• E
    net/neigh: fix NULL deref in pneigh_dump_table() · aab456df
    Eric Dumazet 提交于
    pneigh can have NULL device pointer, so we need to make
    neigh_master_filtered() and neigh_ifindex_filtered() more robust.
    
    syzbot report :
    
    kasan: CONFIG_KASAN_INLINE enabled
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] PREEMPT SMP KASAN
    CPU: 0 PID: 15867 Comm: syz-executor2 Not tainted 4.19.0+ #276
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    RIP: 0010:__read_once_size include/linux/compiler.h:179 [inline]
    RIP: 0010:list_empty include/linux/list.h:203 [inline]
    RIP: 0010:netdev_master_upper_dev_get+0xa1/0x250 net/core/dev.c:6467
    RSP: 0018:ffff8801bfaf7220 EFLAGS: 00010202
    RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90005e92000
    RDX: 0000000000000016 RSI: ffffffff860b44d9 RDI: 0000000000000005
    RBP: ffff8801bfaf72b0 R08: ffff8801c4c84080 R09: fffffbfff139a580
    R10: fffffbfff139a580 R11: ffffffff89cd2c07 R12: 1ffff10037f5ee45
    R13: 0000000000000000 R14: ffff8801bfaf7288 R15: 00000000000000b0
    FS:  00007f65cc68d700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000001b33a21000 CR3: 00000001c6116000 CR4: 00000000001406f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     neigh_master_filtered net/core/neighbour.c:2367 [inline]
     pneigh_dump_table net/core/neighbour.c:2456 [inline]
     neigh_dump_info+0x7a9/0x1ce0 net/core/neighbour.c:2577
     netlink_dump+0x606/0x1080 net/netlink/af_netlink.c:2244
     __netlink_dump_start+0x59a/0x7c0 net/netlink/af_netlink.c:2352
     netlink_dump_start include/linux/netlink.h:216 [inline]
     rtnetlink_rcv_msg+0x809/0xc20 net/core/rtnetlink.c:4898
     netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477
     rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4953
     netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
     netlink_unicast+0x5a5/0x760 net/netlink/af_netlink.c:1336
     netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1917
     sock_sendmsg_nosec net/socket.c:621 [inline]
     sock_sendmsg+0xd5/0x120 net/socket.c:631
     sock_write_iter+0x35e/0x5c0 net/socket.c:900
     call_write_iter include/linux/fs.h:1808 [inline]
     new_sync_write fs/read_write.c:474 [inline]
     __vfs_write+0x6b8/0x9f0 fs/read_write.c:487
     vfs_write+0x1fc/0x560 fs/read_write.c:549
     ksys_write+0x101/0x260 fs/read_write.c:598
     __do_sys_write fs/read_write.c:610 [inline]
     __se_sys_write fs/read_write.c:607 [inline]
     __x64_sys_write+0x73/0xb0 fs/read_write.c:607
     do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
     entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x457569
    
    Fixes: 6f52f80e ("net/neigh: Extend dump filter to proxy neighbor dumps")
    Signed-off-by: NEric Dumazet <edumazet@google.com>
    Cc: David Ahern <dsahern@gmail.com>
    Reported-by: Nsyzbot <syzkaller@googlegroups.com>
    Reviewed-by: NDavid Ahern <dsahern@gmail.com>
    Tested-by: NDavid Ahern <dsahern@gmail.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    aab456df
neighbour.c 83.3 KB