Pavel Tikhomirov 1ffbc7ea91 net: sched: sch_teql: fix null-pointer dereference ... Reproduce: modprobe sch_teql tc qdisc add dev teql0 root teql0 This leads to (for instance in Centos 7 VM) OOPS: [ 532.366633] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 [ 532.366733] IP: [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.366825] PGD 80000001376d5067 PUD 137e37067 PMD 0 [ 532.366906] Oops: 0000 [#1] SMP [ 532.366987] Modules linked in: sch_teql ... [ 532.367945] CPU: 1 PID: 3026 Comm: tc Kdump: loaded Tainted: G ------------ T 3.10.0-1062.7.1.el7.x86_64 #1 [ 532.368041] Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.2 04/01/2014 [ 532.368125] task: ffff8b7d37d31070 ti: ffff8b7c9fdbc000 task.ti: ffff8b7c9fdbc000 [ 532.368224] RIP: 0010:[<ffffffffc06124a8>] [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.368320] RSP: 0018:ffff8b7c9fdbf8e0 EFLAGS: 00010286 [ 532.368394] RAX: ffffffffc0612490 RBX: ffff8b7cb1565e00 RCX: ffff8b7d35ba2000 [ 532.368476] RDX: ffff8b7d35ba2000 RSI: 0000000000000000 RDI: ffff8b7cb1565e00 [ 532.368557] RBP: ffff8b7c9fdbf8f8 R08: ffff8b7d3fd1f140 R09: ffff8b7d3b001600 [ 532.368638] R10: ffff8b7d3b001600 R11: ffffffff84c7d65b R12: 00000000ffffffd8 [ 532.368719] R13: 0000000000008000 R14: ffff8b7d35ba2000 R15: ffff8b7c9fdbf9a8 [ 532.368800] FS: 00007f6a4e872740(0000) GS:ffff8b7d3fd00000(0000) knlGS:0000000000000000 [ 532.368885] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 532.368961] CR2: 00000000000000a8 CR3: 00000001396ee000 CR4: 00000000000206e0 [ 532.369046] Call Trace: [ 532.369159] [<ffffffff84c8192e>] qdisc_create+0x36e/0x450 [ 532.369268] [<ffffffff846a9b49>] ? ns_capable+0x29/0x50 [ 532.369366] [<ffffffff849afde2>] ? nla_parse+0x32/0x120 [ 532.369442] [<ffffffff84c81b4c>] tc_modify_qdisc+0x13c/0x610 [ 532.371508] [<ffffffff84c693e7>] rtnetlink_rcv_msg+0xa7/0x260 [ 532.372668] [<ffffffff84907b65>] ? sock_has_perm+0x75/0x90 [ 532.373790] [<ffffffff84c69340>] ? rtnl_newlink+0x890/0x890 [ 532.374914] [<ffffffff84c8da7b>] netlink_rcv_skb+0xab/0xc0 [ 532.376055] [<ffffffff84c63708>] rtnetlink_rcv+0x28/0x30 [ 532.377204] [<ffffffff84c8d400>] netlink_unicast+0x170/0x210 [ 532.378333] [<ffffffff84c8d7a8>] netlink_sendmsg+0x308/0x420 [ 532.379465] [<ffffffff84c2f3a6>] sock_sendmsg+0xb6/0xf0 [ 532.380710] [<ffffffffc034a56e>] ? __xfs_filemap_fault+0x8e/0x1d0 [xfs] [ 532.381868] [<ffffffffc034a75c>] ? xfs_filemap_fault+0x2c/0x30 [xfs] [ 532.383037] [<ffffffff847ec23a>] ? __do_fault.isra.61+0x8a/0x100 [ 532.384144] [<ffffffff84c30269>] ___sys_sendmsg+0x3e9/0x400 [ 532.385268] [<ffffffff847f3fad>] ? handle_mm_fault+0x39d/0x9b0 [ 532.386387] [<ffffffff84d88678>] ? __do_page_fault+0x238/0x500 [ 532.387472] [<ffffffff84c31921>] __sys_sendmsg+0x51/0x90 [ 532.388560] [<ffffffff84c31972>] SyS_sendmsg+0x12/0x20 [ 532.389636] [<ffffffff84d8dede>] system_call_fastpath+0x25/0x2a [ 532.390704] [<ffffffff84d8de21>] ? system_call_after_swapgs+0xae/0x146 [ 532.391753] Code: 00 00 00 00 00 00 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 53 48 8b b7 48 01 00 00 48 89 fb <48> 8b 8e a8 00 00 00 48 85 c9 74 43 48 89 ca eb 0f 0f 1f 80 00 [ 532.394036] RIP [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql] [ 532.395127] RSP <ffff8b7c9fdbf8e0> [ 532.396179] CR2: 00000000000000a8 Null pointer dereference happens on master->slaves dereference in teql_destroy() as master is null-pointer. When qdisc_create() calls teql_qdisc_init() it imediately fails after check "if (m->dev == dev)" because both devices are teql0, and it does not set qdisc_priv(sch)->m leaving it zero on error path, then qdisc_create() imediately calls teql_destroy() which does not expect zero master pointer and we get OOPS. Fixes: 87b60cfacf ("net_sched: fix error recovery at qdisc creation") Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2021-04-08 14:14:42 -07:00
..
6lowpan
9p	net: 9p: advance iov on empty read	2021-03-03 16:57:59 -08:00
802
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-01-14 18:34:50 -08:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-02-12 16:40:28 -08:00
atm	net: atm: pppoatm: use new API for wakeup tasklet	2021-01-29 18:24:05 -08:00
ax25
batman-adv	batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field	2021-04-05 15:06:03 -07:00
bluetooth	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kern	2021-02-11 14:59:01 -08:00
bpf	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-01-20 12:16:11 -08:00
bpfilter	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
bridge	net: bridge: don't notify switchdev for local FDB addresses	2021-03-23 14:39:41 -07:00
caif	net: caif: Use netif_rx_any_context().	2021-02-15 13:21:48 -08:00
can	can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE	2021-03-29 09:51:43 +02:00
ceph	libceph: remove osdtimeout option entirely	2021-02-16 12:09:52 +01:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2021-04-08 14:10:53 -07:00
dcb	net: dcb: use obj-$(CONFIG_DCB) form in net/Makefile	2021-01-27 17:03:52 -08:00
dccp	ipv6: weaken the v4mapped source check	2021-03-18 11:19:23 -07:00
decnet	net: decnet: fix netdev refcount leaking on error path	2021-01-27 17:33:46 -08:00
dns_resolver	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
dsa	net: dsa: Fix type was not set for devlink port	2021-03-29 13:49:04 -07:00
ethernet	net: datagram: fix some kernel-doc markups	2020-11-17 14:15:03 -08:00
ethtool	ethtool: Add lanes parameter for ETHTOOL_LINK_MODE_10000baseR_FEC_BIT	2021-04-07 14:53:04 -07:00
hsr	net: hsr: Reset MAC header for Tx path	2021-04-07 14:25:12 -07:00
ieee802154	net: ieee802154: stop dump llsec params for monitors	2021-04-06 22:34:38 +02:00
ife	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
ipv4	ipv6: report errors for iftoken via netlink extack	2021-04-08 13:52:36 -07:00
ipv6	ipv6: report errors for iftoken via netlink extack	2021-04-08 13:52:36 -07:00
iucv	net/af_iucv: build SG skbs for TRANS_HIPER sockets	2021-01-28 20:36:22 -08:00
kcm	net: group skb_shinfo zerocopy related bits together.	2021-01-07 16:08:37 -08:00
key	af_key: relax availability checks for skb size calculation	2021-01-04 10:05:50 +01:00
l2tp	net: l2tp: reduce log level of messages in receive path, add counter instead	2021-03-03 16:55:02 -08:00
l3mdev	net: l3mdev: use obj-$(CONFIG_NET_L3_MASTER_DEV) form in net/Makefile	2021-01-27 17:03:52 -08:00
lapb	net: lapb: Copy the skb before sending a packet	2021-02-02 08:40:48 -08:00
llc	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
mac80211	mac80211: fix time-is-after bug in mlme	2021-04-08 10:14:53 +02:00
mac802154	net: mac802154: Fix general protection fault	2021-04-06 22:42:16 +02:00
mpls	net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0	2021-03-09 16:12:20 -08:00
mptcp	mptcp: revert "mptcp: provide subflow aware release function"	2021-04-01 16:02:50 -07:00
ncsi	net/ncsi: Avoid channel_monitor hrtimer deadlock	2021-03-30 13:16:23 -07:00
netfilter	netfilter: nftables: skip hook overlap logic if flowtable is stale	2021-03-18 01:08:54 +01:00
netlabel	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-04 15:26:57 -08:00
netlink	mptcp: avoid lock_fast usage in accept path	2021-02-12 16:31:46 -08:00
netrom
nfc	nfc: Avoid endless loops caused by repeated llcp_sock_connect()	2021-03-25 17:02:01 -07:00
nsh
openvswitch	openvswitch: fix send of uninitialized stack memory in ct limit reply	2021-04-05 12:54:42 -07:00
packet	net/packet: Improve the comment about LL header visibility criteria	2021-02-06 14:59:28 -08:00
phonet
psample	net: psample: Fix netlink skb length with tunnel info	2021-02-25 09:49:46 -08:00
qrtr	net: qrtr: Fix memory leak on qrtr_tx_wait failure	2021-03-30 13:48:29 -07:00
rds	net/rds: Avoid potential use after free in rds_send_remove_from_sock	2021-04-07 14:01:24 -07:00
rfkill	rfkill: revert back to old userspace API by default	2021-04-08 10:14:45 +02:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix dependency on IPv6 in udp tunnel config	2021-02-12 16:42:05 -08:00
sched	net: sched: sch_teql: fix null-pointer dereference	2021-04-08 14:14:42 -07:00
sctp	net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()	2021-04-05 12:56:52 -07:00
smc	net/smc: use memcpy instead of snprintf to avoid out of bounds read	2021-01-12 20:22:01 -08:00
strparser
sunrpc	Miscellaneous NFSD fixes for v5.12-rc.	2021-03-16 10:22:50 -07:00
switchdev	net: bridge: propagate extack through switchdev_port_attr_set	2021-02-14 17:38:11 -08:00
tipc	net: tipc: Fix spelling errors in net/tipc module	2021-04-07 14:29:29 -07:00
tls	net/tls: Select SOCK_RX_QUEUE_MAPPING from TLS_DEVICE	2021-02-11 19:08:06 -08:00
unix	af_unix: handle idmapped mounts	2021-01-24 14:27:18 +01:00
vmw_vsock	selinux: vsock: Set SID for socket returned by accept()	2021-03-19 13:46:55 -07:00
wireless	nl80211: fix beacon head validation	2021-04-08 16:43:05 +02:00
x25	net: x25: Remove unimplemented X.25-over-LLC code stubs	2020-12-12 17:15:33 -08:00
xdp	xsk: Fold xp_assign_dev and __xp_assign_dev	2021-01-25 23:56:33 +01:00
xfrm	xfrm/compat: Cleanup WARN()s that can be user-triggered	2021-03-30 07:29:09 +02:00
compat.c	iov_iter: transparently handle compat iovecs in import_iovec	2020-10-03 00:02:13 -04:00
devres.c
Kconfig	net/sock: Add kernel config SOCK_RX_QUEUE_MAPPING	2021-02-11 19:08:06 -08:00
Makefile	net: l3mdev: use obj-$(CONFIG_NET_L3_MASTER_DEV) form in net/Makefile	2021-01-27 17:03:52 -08:00
socket.c	io_uring-worker.v3-2021-02-25	2021-02-27 08:29:02 -08:00
sysctl_net.c