Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity
android_kernel_samsung_msm8976/net/ipv6
History
WANG Cong ae02269413 ipv6: reorder icmpv6_init() and ip6_mr_init() 
[ Upstream commit 15e668070a64bb97f102ad9cf3bccbca0545cda8 ]

Andrey reported the following kernel crash:

kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 14446 Comm: syz-executor6 Not tainted 4.10.0+ #82
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88001f311700 task.stack: ffff88001f6e8000
RIP: 0010:ip6mr_sk_done+0x15a/0x3d0 net/ipv6/ip6mr.c:1618
RSP: 0018:ffff88001f6ef418 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 1ffff10003edde8c RCX: ffffc900043ee000
RDX: 0000000000000004 RSI: ffffffff83e3b3f8 RDI: 0000000000000020
RBP: ffff88001f6ef508 R08: fffffbfff0dcc5d8 R09: 0000000000000000
R10: ffffffff86e62ec0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88001f6ef4e0 R15: ffff8800380a0040
FS:  00007f7a52cec700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000061c500 CR3: 000000001f1ae000 CR4: 00000000000006f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 rawv6_close+0x4c/0x80 net/ipv6/raw.c:1217
 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
 inet6_release+0x50/0x70 net/ipv6/af_inet6.c:432
 sock_release+0x8d/0x1e0 net/socket.c:597
 __sock_create+0x39d/0x880 net/socket.c:1226
 sock_create_kern+0x3f/0x50 net/socket.c:1243
 inet_ctl_sock_create+0xbb/0x280 net/ipv4/af_inet.c:1526
 icmpv6_sk_init+0x163/0x500 net/ipv6/icmp.c:954
 ops_init+0x10a/0x550 net/core/net_namespace.c:115
 setup_net+0x261/0x660 net/core/net_namespace.c:291
 copy_net_ns+0x27e/0x540 net/core/net_namespace.c:396
9pnet_virtio: no channels available for device ./file1
 create_new_namespaces+0x437/0x9b0 kernel/nsproxy.c:106
 unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205
 SYSC_unshare kernel/fork.c:2281 [inline]
 SyS_unshare+0x64e/0x1000 kernel/fork.c:2231
 entry_SYSCALL_64_fastpath+0x1f/0xc2

This is because net->ipv6.mr6_tables is not initialized at that point,
ip6mr_rules_init() is not called yet, therefore on the error path when
we iterator the list, we trigger this oops. Fix this by reordering
ip6mr_rules_init() before icmpv6_sk_init().

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2019-07-27 21:45:26 +02:00
..
netfilter net: disable fragment reassembly if high_thresh is set to zero 2019-07-27 21:42:34 +02:00
Kconfig
…
Makefile
…
addrconf.c ipv6: fix sparse warning on rt6i_node 2019-07-27 21:45:09 +02:00
addrconf_core.c
…
addrlabel.c ipv6/addrlabel: fix ip6addrlbl_get() 2016-01-28 21:49:33 -08:00
af_inet6.c ipv6: reorder icmpv6_init() and ip6_mr_init() 2019-07-27 21:45:26 +02:00
ah6.c
…
anycast.c ipv6: fix rtnl locking in setsockopt for anycast and multicast 2019-07-27 21:42:28 +02:00
datagram.c Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
esp6.c
…
exthdrs.c ipv6: add complete rcu protection around np->opt 2016-09-09 02:36:40 -07:00
exthdrs_core.c This is the 3.10.102 stable release 2017-04-18 17:22:08 +02:00
exthdrs_offload.c ipv6: fix exthdrs offload registration in out_rt path 2015-10-01 12:07:38 +02:00
fib6_rules.c
…
icmp.c net: add a sysctl to reflect the fwmark on replies 2014-06-23 15:20:28 -07:00
inet6_connection_sock.c ipv6: add complete rcu protection around np->opt 2016-09-09 02:36:40 -07:00
inet6_hashtables.c
…
ip6_checksum.c
…
ip6_fib.c ipv6: fix sparse warning on rt6i_node 2019-07-27 21:45:09 +02:00
ip6_flowlabel.c
…
ip6_gre.c ip6_gre: fix endianness errors in ip6gre_err 2019-07-27 21:44:42 +02:00
ip6_icmp.c
…
ip6_input.c ipv6: Make MLD packets to only be processed locally 2015-10-01 12:07:34 +02:00
ip6_offload.c ipv6: Fix leak in ipv6_gso_segment(). 2019-07-27 21:44:50 +02:00
ip6_offload.h
…
ip6_output.c udp: consistently apply ufo or fragmentation 2019-07-27 21:44:11 +02:00
ip6_tunnel.c ipv6: Add rt6_get_cookie() function 2019-07-27 21:45:03 +02:00
ip6mr.c ip6mr: fix notification device destruction 2019-07-27 21:44:08 +02:00
ipcomp6.c
…
ipv6_sockglue.c ipv6: add complete rcu protection around np->opt 2016-09-09 02:36:40 -07:00
mcast.c ipv6: fix rtnl locking in setsockopt for anycast and multicast 2019-07-27 21:42:28 +02:00
mip6.c
…
ndisc.c ipv6: don't call fib6_run_gc() until routing is ready 2019-07-27 21:42:27 +02:00
netfilter.c
…
output_core.c ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() 2019-07-27 21:45:02 +02:00
ping.c net: ping: Return EAFNOSUPPORT when appropriate. 2015-09-16 18:20:13 +05:30
proc.c
…
protocol.c
…
raw.c net: ping: do not abuse udp_poll() 2019-07-27 21:44:33 +02:00
reassembly.c net: disable fragment reassembly if high_thresh is set to zero 2019-07-27 21:42:34 +02:00
route.c ipv6: Fix may be used uninitialized warning in rt6_check 2019-07-27 21:45:04 +02:00
sit.c sit: correct IP protocol used in ipip6_err 2019-07-27 21:41:54 +02:00
syncookies.c ipv6: add complete rcu protection around np->opt 2016-09-09 02:36:40 -07:00
sysctl_net_ipv6.c net: add a sysctl to reflect the fwmark on replies 2014-06-23 15:20:28 -07:00
tcp_ipv6.c dccp/tcp: fix routing redirect race 2019-07-27 21:43:13 +02:00
tcpv6_offload.c
…
tunnel6.c
…
udp.c udp: properly support MSG_PEEK with truncated buffers 2017-04-27 23:58:25 -07:00
udp_impl.h
…
udp_offload.c net: avoid skb_warn_bad_offload false positives on UFO 2019-07-27 21:45:23 +02:00
udplite.c
…
xfrm6_input.c
…
xfrm6_mode_beet.c
…
xfrm6_mode_ro.c ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() 2019-07-27 21:44:48 +02:00
xfrm6_mode_transport.c ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() 2019-07-27 21:44:48 +02:00
xfrm6_mode_tunnel.c
…
xfrm6_output.c
…
xfrm6_policy.c ipv6: Add rt6_get_cookie() function 2019-07-27 21:45:03 +02:00
xfrm6_state.c
…
xfrm6_tunnel.c
…