Taehee Yoo
0d1e561fc3
gtp: fix use-after-free in gtp_newlink()
[ Upstream commit a2bed90704c68d3763bf24decb1b781a45395de8 ]
Current gtp_newlink() could be called after unregister_pernet_subsys().
gtp_newlink() uses gtp_net but it can be destroyed by
unregister_pernet_subsys().
So unregister_pernet_subsys() should be called after
rtnl_link_unregister().
Test commands:
#SHELL 1
while :
do
for i in {1..5}
do
./gtp-link add gtp$i &
done
killall gtp-link
done
#SHELL 2
while :
do
modprobe -rv gtp
done
Splat looks like:
[ 753.176631] BUG: KASAN: use-after-free in gtp_newlink+0x9b4/0xa5c [gtp]
[ 753.177722] Read of size 8 at addr ffff8880d48f2458 by task gtp-link/7126
[ 753.179082] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G W 5.2.0-rc6+ #50
[ 753.185801] Call Trace:
[ 753.186264] dump_stack+0x7c/0xbb
[ 753.186863] ? gtp_newlink+0x9b4/0xa5c [gtp]
[ 753.187583] print_address_description+0xc7/0x240
[ 753.188382] ? gtp_newlink+0x9b4/0xa5c [gtp]
[ 753.189097] ? gtp_newlink+0x9b4/0xa5c [gtp]
[ 753.189846] __kasan_report+0x12a/0x16f
[ 753.190542] ? gtp_newlink+0x9b4/0xa5c [gtp]
[ 753.191298] kasan_report+0xe/0x20
[ 753.191893] gtp_newlink+0x9b4/0xa5c [gtp]
[ 753.192580] ? __netlink_ns_capable+0xc3/0xf0
[ 753.193370] __rtnl_newlink+0xb9f/0x11b0
[ ... ]
[ 753.241201] Allocated by task 7186:
[ 753.241844] save_stack+0x19/0x80
[ 753.242399] __kasan_kmalloc.constprop.3+0xa0/0xd0
[ 753.243192] __kmalloc+0x13e/0x300
[ 753.243764] ops_init+0xd6/0x350
[ 753.244314] register_pernet_operations+0x249/0x6f0
[ ... ]
[ 753.251770] Freed by task 7178:
[ 753.252288] save_stack+0x19/0x80
[ 753.252833] __kasan_slab_free+0x111/0x150
[ 753.253962] kfree+0xc7/0x280
[ 753.254509] ops_free_list.part.11+0x1c4/0x2d0
[ 753.255241] unregister_pernet_operations+0x262/0x390
[ ... ]
[ 753.285883] list_add corruption. next->prev should be prev (ffff8880d48f2458), but was ffff8880d497d878. (next.
[ 753.287241] ------------[ cut here ]------------
[ 753.287794] kernel BUG at lib/list_debug.c:25!
[ 753.288364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 753.289099] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G B W 5.2.0-rc6+ #50
[ 753.291036] RIP: 0010:__list_add_valid+0x74/0xd0
[ 753.291589] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 89 d9 48b
[ 753.293779] RSP: 0018:ffff8880cae8f398 EFLAGS: 00010286
[ 753.294401] RAX: 0000000000000075 RBX: ffff8880d497d878 RCX: 0000000000000000
[ 753.296260] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed10195d1e69
[ 753.297070] RBP: ffff8880cd250ae0 R08: ffffed101b4bff21 R09: ffffed101b4bff21
[ 753.297899] R10: 0000000000000001 R11: ffffed101b4bff20 R12: ffff8880d497d878
[ 753.298703] R13: 0000000000000000 R14: ffff8880cd250ae0 R15: ffff8880d48f2458
[ 753.299564] FS: 00007f5f79805740(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000
[ 753.300533] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 753.301231] CR2: 00007fe8c7ef4f10 CR3: 00000000b71a6006 CR4: 00000000000606f0
[ 753.302183] Call Trace:
[ 753.302530] gtp_newlink+0x5f6/0xa5c [gtp]
[ 753.303037] ? __netlink_ns_capable+0xc3/0xf0
[ 753.303576] __rtnl_newlink+0xb9f/0x11b0
[ 753.304092] ? rtnl_link_unregister+0x230/0x230
Fixes: 459aa660eb ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
2019-08-04 09:33:25 +02:00 |
| .. |
|
accessibility
|
|
|
|
acpi
|
x86/cpu: Sanitize FAM6_ATOM naming
|
2019-05-14 19:19:34 +02:00 |
|
amba
|
ARM: amba: Don't read past the end of sysfs "driver_override" buffer
|
2018-05-01 15:13:08 -07:00 |
|
android
|
binder: replace "%p" with "%pK"
|
2019-06-11 12:22:44 +02:00 |
|
ata
|
libata: don't request sense data on !ZAC ATA devices
|
2019-08-04 09:33:22 +02:00 |
|
atm
|
atm: he: fix sign-extension overflow on large shift
|
2019-02-27 10:06:59 +01:00 |
|
auxdisplay
|
|
|
|
base
|
regmap: fix bulk writes on paged registers
|
2019-08-04 09:33:19 +02:00 |
|
bcma
|
|
|
|
block
|
virtio-blk: limit number of hw queues by nr_cpu_ids
|
2019-05-10 17:52:09 +02:00 |
|
bluetooth
|
Bluetooth: hci_bcsp: Fix memory leak in rx_skb
|
2019-08-04 09:33:24 +02:00 |
|
bus
|
bus: arm-cci: remove unnecessary unreachable()
|
2018-12-05 19:42:41 +01:00 |
|
cdrom
|
cdrom: Fix race condition in cdrom_sysctl_register
|
2019-04-05 22:29:12 +02:00 |
|
char
|
virtio_console: initialize vtermno value for ports
|
2019-05-31 06:48:29 -07:00 |
|
clk
|
clk: sunxi: fix uninitialized access
|
2019-07-10 09:55:44 +02:00 |
|
clocksource
|
clocksource/drivers/exynos_mct: Increase priority over ARM arch timer
|
2019-08-04 09:33:22 +02:00 |
|
connector
|
|
|
|
cpufreq
|
cpufreq: pmac32: fix possible object reference leak
|
2019-05-31 06:48:27 -07:00 |
|
cpuidle
|
cpuidle: big.LITTLE: fix refcount leak
|
2019-02-12 19:44:55 +01:00 |
|
crypto
|
crypto: talitos - Align SEC1 accesses to 32 bits boundaries.
|
2019-08-04 09:33:17 +02:00 |
|
dax
|
|
|
|
dca
|
|
|
|
devfreq
|
|
|
|
dio
|
|
|
|
dma
|
dmaengine: imx-sdma: fix use-after-free on probe error path
|
2019-08-04 09:33:14 +02:00 |
|
dma-buf
|
dma-buf: remove redundant initialization of sg_table
|
2018-06-06 16:44:33 +02:00 |
|
edac
|
EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
|
2019-08-04 09:33:23 +02:00 |
|
eisa
|
|
|
|
extcon
|
extcon: arizona: Disable mic detect if running when driver is removed
|
2019-05-31 06:48:26 -07:00 |
|
firewire
|
firewire-ohci: work around oversized DMA reads on JMicron controllers
|
2018-05-30 07:50:18 +02:00 |
|
firmware
|
efi/libstub: Unify command line param parsing
|
2019-06-11 12:22:45 +02:00 |
|
fmc
|
|
|
|
fpga
|
|
|
|
gpio
|
gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants
|
2019-08-04 09:33:24 +02:00 |
|
gpu
|
drm/imx: only send event on crtc disable if kept disabled
|
2019-07-10 09:55:46 +02:00 |
|
hid
|
HID: core: move Usage Page concatenation to Main item
|
2019-05-31 06:48:29 -07:00 |
|
hsi
|
|
|
|
hv
|
Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
|
2018-12-29 13:40:15 +01:00 |
|
hwmon
|
hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
|
2019-07-10 09:55:32 +02:00 |
|
hwspinlock
|
|
|
|
hwtracing
|
intel_th: msu: Fix single mode with IOMMU
|
2019-05-25 18:26:46 +02:00 |
|
i2c
|
i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
|
2019-06-22 08:17:23 +02:00 |
|
ide
|
ide: pmac: add of_node_put()
|
2018-12-21 14:11:37 +01:00 |
|
idle
|
x86/cpu: Sanitize FAM6_ATOM naming
|
2019-05-14 19:19:34 +02:00 |
|
iio
|
iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data
|
2019-05-31 06:48:27 -07:00 |
|
infiniband
|
ipoib: correcly show a VF hardware address
|
2019-08-04 09:33:20 +02:00 |
|
input
|
Input: imx_keypad - make sure keyboard can always wake up system
|
2019-07-21 09:05:54 +02:00 |
|
iommu
|
iommu/vt-d: Set intel_iommu_gfx_mapped correctly
|
2019-06-22 08:17:14 +02:00 |
|
ipack
|
|
|
|
irqchip
|
Revert "MIPS: perf: ath79: Fix perfcount IRQ assignment"
|
2019-06-11 12:22:48 +02:00 |
|
isdn
|
mISDN: make sure device name is NUL terminated
|
2019-06-22 08:17:22 +02:00 |
|
leds
|
leds: pca9532: fix a potential NULL pointer dereference
|
2019-05-04 08:49:10 +02:00 |
|
lguest
|
|
|
|
lightnvm
|
|
|
|
macintosh
|
macintosh/rack-meter: Convert cputime64_t use to u64
|
2018-10-20 09:51:32 +02:00 |
|
mailbox
|
mailbox: xgene-slimpro: Fix potential NULL pointer dereference
|
2018-09-09 20:01:19 +02:00 |
|
mcb
|
|
|
|
md
|
bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
|
2019-08-04 09:33:23 +02:00 |
|
media
|
media: coda: increment sequence offset for the last returned frame
|
2019-08-04 09:33:21 +02:00 |
|
memory
|
memory: tegra: Fix integer overflow on tick value calculation
|
2019-05-25 18:26:49 +02:00 |
|
memstick
|
memstick: Prevent memstick host from getting runtime suspended during card detection
|
2019-02-12 19:44:55 +01:00 |
|
message
|
scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
|
2018-05-25 16:13:06 +02:00 |
|
mfd
|
mfd: omap-usb-tll: Fix register offsets
|
2019-07-10 09:55:44 +02:00 |
|
misc
|
VMCI: Fix integer overflow in VMCI handle arrays
|
2019-07-21 09:06:03 +02:00 |
|
mmc
|
mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
|
2019-05-31 06:48:25 -07:00 |
|
mtd
|
mtd: rawnand: gpmi: fix MX28 bus master lockup problem
|
2019-02-15 08:07:37 +01:00 |
|
net
|
gtp: fix use-after-free in gtp_newlink()
|
2019-08-04 09:33:25 +02:00 |
|
nfc
|
spi: ST ST95HF NFC: declare missing of table
|
2019-05-16 19:43:43 +02:00 |
|
ntb
|
ntb_transport: Fix bug with max_mw_size parameter
|
2018-05-30 07:50:22 +02:00 |
|
nubus
|
|
|
|
nvdimm
|
libnvdimm/namespace: Fix label tracking error
|
2019-05-31 06:48:11 -07:00 |
|
nvme
|
nvme: Fix u32 overflow in the number of namespace list calculation
|
2019-07-10 09:55:32 +02:00 |
|
nvmem
|
nvmem: core: fix read buffer in place
|
2019-06-22 08:17:15 +02:00 |
|
of
|
of: add helper to lookup compatible child node
|
2018-12-01 09:44:21 +01:00 |
|
oprofile
|
|
|
|
parisc
|
parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
|
2019-06-11 12:22:47 +02:00 |
|
parport
|
parport: Fix mem leak in parport_register_dev_model
|
2019-07-10 09:55:29 +02:00 |
|
pci
|
PCI: xilinx: Check for __get_free_pages() failure
|
2019-06-22 08:17:17 +02:00 |
|
pcmcia
|
pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
|
2018-11-13 11:16:46 -08:00 |
|
perf
|
|
|
|
phy
|
phy: tegra: remove redundant self assignment of 'map'
|
2019-02-27 10:07:03 +01:00 |
|
pinctrl
|
pinctrl: pistachio: fix leaked of_node references
|
2019-05-31 06:48:18 -07:00 |
|
platform
|
platform/x86: intel_pmc_ipc: adding error handling
|
2019-06-22 08:17:16 +02:00 |
|
pnp
|
|
|
|
power
|
power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG
|
2019-05-25 18:26:56 +02:00 |
|
powercap
|
x86/cpu: Sanitize FAM6_ATOM naming
|
2019-05-14 19:19:34 +02:00 |
|
pps
|
|
|
|
ps3
|
|
|
|
ptp
|
ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
|
2019-02-12 19:44:52 +01:00 |
|
pwm
|
pwm: Fix deadlock warning when removing PWM device
|
2019-06-22 08:17:17 +02:00 |
|
rapidio
|
rapidio: fix a NULL pointer dereference when create_workqueue() fails
|
2019-06-22 08:17:11 +02:00 |
|
ras
|
|
|
|
regulator
|
regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
|
2019-04-05 22:29:14 +02:00 |
|
remoteproc
|
|
|
|
reset
|
reset: make device_reset_optional() really optional
|
2018-12-08 13:05:08 +01:00 |
|
rpmsg
|
rpmsg: smd: fix memory leak on channel create
|
2018-11-13 11:17:03 -08:00 |
|
rtc
|
rtc: pcf8523: don't return invalid date when battery is low
|
2019-06-22 08:17:21 +02:00 |
|
s390
|
s390/qdio: handle PENDING state for QEBSM devices
|
2019-08-04 09:33:18 +02:00 |
|
sbus
|
drivers/sbus/char: add of_node_put()
|
2018-12-21 14:11:36 +01:00 |
|
scsi
|
scsi: hpsa: correct ioaccel2 chaining
|
2019-07-10 09:55:43 +02:00 |
|
sfi
|
|
|
|
sh
|
|
|
|
sn
|
|
|
|
soc
|
soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
|
2019-06-22 08:17:15 +02:00 |
|
spi
|
spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
|
2019-07-10 09:55:43 +02:00 |
|
spmi
|
|
|
|
ssb
|
ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
|
2019-05-31 06:48:12 -07:00 |
|
staging
|
media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails.
|
2019-08-04 09:33:17 +02:00 |
|
target
|
scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
|
2019-03-23 13:19:47 +01:00 |
|
tc
|
TC: Set DMA masks for devices
|
2018-11-13 11:17:02 -08:00 |
|
thermal
|
drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER
|
2019-06-22 08:17:13 +02:00 |
|
thunderbolt
|
|
|
|
tty
|
Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
|
2019-07-21 09:06:00 +02:00 |
|
uio
|
uio: Fix an Oops on load
|
2018-11-27 16:09:41 +01:00 |
|
usb
|
usb: renesas_usbhs: add a workaround for a race condition of workqueue
|
2019-07-21 09:06:01 +02:00 |
|
uwb
|
uwb: hwa-rc: fix memory leak at probe
|
2018-10-03 17:01:42 -07:00 |
|
vfio
|
vfio/pci: use correct format characters
|
2019-05-08 07:19:10 +02:00 |
|
vhost
|
vhost_net: disable zerocopy by default
|
2019-08-04 09:33:20 +02:00 |
|
video
|
video: imsttfb: fix potential NULL pointer dereferences
|
2019-06-22 08:17:17 +02:00 |
|
virt
|
drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
|
2019-05-16 19:43:47 +02:00 |
|
virtio
|
virtio: Honour 'may_reduce_num' in vring_create_virtqueue
|
2019-04-17 08:36:47 +02:00 |
|
vlynq
|
|
|
|
vme
|
|
|
|
w1
|
w1: fix the resume command API
|
2019-05-31 06:48:15 -07:00 |
|
watchdog
|
watchdog: fix compile time error of pretimeout governors
|
2019-06-22 08:17:14 +02:00 |
|
xen
|
fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
|
2019-06-11 12:22:49 +02:00 |
|
zorro
|
zorro: Set up z->dev.dma_mask for the DMA API
|
2018-05-30 07:50:44 +02:00 |
|
Kconfig
|
|
|
|
Makefile
|
|
|