Xin Long
3e00bf91fe
net: sched: fix NULL pointer dereference when action calls some targets ...
[ Upstream commit 4f8a881acc9d1adaf1e552349a0b1df28933a04c ]
As we know in some target's checkentry it may dereference par.entryinfo
to check entry stuff inside. But when sched action calls xt_check_target,
par.entryinfo is set with NULL. It would cause kernel panic when calling
some targets.
It can be reproduce with:
# tc qd add dev eth1 ingress handle ffff:
# tc filter add dev eth1 parent ffff: u32 match u32 0 0 action xt \
-j ECN --ecn-tcp-remove
It could also crash kernel when using target CLUSTERIP or TPROXY.
By now there's no proper value for par.entryinfo in ipt_init_target,
but it can not be set with NULL. This patch is to void all these
panics by setting it with an ipt_entry obj with all members = 0.
Note that this issue has been there since the very beginning.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-30 10:21:42 +02:00
6lowpan: ndisc: no overreact if no short address is available
2016-09-19 20:19:34 +02:00
p9_client_readdir() fix
2017-05-03 08:36:38 -07:00
net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
2017-07-05 14:40:16 +02:00
appletalk: use IS_ENABLED() instead of checking for built-in or module
2016-09-10 21:19:10 -07:00
lec: use IS_ENABLED() instead of checking for built-in or module
2016-09-10 21:19:10 -07:00
ax25: Fix segfault after sock connection timeout
2017-02-04 09:47:09 +01:00
batman-adv: Check for alloc errors when preparing TT local data
2016-12-02 10:46:59 +01:00
Bluetooth: use constant time memory comparison for secret values
2017-07-27 15:07:58 -07:00
bridge: mdb: fix leak on complete_info ptr on fail path
2017-07-21 07:42:17 +02:00
net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
2017-07-05 14:40:14 +02:00
can: Fix kernel panic at security_sock_rcv_skb
2017-02-18 15:11:40 +01:00
libceph: force GFP_NOIO for socket allocations
2017-04-08 09:30:30 +02:00
net: avoid skb_warn_bad_offload false positives on UFO
2017-08-12 19:31:22 -07:00
net: dcb: set error code on failures
2016-12-03 23:54:25 -05:00
dccp: defer ccid_hc_tx_delete() at dismantle time
2017-08-30 10:21:39 +02:00
decnet: always not take dst->__refcnt when inserting dst into hash table
2017-07-05 14:40:16 +02:00
net: dsa: Check return value of phy_connect_direct()
2017-07-05 14:40:23 +02:00
net: introduce device min_header_len
2017-02-18 15:11:43 +01:00
net/hsr: Remove unused but set variable
2016-10-18 10:28:18 -04:00
ieee802154: 6lowpan: fix intra pan id check
2016-07-08 13:23:12 +02:00
tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP
2017-08-30 10:21:42 +02:00
ipv6: repair fib6 tree in failure case
2017-08-30 10:21:41 +02:00
ipx: call ipxitf_put() in ioctl error path
2017-05-25 15:44:41 +02:00
irda: do not leak initialized list.dev to userspace
2017-08-30 10:21:42 +02:00
net/af_iucv: don't use paged skbs for TX on HiperSockets
2017-01-19 20:18:04 +01:00
kcm: return immediately after copy_from_user() failure
2017-05-03 08:36:34 -07:00
af_key: do not use GFP_KERNEL in atomic contexts
2017-08-30 10:21:38 +02:00
l2tp: consider '::' as wildcard address in l2tp_ip6 socket lookup
2017-08-06 18:59:46 -07:00
net: ipv6: Remove l3mdev_get_saddr6
2016-09-10 23:12:53 -07:00
net/llc: avoid BUG_ON() in skb_orphan()
2017-02-26 11:10:50 +01:00
mac80211: initialize SMPS field in HT capabilities
2017-07-05 14:40:25 +02:00
mac802154: use rate limited warnings for malformed frames
2016-09-19 20:19:34 +02:00
mpls: Do not decrement alive counter for unregister events
2017-03-22 12:43:34 +01:00
net/ncsi: Improve HNCDSC AEN handler
2016-10-20 11:23:08 -04:00
netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister
2017-08-24 17:12:18 -07:00
netlabel: Implement CALIPSO config functions for SMACK.
2016-06-27 15:06:18 -04:00
netlink: Do not schedule work from sk_destruct
2016-12-05 19:43:42 -05:00
NFC: Add sockaddr length checks before accessing sa_family in bind handlers
2017-07-27 15:07:56 -07:00
openvswitch: fix skb_panic due to the incorrect actions attrlen
2017-08-30 10:21:40 +02:00
packet: fix tp_reserve race in packet_set_ring
2017-08-12 19:31:22 -07:00
rds: tcp: use sock_create_lite() to create the accept socket
2017-07-21 07:42:19 +02:00
rose: limit sk_filter trim to payload
2016-07-13 11:53:40 -07:00
rxrpc: Fix several cases where a padded len isn't checked in ticket decode
2017-06-29 13:00:31 +02:00
net: sched: fix NULL pointer dereference when action calls some targets
2017-08-30 10:21:42 +02:00
sctp: fully initialize the IPv6 address in sctp_v6_to_addr()
2017-08-30 10:21:41 +02:00
strparser: destroy workqueue on module exit
2017-03-22 12:43:33 +01:00
sunrpc: use constant time memory comparison for mac
2017-07-27 15:08:05 -07:00
switchdev: Execute bridge ndos only for bridge ports
2016-10-19 10:58:04 -04:00
tipc: fix use-after-free
2017-08-30 10:21:41 +02:00
af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
2017-07-05 14:40:14 +02:00
vsock/virtio: fix src/dst cid format
2017-01-09 08:32:23 +01:00
cfg80211: Check if NAN service ID is of expected size
2017-07-21 07:42:20 +02:00
net: x25: remove null checks on arrays calling_ae and called_ae
2016-09-09 18:13:30 -07:00
xfrm: Don't use sk_family for socket policy lookups
2017-08-06 18:59:48 -07:00
packet: compat support for sock_fprog
2016-06-09 23:41:03 -07:00
strparser: Stream parser for messages
2016-08-17 19:36:23 -04:00
strparser: Stream parser for messages
2016-08-17 19:36:23 -04:00
net: socket: fix recvmmsg not returning error from sock_error
2017-02-26 11:10:51 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2016-10-06 09:52:23 -07:00
3e00bf91fe