Christoph Paasch 9410d386d0 net: Prevent invalid access to skb->prev in __qdisc_drop_all ... __qdisc_drop_all() accesses skb->prev to get to the tail of the segment-list. With commit 68d2f84a13 ("net: gro: properly remove skb from list") the skb-list handling has been changed to set skb->next to NULL and set the list-poison on skb->prev. With that change, __qdisc_drop_all() will panic when it tries to dereference skb->prev. Since commit 992cba7e27 ("net: Add and use skb_list_del_init().") __list_del_entry is used, leaving skb->prev unchanged (thus, pointing to the list-head if it's the first skb of the list). This will make __qdisc_drop_all modify the next-pointer of the list-head and result in a panic later on: [ 34.501053] general protection fault: 0000 [#1] SMP KASAN PTI [ 34.501968] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.20.0-rc2.mptcp #108 [ 34.502887] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011 [ 34.504074] RIP: 0010:dev_gro_receive+0x343/0x1f90 [ 34.504751] Code: e0 48 c1 e8 03 42 80 3c 30 00 0f 85 4a 1c 00 00 4d 8b 24 24 4c 39 65 d0 0f 84 0a 04 00 00 49 8d 7c 24 38 48 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 04 [ 34.507060] RSP: 0018:ffff8883af507930 EFLAGS: 00010202 [ 34.507761] RAX: 0000000000000007 RBX: ffff8883970b2c80 RCX: 1ffff11072e165a6 [ 34.508640] RDX: 1ffff11075867008 RSI: ffff8883ac338040 RDI: 0000000000000038 [ 34.509493] RBP: ffff8883af5079d0 R08: ffff8883970b2d40 R09: 0000000000000062 [ 34.510346] R10: 0000000000000034 R11: 0000000000000000 R12: 0000000000000000 [ 34.511215] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8883ac338008 [ 34.512082] FS: 0000000000000000(0000) GS:ffff8883af500000(0000) knlGS:0000000000000000 [ 34.513036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.513741] CR2: 000055ccc3e9d020 CR3: 00000003abf32000 CR4: 00000000000006e0 [ 34.514593] Call Trace: [ 34.514893] <IRQ> [ 34.515157] napi_gro_receive+0x93/0x150 [ 34.515632] receive_buf+0x893/0x3700 [ 34.516094] ? __netif_receive_skb+0x1f/0x1a0 [ 34.516629] ? virtnet_probe+0x1b40/0x1b40 [ 34.517153] ? __stable_node_chain+0x4d0/0x850 [ 34.517684] ? kfree+0x9a/0x180 [ 34.518067] ? __kasan_slab_free+0x171/0x190 [ 34.518582] ? detach_buf+0x1df/0x650 [ 34.519061] ? lapic_next_event+0x5a/0x90 [ 34.519539] ? virtqueue_get_buf_ctx+0x280/0x7f0 [ 34.520093] virtnet_poll+0x2df/0xd60 [ 34.520533] ? receive_buf+0x3700/0x3700 [ 34.521027] ? qdisc_watchdog_schedule_ns+0xd5/0x140 [ 34.521631] ? htb_dequeue+0x1817/0x25f0 [ 34.522107] ? sch_direct_xmit+0x142/0xf30 [ 34.522595] ? virtqueue_napi_schedule+0x26/0x30 [ 34.523155] net_rx_action+0x2f6/0xc50 [ 34.523601] ? napi_complete_done+0x2f0/0x2f0 [ 34.524126] ? kasan_check_read+0x11/0x20 [ 34.524608] ? _raw_spin_lock+0x7d/0xd0 [ 34.525070] ? _raw_spin_lock_bh+0xd0/0xd0 [ 34.525563] ? kvm_guest_apic_eoi_write+0x6b/0x80 [ 34.526130] ? apic_ack_irq+0x9e/0xe0 [ 34.526567] __do_softirq+0x188/0x4b5 [ 34.527015] irq_exit+0x151/0x180 [ 34.527417] do_IRQ+0xdb/0x150 [ 34.527783] common_interrupt+0xf/0xf [ 34.528223] </IRQ> This patch makes sure that skb->prev is set to NULL when entering netem_enqueue. Cc: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp> Cc: Tyler Hicks <tyhicks@canonical.com> Cc: Eric Dumazet <eric.dumazet@gmail.com> Fixes: 68d2f84a13 ("net: gro: properly remove skb from list") Suggested-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Christoph Paasch <cpaasch@apple.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-11-29 16:27:27 -08:00
..
act_api.c	net: Add extack to nlmsg_parse	2018-10-08 10:39:04 -07:00
act_bpf.c	Revert "net: sched: act: add extack for lookup callback"	2018-08-31 22:50:15 -07:00
act_connmark.c	net_sched: add missing tcf_lock for act_connmark	2018-08-31 22:57:43 -07:00
act_csum.c	Revert "net: sched: act: add extack for lookup callback"	2018-08-31 22:50:15 -07:00
act_gact.c	net/sched: act_gact: disallow 'goto chain' on fallback control action	2018-10-22 19:40:55 -07:00
act_ife.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-09-04 21:33:03 -07:00
act_ipt.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-03 21:00:17 -07:00
act_meta_mark.c	net: remove duplicate includes	2017-12-13 13:18:46 -05:00
act_meta_skbprio.c	net sched actions: change IFE modules alias names	2017-10-12 22:13:20 -07:00
act_meta_skbtcindex.c	net: remove duplicate includes	2017-12-13 13:18:46 -05:00
act_mirred.c	act_mirred: clear skb->tstamp on redirect	2018-11-11 10:21:31 -08:00
act_nat.c	net: sched: act_nat: remove dependency on rtnl lock	2018-09-08 10:18:25 -07:00
act_pedit.c	net/sched: act_pedit: fix memory leak when IDR allocation fails	2018-11-16 19:53:45 -08:00
act_police.c	net/sched: act_police: add missing spinlock initialization	2018-11-23 11:20:02 -08:00
act_sample.c	Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net	2018-09-18 09:33:27 -07:00
act_simple.c	Revert "net: sched: act: add extack for lookup callback"	2018-08-31 22:50:15 -07:00
act_skbedit.c	net: sched: act_skbedit: remove dependency on rtnl lock	2018-09-08 10:17:35 -07:00
act_skbmod.c	Revert "net: sched: act: add extack for lookup callback"	2018-08-31 22:50:15 -07:00
act_tunnel_key.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-09-12 22:22:42 -07:00
act_vlan.c	Revert "net: sched: act: add extack for lookup callback"	2018-08-31 22:50:15 -07:00
cls_api.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-19 11:03:06 -07:00
cls_basic.c	sched: fix trailing whitespace	2018-07-24 14:10:42 -07:00
cls_bpf.c	cls_bpf: Use kmemdup instead of duplicating it in cls_bpf_prog_from_ops	2018-07-29 13:19:49 -07:00
cls_cgroup.c	net_sched: switch to rcu_work	2018-05-24 22:56:15 -04:00
cls_flow.c	net_sched: switch to rcu_work	2018-05-24 22:56:15 -04:00
cls_flower.c	net: sched: cls_flower: validate nested enc_opts_policy to avoid warning	2018-11-10 09:55:30 -08:00
cls_fw.c	net_sched: switch to rcu_work	2018-05-24 22:56:15 -04:00
cls_matchall.c	cls_matchall: fix tcf_unbind_filter missing	2018-08-16 12:08:26 -07:00
cls_route.c	net_sched: switch to rcu_work	2018-05-24 22:56:15 -04:00
cls_rsvp6.c
cls_rsvp.c
cls_rsvp.h	net_sched: switch to rcu_work	2018-05-24 22:56:15 -04:00
cls_tcindex.c	net_sched: Fix missing res info when create new tc_index filter	2018-08-13 19:37:42 -07:00
cls_u32.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-12 21:38:46 -07:00
em_canid.c	net: sched: remove tcf_proto from ematch calls	2014-10-06 18:02:32 -04:00
em_cmp.c	net_sched: cleanups	2011-01-19 23:31:12 -08:00
em_ipset.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
em_ipt.c	net: sched: add em_ipt ematch for calling xtables matches	2018-02-21 13:15:33 -05:00
em_meta.c	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
em_nbyte.c	net: sched: em_nbyte: don't add the data offset twice	2018-01-24 14:52:40 -05:00
em_text.c	net: Remove state argument from skb_find_text()	2015-02-22 15:59:54 -05:00
em_u32.c	net_sched: cleanups	2011-01-19 23:31:12 -08:00
ematch.c	net: sched: ematch: obtain net pointer from blocks	2017-10-16 21:00:40 +01:00
Kconfig	tc: Add support for configuring the taprio scheduler	2018-10-04 13:52:23 -07:00
Makefile	tc: Add support for configuring the taprio scheduler	2018-10-04 13:52:23 -07:00
sch_api.c	net: sched: Remove TCA_OPTIONS from policy	2018-10-24 14:35:09 -07:00
sch_atm.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_blackhole.c	net_sched: blackhole: tell upper qdisc about dropped packets	2018-06-17 08:42:33 +09:00
sch_cake.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-12 21:38:46 -07:00
sch_cbq.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_cbs.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_choke.c	net: sched: sch: add extack for change qdisc ops	2017-12-21 12:32:50 -05:00
sch_codel.c	net: sched: sch: add extack for change qdisc ops	2017-12-21 12:32:50 -05:00
sch_drr.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_dsmark.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_etf.c	net/sched: Make etf report drops on error_queue	2018-07-04 22:30:28 +09:00
sch_fifo.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_fq_codel.c	net: Add and use skb_mark_not_on_list().	2018-09-10 10:06:54 -07:00
sch_fq.c	net_sched: sch_fq: ensure maxrate fq parameter applies to EDT flows	2018-11-15 11:42:12 -08:00
sch_generic.c	net: sched: avoid writing on noop_qdisc	2018-10-10 22:49:16 -07:00
sch_gred.c	net: sched: gred: pass the right attribute to gred_change_table_def()	2018-10-28 19:23:26 -07:00
sch_hfsc.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_hhf.c	net: Add and use skb_mark_not_on_list().	2018-09-10 10:06:54 -07:00
sch_htb.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_ingress.c	net: sched: allow ingress and clsact qdiscs to share filter blocks	2018-01-17 14:53:57 -05:00
sch_mq.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_mqprio.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_multiq.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_netem.c	net: Prevent invalid access to skb->prev in __qdisc_drop_all	2018-11-29 16:27:27 -08:00
sch_pie.c	net: sched: pie: fix coding style issues	2018-10-07 20:39:01 -07:00
sch_plug.c	net: sched: sch: add extack for change qdisc ops	2017-12-21 12:32:50 -05:00
sch_prio.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_qfq.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_red.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_sfb.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_sfq.c	net: sch: api: add extack support in tcf_block_get	2017-12-21 12:32:51 -05:00
sch_skbprio.c	net/sched: add skbprio scheduler	2018-07-24 14:44:00 -07:00
sch_taprio.c	tc: Add support for configuring the taprio scheduler	2018-10-04 13:52:23 -07:00
sch_tbf.c	net: sched: rename qdisc_destroy() to qdisc_put()	2018-09-25 20:17:35 -07:00
sch_teql.c	net: sched: sch: add extack for init callback	2017-12-21 12:32:50 -05:00