Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1721426
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.12 24/99] net: sched: fix NULL pointer dereference when action calls some targets |
| Date | 2017-08-28 11:30 +0200 |
| Message-ID | <ujowO-3Qe-27@gated-at.bofh.it> (permalink) |
| References | <ujnhn-38X-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit 4f8a881acc9d1adaf1e552349a0b1df28933a04c ]
As we know in some target's checkentry it may dereference par.entryinfo
to check entry stuff inside. But when sched action calls xt_check_target,
par.entryinfo is set with NULL. It would cause kernel panic when calling
some targets.
It can be reproduce with:
# tc qd add dev eth1 ingress handle ffff:
# tc filter add dev eth1 parent ffff: u32 match u32 0 0 action xt \
-j ECN --ecn-tcp-remove
It could also crash kernel when using target CLUSTERIP or TPROXY.
By now there's no proper value for par.entryinfo in ipt_init_target,
but it can not be set with NULL. This patch is to void all these
panics by setting it with an ipt_entry obj with all members = 0.
Note that this issue has been there since the very beginning.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/act_ipt.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -41,6 +41,7 @@ static int ipt_init_target(struct net *n
{
struct xt_tgchk_param par;
struct xt_target *target;
+ struct ipt_entry e = {};
int ret = 0;
target = xt_request_find_target(AF_INET, t->u.user.name,
@@ -52,6 +53,7 @@ static int ipt_init_target(struct net *n
memset(&par, 0, sizeof(par));
par.net = net;
par.table = table;
+ par.entryinfo = &e;
par.target = target;
par.targinfo = t->data;
par.hook_mask = hook;
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 90/99] iio: magnetometer: st_magn: fix status register address for LSM303AGR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 23/99] irda: do not leak initialized list.dev to userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 40/99] ALSA: firewire: fix NULL pointer dereference when releasing uninitialized data of iso-resource Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 38/99] ALSA: core: Fix unexpected error at replacing user TLV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 20/99] ipv6: repair fib6 tree in failure case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 44/99] ARCv2: PAE40: set MSB even if !CONFIG_ARC_HAS_PAE40 but PAE exists in SoC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 17/99] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 68/99] cifs: Fix df output for users with quota limits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 11/99] net: igmp: Use ingress interface rather than vrf device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 18/99] tipc: fix use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 13/99] ptr_ring: use kmalloc_array() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 36/99] KVM: x86: block guest protection keys unless the host has them enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 31/99] Input: ALPS - fix two-finger scroll breakage in right side on ALPS touchpad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 10/99] bpf: fix bpf_trace_printk on 32 bit archs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 93/99] iommu: Fix wrong freeing of iommu_device->dev Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 75/99] timers: Fix excessive granularity of new timers after a nohz idle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 79/99] netfilter: nat: fix src map lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 77/99] net: sunrpc: svcsock: fix NULL-pointer exception Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 99/99] powerpc/mm: Ensure cpumask update is ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 81/99] Bluetooth: hidp: fix possible might sleep error in hidp_session_thread Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 91/99] iio: magnetometer: st_magn: remove ihl property for LSM303AGR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 76/99] x86/mm: Fix use-after-free of ldt_struct Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 80/99] netfilter: nfnetlink: Improve input length sanitization in nfnetlink_rcv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 69/99] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 96/99] ntb: transport shouldnt disable link due to bogus values in SPADs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 89/99] iio: hid-sensor-trigger: Fix the race with user space powering up sensors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 73/99] ftrace: Check for null ret_stack on profile function graph entry function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 95/99] ntb: ntb_test: ensure the link is up before trying to configure the mws Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 63/99] tracing: Missing error code in tracer_alloc_buffers() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 82/99] Bluetooth: cmtp: fix possible might sleep error in cmtp_session Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 94/99] Clarify (and fix) MAX_LFS_FILESIZE macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 74/99] perf/core: Fix group {cpu,task} validation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 71/99] ring-buffer: Have ring_buffer_alloc_read_page() return error on offline CPU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 35/99] KVM, pkeys: do not use PKRU value in vcpu->arch.guest_fpu.state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 83/99] Bluetooth: bnep: fix possible might sleep error in bnep_session Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 72/99] virtio_pci: fix cpu affinity support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 97/99] ACPI: APD: Fix HID for Hisilicon Hip07/08 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 87/99] ANDROID: binder: fix proc->tsk check. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 37/99] ALSA: usb-audio: Add delay quirk for H650e/Jabra 550a USB headsets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 85/99] binder: use group leader instead of open thread Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 78/99] netfilter: expect: fix crash when putting uninited expectation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 98/99] ACPI: EC: Fix regression related to wrong ECDT initialization order Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 70/99] nfsd: Limit end of page list when decoding NFSv4 WRITE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 39/99] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 33/99] KVM: s390: sthyi: fix specification exception detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 64/99] tracing: Fix kmemleak in tracing_map_array_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 52/99] arm64: fpsimd: Prevent registers leaking across exec Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 03/99] bonding: ratelimit failed speed/duplex update warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 07/99] ipv4: fix NULL dereference in free_fib_info_rcu() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 47/99] dax: fix deadlock due to misaligned PMD faults Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 57/99] drm/atomic: If the atomic check fails, return its value first Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 45/99] PM/hibernate: touch NMI watchdog when creating snapshot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 43/99] ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 08/99] net_sched/sfq: update hierarchical backlog when drop packet Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 61/99] ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 48/99] i2c: designware: Fix system suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 66/99] RDMA/uverbs: Initialize cq_context appropriately Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 30/99] Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 46/99] mm, shmem: fix handling /sys/kernel/mm/transparent_hugepage/shmem_enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 60/99] Revert "drm/amdgpu: fix vblank_time when displays are off" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 32/99] KVM: s390: sthyi: fix sthyi inline assembly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 09/99] net_sched: remove warning from qdisc_hash_add Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 65/99] tracing: Fix freeing of filter in create_filter() when set_str is false Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 41/99] ALSA: firewire-motu: destroy stream data surely at failure of card initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 05/99] dccp: purge write queue in dccp_destroy_sock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 42/99] ARCv2: SLC: Make sure busy bit is set properly for region ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 49/99] mm/madvise.c: fix freeing of locked page with MADV_FREE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 21/99] tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 12/99] openvswitch: fix skb_panic due to the incorrect actions attrlen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 16/99] tun: handle register_netdevice() failures properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 24/99] net: sched: fix NULL pointer dereference when action calls some targets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 02/99] bonding: require speed/duplex only for 802.3ad, alb and tlb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 28/99] bpf/verifier: fix min/max handling in BPF_SUB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 26/99] bpf, verifier: add additional patterns to evaluate_reg_imm_alu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 14/99] ipv4: better IP_MAX_MTU enforcement Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 19/99] ipv6: reset fn->rr_ptr when replacing route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
Re: [PATCH 4.12 00/99] 4.12.10-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-28 21:50 +0200
Re: [PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-29 07:00 +0200
Re: [PATCH 4.12 00/99] 4.12.10-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-29 02:20 +0200
Re: [PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-29 07:00 +0200
csiph-web