Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1587428
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 10/32] vxlan: fix oops in dev_fill_metadata_dst |
| Date | 2017-02-24 10:00 +0100 |
| Message-ID | <tejTk-66Y-37@gated-at.bofh.it> (permalink) |
| References | <tejzY-5Xe-19@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 22f0708a718daea5e79de2d29b4829de016a4ff4 ]
Since the commit 0c1d70af924b ("net: use dst_cache for vxlan device")
vxlan_fill_metadata_dst() calls vxlan_get_route() passing a NULL
dst_cache pointer, so the latter should explicitly check for
valid dst_cache ptr. Unfortunately the commit d71785ffc7e7 ("net: add
dst_cache to ovs vxlan lwtunnel") removed said check.
As a result is possible to trigger a null pointer access calling
vxlan_fill_metadata_dst(), e.g. with:
ovs-vsctl add-br ovs-br0
ovs-vsctl add-port ovs-br0 vxlan0 -- set interface vxlan0 \
type=vxlan options:remote_ip=192.168.1.1 \
options:key=1234 options:dst_port=4789 ofport_request=10
ip address add dev ovs-br0 172.16.1.2/24
ovs-vsctl set Bridge ovs-br0 ipfix=@i -- --id=@i create IPFIX \
targets=\"172.16.1.1:1234\" sampling=1
iperf -c 172.16.1.1 -u -l 1000 -b 10M -t 1 -p 1234
This commit addresses the issue passing to vxlan_get_route() the
dst_cache already available into the lwt info processed by
vxlan_fill_metadata_dst().
Fixes: d71785ffc7e7 ("net: add dst_cache to ovs vxlan lwtunnel")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/vxlan.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2449,7 +2449,8 @@ static int vxlan_fill_metadata_dst(struc
return -EINVAL;
rt = vxlan_get_route(vxlan, skb, 0, info->key.tos,
info->key.u.ipv4.dst,
- &info->key.u.ipv4.src, NULL, info);
+ &info->key.u.ipv4.src,
+ &info->dst_cache, info);
if (IS_ERR(rt))
return PTR_ERR(rt);
ip_rt_put(rt);
@@ -2459,7 +2460,8 @@ static int vxlan_fill_metadata_dst(struc
ndst = vxlan6_get_route(vxlan, skb, 0, info->key.tos,
info->key.label, &info->key.u.ipv6.dst,
- &info->key.u.ipv6.src, NULL, info);
+ &info->key.u.ipv6.src,
+ &info->dst_cache, info);
if (IS_ERR(ndst))
return PTR_ERR(ndst);
dst_release(ndst);
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 00/32] 4.9.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:40 +0100 [PATCH 4.9 27/32] goldfish: Sanitize the broken interrupt handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 23/32] USB: serial: opticon: fix CTS retrieval at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 30/32] block: fix double-free in the failure path of cgwb_bdi_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 13/32] ip: fix IP_CHECKSUM handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 28/32] netfilter: nf_ct_helper: warn when not applying default helper assignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 31/32] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 17/32] USB: serial: cp210x: add new IDs for GE Bx50v3 boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 16/32] USB: serial: mos7840: fix another NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 25/32] USB: serial: console: fix uninitialised spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 11/32] irda: Fix lockdep annotations in hashbin_delete(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 24/32] USB: serial: ark3116: fix register-accessor error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 15/32] tty: serial: msm: Fix module autoload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 29/32] ACPICA: Linuxize: Restore and fix Intel compiler build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 32/32] xfs: clear delalloc and cache on buffered write failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 22/32] USB: serial: spcp8x5: fix modem-status handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 08/32] net: neigh: Fix netevent NETEVENT_DELAY_PROBE_TIME_UPDATE notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 26/32] x86/platform/goldfish: Prevent unconditional loading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100 [PATCH 4.9 12/32] ptr_ring: fix race conditions when resizing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 02/32] kcm: fix a null pointer dereference in kcm_sendmsg() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 07/32] packet: Do not call fanout_release from atomic contexts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 04/32] net/llc: avoid BUG_ON() in skb_orphan() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 14/32] net: socket: fix recvmmsg not returning error from sock_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 10/32] vxlan: fix oops in dev_fill_metadata_dst Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 03/32] net/mlx5e: Disable preemption when doing TC statistics upcall Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 [PATCH 4.9 19/32] USB: serial: ftdi_sio: fix extreme low-latency setting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100 Re: [PATCH 4.9 00/32] 4.9.13-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-24 18:30 +0100 Re: [PATCH 4.9 00/32] 4.9.13-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-24 19:20 +0100 Re: [PATCH 4.9 00/32] 4.9.13-stable review Alexandre Belloni <alexandre.belloni@free-electrons.com> - 2017-02-27 00:00 +0100
csiph-web