Wei Wang 7bbfe00e02 ipv6: fix general protection fault in fib6_add() ... In fib6_add(), pn could be NULL if fib6_add_1() failed to return a fib6 node. Checking pn != fn before accessing pn->leaf makes sure pn is not NULL. This fixes the following GPF reported by syzkaller: general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 3201 Comm: syzkaller001778 Not tainted 4.15.0-rc5+ #151 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:fib6_add+0x736/0x15a0 net/ipv6/ip6_fib.c:1244 RSP: 0018:ffff8801c7626a70 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000020 RCX: ffffffff84794465 RDX: 0000000000000004 RSI: ffff8801d38935f0 RDI: 0000000000000282 RBP: ffff8801c7626da0 R08: 1ffff10038ec4c35 R09: 0000000000000000 R10: ffff8801c7626c68 R11: 0000000000000000 R12: 00000000fffffffe R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000009 FS: 0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:0000000009b70840 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000020be1000 CR3: 00000001d585a006 CR4: 00000000001606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __ip6_ins_rt+0x6c/0x90 net/ipv6/route.c:1006 ip6_route_multipath_add+0xd14/0x16c0 net/ipv6/route.c:3833 inet6_rtm_newroute+0xdc/0x160 net/ipv6/route.c:3957 rtnetlink_rcv_msg+0x733/0x1020 net/core/rtnetlink.c:4411 netlink_rcv_skb+0x21e/0x460 net/netlink/af_netlink.c:2408 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4423 netlink_unicast_kernel net/netlink/af_netlink.c:1275 [inline] netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1301 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1864 sock_sendmsg_nosec net/socket.c:636 [inline] sock_sendmsg+0xca/0x110 net/socket.c:646 sock_write_iter+0x31a/0x5d0 net/socket.c:915 call_write_iter include/linux/fs.h:1772 [inline] do_iter_readv_writev+0x525/0x7f0 fs/read_write.c:653 do_iter_write+0x154/0x540 fs/read_write.c:932 compat_writev+0x225/0x420 fs/read_write.c:1246 do_compat_writev+0x115/0x220 fs/read_write.c:1267 C_SYSC_writev fs/read_write.c:1278 [inline] compat_SyS_writev+0x26/0x30 fs/read_write.c:1274 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 Reported-by: syzbot <syzkaller@googlegroups.com> Fixes: 66f5d6ce53 ("ipv6: replace rwlock with rcu and spinlock in fib6_table") Signed-off-by: Wei Wang <weiwan@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-01-04 14:29:20 -05:00
..
ila	ila: Add a hook type for LWT routes	2017-11-08 11:20:49 +09:00
netfilter	netfilter: ip6t_MASQUERADE: add dependency on conntrack module	2017-12-11 17:04:50 +01:00
addrconf_core.c
addrconf.c	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
addrlabel.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
af_inet6.c	net: reevalulate autoflowlabel setting after sysctl setting	2017-12-21 13:07:20 -05:00
ah6.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
anycast.c
calipso.c
datagram.c
esp6_offload.c
esp6.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
exthdrs_core.c
exthdrs_offload.c
exthdrs.c
fib6_notifier.c
fib6_rules.c
fou6.c
icmp.c
inet6_connection_sock.c
inet6_hashtables.c
ip6_checksum.c
ip6_fib.c	ipv6: fix general protection fault in fib6_add()	2018-01-04 14:29:20 -05:00
ip6_flowlabel.c	treewide: Switch DEFINE_TIMER callbacks to struct timer_list *	2017-11-21 15:57:05 -08:00
ip6_gre.c	ip6_gre: fix device features for ioctl setup	2017-12-26 12:21:19 -05:00
ip6_icmp.c
ip6_input.c
ip6_offload.c
ip6_offload.h
ip6_output.c	net: reevalulate autoflowlabel setting after sysctl setting	2017-12-21 13:07:20 -05:00
ip6_tunnel.c	ip6_tunnel: allow ip6gre dev mtu to be set below 1280	2018-01-02 12:36:14 -05:00
ip6_udp_tunnel.c
ip6_vti.c
ip6mr.c	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
ipcomp6.c
ipv6_sockglue.c	net: reevalulate autoflowlabel setting after sysctl setting	2017-12-21 13:07:20 -05:00
Kconfig
Makefile
mcast_snoop.c
mcast.c	ipv6: mcast: better catch silly mtu values	2017-12-13 13:13:15 -05:00
mip6.c
ndisc.c	net: ipv6: sysctl to specify IPv6 ND traffic class	2017-11-11 15:13:02 +09:00
netfilter.c
output_core.c	net: accept UFO datagrams from tuntap and packet	2017-11-24 01:37:35 +09:00
ping.c
proc.c
protocol.c
raw.c
reassembly.c
route.c	ipv6: Honor specified parameters in fibmatch lookup	2017-12-21 11:51:06 -05:00
seg6_hmac.c
seg6_iptunnel.c
seg6_local.c
seg6.c
sit.c	sit: update frag_off info	2017-11-30 10:25:41 -05:00
syncookies.c
sysctl_net_ipv6.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
tcp_ipv6.c	tcp md5sig: Use skb's saddr when replying to an incoming segment	2017-12-12 11:15:42 -05:00
tcpv6_offload.c
tunnel6.c
udp_impl.h
udp_offload.c	net: accept UFO datagrams from tuntap and packet	2017-11-24 01:37:35 +09:00
udp.c
udplite.c
xfrm6_input.c	xfrm: Reinject transport-mode packets through tasklet	2017-12-19 08:23:21 +01:00
xfrm6_mode_beet.c
xfrm6_mode_ro.c
xfrm6_mode_transport.c
xfrm6_mode_tunnel.c
xfrm6_output.c
xfrm6_policy.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c	xfrm6_tunnel: exit_net cleanup check added	2017-11-14 15:46:17 +09:00