Tuong Lien 5e9eeccc58 tipc: fix NULL pointer dereference in streaming ... syzbot found the following crash: general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] CPU: 1 PID: 7060 Comm: syz-executor394 Not tainted 5.7.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__tipc_sendstream+0xbde/0x11f0 net/tipc/socket.c:1591 Code: 00 00 00 00 48 39 5c 24 28 48 0f 44 d8 e8 fa 3e db f9 48 b8 00 00 00 00 00 fc ff df 48 8d bb c8 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 e2 04 00 00 48 8b 9b c8 00 00 00 48 b8 00 00 00 RSP: 0018:ffffc90003ef7818 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8797fd9d RDX: 0000000000000019 RSI: ffffffff8797fde6 RDI: 00000000000000c8 RBP: ffff888099848040 R08: ffff88809a5f6440 R09: fffffbfff1860b4c R10: ffffffff8c305a5f R11: fffffbfff1860b4b R12: ffff88809984857e R13: 0000000000000000 R14: ffff888086aa4000 R15: 0000000000000000 FS: 00000000009b4880(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000140 CR3: 00000000a7fdf000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tipc_sendstream+0x4c/0x70 net/tipc/socket.c:1533 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:672 ____sys_sendmsg+0x32f/0x810 net/socket.c:2352 ___sys_sendmsg+0x100/0x170 net/socket.c:2406 __sys_sendmmsg+0x195/0x480 net/socket.c:2496 __do_sys_sendmmsg net/socket.c:2525 [inline] __se_sys_sendmmsg net/socket.c:2522 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2522 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x440199 ... This bug was bisected to commit 0a3e060f34 ("tipc: add test for Nagle algorithm effectiveness"). However, it is not the case, the trouble was from the base in the case of zero data length message sending, we would unexpectedly make an empty 'txq' queue after the 'tipc_msg_append()' in Nagle mode. A similar crash can be generated even without the bisected patch but at the link layer when it accesses the empty queue. We solve the issues by building at least one buffer to go with socket's header and an optional data section that may be empty like what we had with the 'tipc_msg_build()'. Note: the previous commit 4c21daae3d ("tipc: Fix NULL pointer dereference in __tipc_sendstream()") is obsoleted by this one since the 'txq' will be never empty and the check of 'skb != NULL' is unnecessary but it is safe anyway. Reported-by: syzbot+8eac6d030e7807c21d32@syzkaller.appspotmail.com Fixes: c0bceb97db ("tipc: add smart nagle feature") Acked-by: Jon Maloy <jmaloy@redhat.com> Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>		2020-06-04 15:37:59 -07:00
..
addr.c	tipc: initialise addr_trail_end when setting node addresses	2019-08-11 21:40:04 -07:00
addr.h	tipc: add 128-bit node identifier	2018-03-23 13:12:18 -04:00
bcast.c	tipc: add support for broadcast rcv stats dumping	2020-05-26 15:16:52 -07:00
bcast.h	tipc: add support for broadcast rcv stats dumping	2020-05-26 15:16:52 -07:00
bearer.c	tipc: introduce variable window congestion control	2019-12-10 17:31:15 -08:00
bearer.h	tipc: introduce variable window congestion control	2019-12-10 17:31:15 -08:00
core.c	tipc: fix ordering of tipc module init and exit routine	2019-12-06 12:01:09 -08:00
core.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-11-16 21:51:42 -08:00
crypto.c	Revert "tipc: Fix potential tipc_aead refcnt leak in tipc_crypto_rcv"	2020-06-02 15:13:47 -07:00
crypto.h	tipc: introduce TIPC encryption & authentication	2019-11-08 14:01:59 -08:00
diag.c	tipc: switch to rhashtable iterator	2018-08-29 18:04:54 -07:00
discover.c	tipc: fix use-after-free in tipc_disc_rcv()	2019-12-10 17:45:04 -08:00
discover.h	tipc: some cleanups in the file discover.c	2018-03-23 13:12:17 -04:00
eth_media.c	tipc: introduce variable window congestion control	2019-12-10 17:31:15 -08:00
group.c	tipc: clean up skb list lock handling on send path	2019-08-18 14:01:07 -07:00
group.h	tipc: extend sock diag for group communication	2018-06-30 21:05:42 +09:00
ib_media.c	tipc: introduce variable window congestion control	2019-12-10 17:31:15 -08:00
Kconfig	tipc: introduce TIPC encryption & authentication	2019-11-08 14:01:59 -08:00
link.c	tipc: add support for broadcast rcv stats dumping	2020-05-26 15:16:52 -07:00
link.h	tipc: add support for broadcast rcv stats dumping	2020-05-26 15:16:52 -07:00
Makefile	tipc: remove meaningless assignment in Makefile	2020-01-08 12:38:54 -08:00
monitor.c	tipc: add NULL pointer check to prevent kernel oops	2020-03-15 00:07:00 -07:00
monitor.h	tipc: update mon's self addr when node addr generated	2019-11-12 19:45:45 -08:00
msg.c	tipc: fix NULL pointer dereference in streaming	2020-06-04 15:37:59 -07:00
msg.h	tipc: add test for Nagle algorithm effectiveness	2020-05-26 15:16:52 -07:00
name_distr.c	tipc: improve throughput between nodes in netns	2019-10-29 17:55:38 -07:00
name_distr.h	tipc: permit overlapping service ranges in name table	2018-03-31 22:19:52 -04:00
name_table.c	tipc: fix name table rbtree issues	2019-12-10 17:45:04 -08:00
name_table.h	tipc: support in-order name publication events	2019-11-22 09:29:50 -08:00
net.c	tipc: make legacy address flag readable over netlink	2019-12-20 21:18:42 -08:00
net.h	tipc: make legacy address flag readable over netlink	2019-12-20 21:18:42 -08:00
netlink_compat.c	tipc: eliminate KMSAN: uninit-value in __tipc_nl_compat_dumpit error	2020-01-06 13:24:31 -08:00
netlink.c	tipc: add support for broadcast rcv stats dumping	2020-05-26 15:16:52 -07:00
netlink.h	net: tipc: allocate attrs locally instead of using genl_family_attrbuf in compat_dumpit()	2019-10-06 15:44:47 +02:00
node.c	Revert "tipc: Fix potential tipc_node refcnt leak in tipc_rcv"	2020-06-02 15:13:46 -07:00
node.h	tipc: add support for AEAD key setting via netlink	2019-11-08 14:01:59 -08:00
socket.c	tipc: Fix NULL pointer dereference in __tipc_sendstream()	2020-06-01 15:33:24 -07:00
socket.h	tipc: call tsk_set_importance from tipc_topsrv_create_listener	2020-05-28 11:11:46 -07:00
subscr.c	tipc: fix unbalanced reference counter	2018-04-12 21:46:10 -04:00
subscr.h	tipc: fix failed service subscription deletion	2020-05-13 12:33:19 -07:00
sysctl.c	tipc: enable broadcast retrans via unicast	2020-05-26 15:16:52 -07:00
topsrv.c	tipc: call tsk_set_importance from tipc_topsrv_create_listener	2020-05-28 11:11:46 -07:00
topsrv.h	tipc: rename tipc_server to tipc_topsrv	2018-02-16 15:26:34 -05:00
trace.c	tipc: remove unneeded semicolon in trace.c	2019-01-17 22:04:43 -08:00
trace.h	tipc: add support for broadcast rcv stats dumping	2020-05-26 15:16:52 -07:00
udp_media.c	tipc: block BH before using dst_cache	2020-05-22 15:39:00 -07:00
udp_media.h	tipc: implement configuration of UDP media MTU	2018-04-20 11:04:05 -04:00