David Ahern
da96786e26
net: tcp: check skb is non-NULL for exact match on lookups
Andrey reported the following error report while running the syzkaller
fuzzer:
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 648 Comm: syz-executor Not tainted 4.9.0-rc3+ #333
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff8800398c4480 task.stack: ffff88003b468000
RIP: 0010:[<ffffffff83091106>] [< inline >]
inet_exact_dif_match include/net/tcp.h:808
RIP: 0010:[<ffffffff83091106>] [<ffffffff83091106>]
__inet_lookup_listener+0xb6/0x500 net/ipv4/inet_hashtables.c:219
RSP: 0018:ffff88003b46f270 EFLAGS: 00010202
RAX: 0000000000000004 RBX: 0000000000004242 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffc90000e3c000 RDI: 0000000000000054
RBP: ffff88003b46f2d8 R08: 0000000000004000 R09: ffffffff830910e7
R10: 0000000000000000 R11: 000000000000000a R12: ffffffff867fa0c0
R13: 0000000000004242 R14: 0000000000000003 R15: dffffc0000000000
FS: 00007fb135881700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020cc3000 CR3: 000000006d56a000 CR4: 00000000000006f0
Stack:
0000000000000000 000000000601a8c0 0000000000000000 ffffffff00004242
424200003b9083c2 ffff88003def4041 ffffffff84e7e040 0000000000000246
ffff88003a0911c0 0000000000000000 ffff88003a091298 ffff88003b9083ae
Call Trace:
[<ffffffff831100f4>] tcp_v4_send_reset+0x584/0x1700 net/ipv4/tcp_ipv4.c:643
[<ffffffff83115b1b>] tcp_v4_rcv+0x198b/0x2e50 net/ipv4/tcp_ipv4.c:1718
[<ffffffff83069d22>] ip_local_deliver_finish+0x332/0xad0
net/ipv4/ip_input.c:216
...
MD5 has a code path that calls __inet_lookup_listener with a null skb,
so inet{6}_exact_dif_match needs to check skb against null before pulling
the flag.
Fixes: a04a480d43 ("net: Require exact match for TCP socket lookups if
dif is l3mdev")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-03 16:05:44 -04:00
..
2016-10-17 16:26:29 +01:00
2016-10-29 16:23:48 -04:00
2016-10-29 12:00:39 -04:00
2016-10-22 17:08:07 -04:00
2016-10-24 14:18:14 +02:00
2016-10-17 15:27:27 -07:00
2016-10-15 10:03:15 -07:00
2016-10-20 16:35:50 +02:00
2016-10-20 20:10:17 +02:00
2016-10-15 10:03:15 -07:00
2016-10-14 17:23:33 -07:00
2016-10-29 15:03:14 -04:00
2016-10-15 10:03:15 -07:00
2016-10-26 15:45:38 +10:00
2016-10-20 15:51:28 +11:00
2016-11-03 16:05:44 -04:00
2016-10-16 11:02:31 +02:00
2016-10-27 18:43:43 -07:00
2016-10-24 19:13:20 -07:00
2016-10-27 09:27:57 -07:00
2016-10-20 14:32:22 -04:00
2016-10-19 11:36:22 -06:00
2016-10-28 11:06:25 +02:00
2016-10-15 10:03:15 -07:00
2016-10-26 17:31:23 -04:00
2016-10-17 09:50:56 -07:00
2016-10-20 13:27:47 +02:00