AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2025-02-18 21:16:57 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
723b929ca0
linux_dsm_epyc7002/include
History
David Ahern 557c44be91 net: ipv6: RTF_PCPU should not be settable from userspace 
Andrey reported a fault in the IPv6 route code:

kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 1 PID: 4035 Comm: a.out Not tainted 4.11.0-rc7+ #250
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880069809600 task.stack: ffff880062dc8000
RIP: 0010:ip6_rt_cache_alloc+0xa6/0x560 net/ipv6/route.c:975
RSP: 0018:ffff880062dced30 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff8800670561c0 RCX: 0000000000000006
RDX: 0000000000000003 RSI: ffff880062dcfb28 RDI: 0000000000000018
RBP: ffff880062dced68 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff880062dcfb28 R14: dffffc0000000000 R15: 0000000000000000
FS:  00007feebe37e7c0(0000) GS:ffff88006cb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000205a0fe4 CR3: 000000006b5c9000 CR4: 00000000000006e0
Call Trace:
 ip6_pol_route+0x1512/0x1f20 net/ipv6/route.c:1128
 ip6_pol_route_output+0x4c/0x60 net/ipv6/route.c:1212
...

Andrey's syzkaller program passes rtmsg.rtmsg_flags with the RTF_PCPU bit
set. Flags passed to the kernel are blindly copied to the allocated
rt6_info by ip6_route_info_create making a newly inserted route appear
as though it is a per-cpu route. ip6_rt_cache_alloc sees the flag set
and expects rt->dst.from to be set - which it is not since it is not
really a per-cpu copy. The subsequent call to __ip6_dst_alloc then
generates the fault.

Fix by checking for the flag and failing with EINVAL.

Fixes: d52d3997f8 ("ipv6: Create percpu rt6_info")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-21 13:55:33 -04:00
..
acpi
asm-generic vmlinux.lds: add missing VMLINUX_SYMBOL macros 2017-04-08 00:47:48 -07:00
clocksource
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2017-04-18 09:03:50 -07:00
drm drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces 2017-03-30 11:43:39 +02:00
dt-bindings scripts/spelling.txt: add "overide" pattern and fix typo instances 2017-03-09 17:01:09 -08:00
keys KEYS: Differentiate uses of rcu_dereference_key() and user_key_payload() 2017-03-02 10:09:00 +11:00
kvm KVM: arm64: Ensure LRs are clear when they should be 2017-04-04 14:33:58 +02:00
linux ARM: SoC fixes 2017-04-16 12:38:17 -07:00
math-emu
media media fixes for v4.11-rc2 2017-03-09 15:50:56 -08:00
memory
misc
net sctp: get sock from transport in sctp_transport_update_pmtu 2017-04-05 07:20:06 -07:00
pcmcia
ras
rdma IB/core: Restore I/O MMU, s390 and powerpc support 2017-03-24 21:51:16 -04:00
rxrpc
scsi scsi: mpt3sas: Avoid sleeping in interrupt context 2017-03-01 21:52:13 -05:00
soc
sound sched/headers: Prepare to remove spurious <linux/sched.h> inclusion dependencies 2017-03-02 08:42:41 +01:00
target target: Fix ALUA transition state race between multiple initiators 2017-03-30 23:12:40 -07:00
trace There was some breakage with the changes for jump labels in the 4.11 merge 2017-03-07 09:37:28 -08:00
uapi net: ipv6: RTF_PCPU should not be settable from userspace 2017-04-21 13:55:33 -04:00
video drm/exynos/decon5433: signal frame done interrupt at front porch 2017-03-21 13:17:22 +09:00
xen Merge branch 'stable/for-linus-4.11' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb 2017-03-07 10:23:17 -08:00
Kbuild