dad authored by Chen Zhongjin on 01 November 2022, 12:15:52 UTC, committed by Jakub Kicinski on 03 November 2022, 03:44:27 UTC
When IPv6 module gets initialized but hits an error in the middle,
kenel panic with:

KASAN: null-ptr-deref in range [0x0000000000000598-0x000000000000059f]
CPU: 1 PID: 361 Comm: insmod
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:__neigh_ifdown.isra.0+0x24b/0x370
RSP: 0018:ffff888012677908 EFLAGS: 00000202
...
Call Trace:
 <TASK>
 neigh_table_clear+0x94/0x2d0
 ndisc_cleanup+0x27/0x40 [ipv6]
 inet6_init+0x21c/0x2cb [ipv6]
 do_one_initcall+0xd3/0x4d0
 do_init_module+0x1ae/0x670
...
Kernel panic - not syncing: Fatal exception

When ipv6 initialization fails, it will try to cleanup and calls:

neigh_table_clear()
  neigh_ifdown(tbl, NULL)
    pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev == NULL))
    # dev_net(NULL) triggers null-ptr-deref.

Fix it by passing NULL to pneigh_queue_purge() in neigh_ifdown() if dev
is NULL, to make kernel not panic immediately.

Fixes: 66ba215cb513 ("neigh: fix possible DoS due to net iface start/stop loop")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Link: https://lore.kernel.org/r/20221101121552.21890-1-chenzhongjin@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 62ff373
History
Tip revision: f8017317cb0b279b8ab98b0f3901a2e0ac880dad authored by Chen Zhongjin on 01 November 2022, 12:15:52 UTC
net, neigh: Fix null-ptr-deref in neigh_table_clear()
Tip revision: f801731
File Mode Size
9p
adfs
affs
afs
autofs
befs
bfs
btrfs
cachefiles
ceph
cifs
coda
configfs
cramfs
crypto
debugfs
devpts
dlm
ecryptfs
efivarfs
efs
erofs
exfat
exportfs
ext2
ext4
f2fs
fat
freevxfs
fscache
fuse
gfs2
hfs
hfsplus
hostfs
hpfs
hugetlbfs
iomap
isofs
jbd2
jffs2
jfs
kernfs
ksmbd
lockd
minix
netfs
nfs
nfs_common
nfsd
nilfs2
nls
notify
ntfs
ntfs3
ocfs2
omfs
openpromfs
orangefs
overlayfs
proc
pstore
qnx4
qnx6
quota
ramfs
reiserfs
romfs
smbfs_common
squashfs
sysfs
sysv
tracefs
ubifs
udf
ufs
unicode
vboxsf
verity
xfs
zonefs
Kconfig -rw-r--r-- 9.8 KB
Kconfig.binfmt -rw-r--r-- 6.2 KB
Makefile -rw-r--r-- 4.5 KB
aio.c -rw-r--r-- 61.0 KB
anon_inodes.c -rw-r--r-- 8.1 KB
attr.c -rw-r--r-- 13.3 KB
bad_inode.c -rw-r--r-- 5.8 KB
binfmt_elf.c -rw-r--r-- 61.6 KB
binfmt_elf_fdpic.c -rw-r--r-- 43.4 KB
binfmt_elf_test.c -rw-r--r-- 2.7 KB
binfmt_flat.c -rw-r--r-- 25.8 KB
binfmt_misc.c -rw-r--r-- 17.4 KB
binfmt_script.c -rw-r--r-- 4.2 KB
buffer.c -rw-r--r-- 78.9 KB
char_dev.c -rw-r--r-- 16.5 KB
compat_binfmt_elf.c -rw-r--r-- 3.8 KB
coredump.c -rw-r--r-- 29.2 KB
d_path.c -rw-r--r-- 11.4 KB
dax.c -rw-r--r-- 52.4 KB
dcache.c -rw-r--r-- 87.6 KB
direct-io.c -rw-r--r-- 38.9 KB
drop_caches.c -rw-r--r-- 1.9 KB
eventfd.c -rw-r--r-- 12.1 KB
eventpoll.c -rw-r--r-- 64.9 KB
exec.c -rw-r--r-- 50.9 KB
fcntl.c -rw-r--r-- 23.3 KB
fhandle.c -rw-r--r-- 6.8 KB
file.c -rw-r--r-- 31.7 KB
file_table.c -rw-r--r-- 10.9 KB
filesystems.c -rw-r--r-- 6.5 KB
fs-writeback.c -rw-r--r-- 79.1 KB
fs_context.c -rw-r--r-- 17.7 KB
fs_parser.c -rw-r--r-- 10.7 KB
fs_pin.c -rw-r--r-- 1.9 KB
fs_struct.c -rw-r--r-- 3.4 KB
fs_types.c -rw-r--r-- 2.5 KB
fsopen.c -rw-r--r-- 10.9 KB
init.c -rw-r--r-- 6.1 KB
inode.c -rw-r--r-- 67.3 KB
internal.h -rw-r--r-- 6.1 KB
ioctl.c -rw-r--r-- 23.9 KB
kernel_read_file.c -rw-r--r-- 4.4 KB
libfs.c -rw-r--r-- 41.2 KB
locks.c -rw-r--r-- 75.1 KB
mbcache.c -rw-r--r-- 12.5 KB
mount.h -rw-r--r-- 4.0 KB
mpage.c -rw-r--r-- 18.8 KB
namei.c -rw-r--r-- 137.3 KB
namespace.c -rw-r--r-- 113.9 KB
no-block.c -rw-r--r-- 478 bytes
nsfs.c -rw-r--r-- 6.6 KB
open.c -rw-r--r-- 37.4 KB
pipe.c -rw-r--r-- 36.0 KB
pnode.c -rw-r--r-- 15.1 KB
pnode.h -rw-r--r-- 2.0 KB
posix_acl.c -rw-r--r-- 33.4 KB
proc_namespace.c -rw-r--r-- 8.1 KB
read_write.c -rw-r--r-- 40.2 KB
readdir.c -rw-r--r-- 13.8 KB
remap_range.c -rw-r--r-- 14.1 KB
select.c -rw-r--r-- 34.7 KB
seq_file.c -rw-r--r-- 25.7 KB
signalfd.c -rw-r--r-- 8.7 KB
splice.c -rw-r--r-- 38.7 KB
stack.c -rw-r--r-- 2.5 KB
stat.c -rw-r--r-- 22.1 KB
statfs.c -rw-r--r-- 9.7 KB
super.c -rw-r--r-- 46.7 KB
sync.c -rw-r--r-- 10.4 KB
sysctls.c -rw-r--r-- 809 bytes
timerfd.c -rw-r--r-- 13.9 KB
userfaultfd.c -rw-r--r-- 55.8 KB
utimes.c -rw-r--r-- 7.6 KB
xattr.c -rw-r--r-- 28.6 KB

back to top