Evolution-X-Devices/kernel_google_wahoo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
fa793e7ae17aa5750419aa38af19987a0b0c98e7
kernel_google_wahoo/net/sched
History
Taehee Yoo a3d0caf72b sch_dsmark: fix a NULL deref in qdisc_reset() 
[ Upstream commit 9b76eade16423ef06829cccfe3e100cfce31afcd ]

If Qdisc_ops->init() is failed, Qdisc_ops->reset() would be called.
When dsmark_init(Qdisc_ops->init()) is failed, it possibly doesn't
initialize dsmark_qdisc_data->q. But dsmark_reset(Qdisc_ops->reset())
uses dsmark_qdisc_data->q pointer wihtout any null checking.
So, panic would occur.

Test commands:
    sysctl net.core.default_qdisc=dsmark -w
    ip link add dummy0 type dummy
    ip link add vw0 link dummy0 type virt_wifi
    ip link set vw0 up

Splat looks like:
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 3 PID: 684 Comm: ip Not tainted 5.12.0+ #910
RIP: 0010:qdisc_reset+0x2b/0x680
Code: 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 41 57 41 56 41 55 41 54
55 48 89 fd 48 83 c7 18 53 48 89 fa 48 c1 ea 03 48 83 ec 20 <80> 3c 02
00 0f 85 09 06 00 00 4c 8b 65 18 0f 1f 44 00 00 65 8b 1d
RSP: 0018:ffff88800fda6bf8 EFLAGS: 00010282
RAX: dffffc0000000000 RBX: ffff8880050ed800 RCX: 0000000000000000
RDX: 0000000000000003 RSI: ffffffff99e34100 RDI: 0000000000000018
RBP: 0000000000000000 R08: fffffbfff346b553 R09: fffffbfff346b553
R10: 0000000000000001 R11: fffffbfff346b552 R12: ffffffffc0824940
R13: ffff888109e83800 R14: 00000000ffffffff R15: ffffffffc08249e0
FS:  00007f5042287680(0000) GS:ffff888119800000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ae1f4dbd90 CR3: 0000000006760002 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ? rcu_read_lock_bh_held+0xa0/0xa0
 dsmark_reset+0x3d/0xf0 [sch_dsmark]
 qdisc_reset+0xa9/0x680
 qdisc_destroy+0x84/0x370
 qdisc_create_dflt+0x1fe/0x380
 attach_one_default_qdisc.constprop.41+0xa4/0x180
 dev_activate+0x4d5/0x8c0
 ? __dev_open+0x268/0x390
 __dev_open+0x270/0x390

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-03 08:22:09 +02:00
..
act_api.c
net: avoid potential infinite loop in tc_ctl_action()
2019-10-29 09:13:22 +01:00
act_bpf.c
net/sched: fix NULL dereference in the error path of tcf_bpf_init()
2018-04-13 19:50:25 +02:00
act_connmark.c
act_connmark: avoid crashing on malformed nlattrs with null parms
2017-03-22 12:04:16 +01:00
act_csum.c
sched: act_csum: don't mangle TCP and UDP GSO packets
2018-03-22 09:23:22 +01:00
act_gact.c
net_sched: act_gact: remove spinlock in fast path
2015-07-08 13:50:42 -07:00
act_ipt.c
net: sched: fix NULL pointer dereference when action calls some targets
2017-08-30 10:19:21 +02:00
act_mirred.c
net_sched: close another race condition in tcf_mirred_release()
2017-05-02 21:19:49 -07:00
act_nat.c
bpf: try harder on clones when writing into skb
2016-07-11 09:31:12 -07:00
act_pedit.c
net/sched: act_pedit: fix WARN() in the traffic path
2019-11-28 18:25:26 +01:00
act_police.c
sched: fix act file names in header comment
2014-11-06 15:04:41 -05:00
act_simple.c
net: sched: add percpu stats to actions
2015-07-08 13:50:41 -07:00
act_skbedit.c
net: sched: add percpu stats to actions
2015-07-08 13:50:41 -07:00
act_vlan.c
net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions
2016-11-15 07:46:37 +01:00
cls_api.c
net, sched: fix soft lockup in tc_classify
2017-01-15 13:41:34 +01:00
cls_basic.c
net, sched: respect rcu grace period on cls destruction
2016-12-10 19:07:23 +01:00
cls_bpf.c
cls_bpf: reset class and reuse major in da
2020-05-10 10:26:18 +02:00
cls_cgroup.c
net, sched: respect rcu grace period on cls destruction
2016-12-10 19:07:23 +01:00
cls_flow.c
net, sched: respect rcu grace period on cls destruction
2016-12-10 19:07:23 +01:00
cls_flower.c
net_sched: flower: Avoid dissection of unmasked keys
2020-05-10 10:26:21 +02:00
cls_fw.c
net: revert "net_sched: move tp->root allocation into fw_init()"
2015-09-24 14:33:30 -07:00
cls_route.c
net_sched: cls_route: remove the right filter from hashtable
2020-04-02 19:02:33 +02:00
cls_rsvp6.c
…
cls_rsvp.c
…
cls_rsvp.h
cls_rsvp: fix rsvp_policy
2020-02-14 16:29:54 -05:00
cls_tcindex.c
net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
2021-01-30 13:25:57 +01:00
cls_u32.c
net: sched: Fix memory exposure from short TCA_U32_SEL
2019-10-29 09:13:32 +01:00
em_canid.c
net: sched: remove tcf_proto from ematch calls
2014-10-06 18:02:32 -04:00
em_cmp.c
…
em_ipset.c
netfilter: x_tables: Pass struct net in xt_action_param
2015-09-18 21:58:14 +02:00
em_meta.c
net_sched: em_meta: use skb_to_full_sk() helper
2015-11-08 20:56:39 -05:00
em_nbyte.c
net: sched: remove tcf_proto from ematch calls
2014-10-06 18:02:32 -04:00
em_text.c
net: Remove state argument from skb_find_text()
2015-02-22 15:59:54 -05:00
em_u32.c
…
ematch.c
net_sched: ematch: reject invalid TCF_EM_SIMPLE
2020-02-05 13:03:37 +00:00
Kconfig
net: add CONFIG_NET_INGRESS to enable ingress filtering
2015-05-14 01:10:05 -04:00
Makefile
tc: introduce Flower classifier
2015-05-13 15:19:48 -04:00
sch_api.c
net_sched: reject silly cell_log in qdisc_get_rtab()
2021-02-10 09:07:25 +01:00
sch_atm.c
net: sched: consolidate tc_classify{,_compat}
2015-08-27 14:18:48 -07:00
sch_blackhole.c
net_sched: blackhole: tell upper qdisc about dropped packets
2018-07-22 14:25:53 +02:00
sch_cbq.c
sch_cbq: validate TCA_CBQ_WRROPT to avoid crash
2019-10-07 21:01:06 +02:00
sch_choke.c
net: sched: validate stab values
2021-03-30 14:45:01 +02:00
sch_codel.c
net: sched: Fix a possible null-pointer dereference in dequeue_func()
2019-08-11 12:20:45 +02:00
sch_drr.c
sch_drr: update backlog as well
2020-05-10 10:25:57 +02:00
sch_dsmark.c
sch_dsmark: fix a NULL deref in qdisc_reset()
2021-06-03 08:22:09 +02:00
sch_fifo.c
net_sched: fix pfifo_head_drop behavior vs backlog
2016-07-11 09:31:11 -07:00
sch_fq_codel.c
fq_codel: return non zero qlen in class dumps
2020-05-10 10:26:29 +02:00
sch_fq.c
net: Revert "pkt_sched: fq: use proper locking in fq_dump_stats()"
2020-06-29 20:07:57 -04:00
sch_generic.c
net: sched: export __netdev_watchdog_up()
2020-06-29 20:07:57 -04:00
sch_gred.c
net: sched: validate stab values
2021-03-30 14:45:01 +02:00
sch_hfsc.c
sch_hfsc: always keep backlog updated
2020-05-10 10:25:57 +02:00
sch_hhf.c
net/flow_dissector: switch to siphash
2019-11-10 11:21:14 +01:00
sch_htb.c
sch_htb: fix crash on init failure
2018-09-15 09:40:41 +02:00
sch_ingress.c
net: sched: further simplify handle_ing
2015-05-11 11:10:35 -04:00
sch_mq.c
net: sched: fix tc -s class show no bstats on class with nolock subqueues
2019-12-05 15:27:16 +01:00
sch_mqprio.c
net: sched: fix tc -s class show no bstats on class with nolock subqueues
2019-12-05 15:27:16 +01:00
sch_multiq.c
net: sched: fix tc -s class show no bstats on class with nolock subqueues
2019-12-05 15:27:16 +01:00
sch_netem.c
sch_netem: fix rcu splat in netem_enqueue()
2019-11-06 12:09:24 +01:00
sch_pie.c
net_sched: update hierarchical backlog too
2016-05-18 17:06:39 -07:00
sch_plug.c
net: sched: drop all special handling of tx_queue_len == 0
2015-08-18 11:55:08 -07:00
sch_prio.c
sch_prio: update backlog as well
2020-05-10 10:25:57 +02:00
sch_qfq.c
sch_qfq: keep backlog updated with qlen
2020-05-10 10:25:58 +02:00
sch_red.c
net: sched: validate stab values
2021-03-30 14:45:01 +02:00
sch_sfb.c
sch_sfb: keep backlog updated with qlen
2020-05-10 10:25:58 +02:00
sch_sfq.c
net: sched: validate stab values
2021-03-30 14:45:01 +02:00
sch_tbf.c
sch_tbf: update backlog as well
2020-05-10 10:25:58 +02:00
sch_teql.c
net: sched: sch_teql: fix null-pointer dereference
2021-04-16 12:00:21 +02:00