[4.4,13/38] net: sched: sch_teql: fix null-pointer dereference

From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>

From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>

commit 1ffbc7ea91606e4abd10eb60de5367f1c86daf5e upstream.

Reproduce:

  modprobe sch_teql
  tc qdisc add dev teql0 root teql0

This leads to (for instance in Centos 7 VM) OOPS:

[  532.366633] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8
[  532.366733] IP: [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[  532.366825] PGD 80000001376d5067 PUD 137e37067 PMD 0
[  532.366906] Oops: 0000 [#1] SMP
[  532.366987] Modules linked in: sch_teql ...
[  532.367945] CPU: 1 PID: 3026 Comm: tc Kdump: loaded Tainted: G               ------------ T 3.10.0-1062.7.1.el7.x86_64 #1
[  532.368041] Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.2 04/01/2014
[  532.368125] task: ffff8b7d37d31070 ti: ffff8b7c9fdbc000 task.ti: ffff8b7c9fdbc000
[  532.368224] RIP: 0010:[<ffffffffc06124a8>]  [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[  532.368320] RSP: 0018:ffff8b7c9fdbf8e0  EFLAGS: 00010286
[  532.368394] RAX: ffffffffc0612490 RBX: ffff8b7cb1565e00 RCX: ffff8b7d35ba2000
[  532.368476] RDX: ffff8b7d35ba2000 RSI: 0000000000000000 RDI: ffff8b7cb1565e00
[  532.368557] RBP: ffff8b7c9fdbf8f8 R08: ffff8b7d3fd1f140 R09: ffff8b7d3b001600
[  532.368638] R10: ffff8b7d3b001600 R11: ffffffff84c7d65b R12: 00000000ffffffd8
[  532.368719] R13: 0000000000008000 R14: ffff8b7d35ba2000 R15: ffff8b7c9fdbf9a8
[  532.368800] FS:  00007f6a4e872740(0000) GS:ffff8b7d3fd00000(0000) knlGS:0000000000000000
[  532.368885] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  532.368961] CR2: 00000000000000a8 CR3: 00000001396ee000 CR4: 00000000000206e0
[  532.369046] Call Trace:
[  532.369159]  [<ffffffff84c8192e>] qdisc_create+0x36e/0x450
[  532.369268]  [<ffffffff846a9b49>] ? ns_capable+0x29/0x50
[  532.369366]  [<ffffffff849afde2>] ? nla_parse+0x32/0x120
[  532.369442]  [<ffffffff84c81b4c>] tc_modify_qdisc+0x13c/0x610
[  532.371508]  [<ffffffff84c693e7>] rtnetlink_rcv_msg+0xa7/0x260
[  532.372668]  [<ffffffff84907b65>] ? sock_has_perm+0x75/0x90
[  532.373790]  [<ffffffff84c69340>] ? rtnl_newlink+0x890/0x890
[  532.374914]  [<ffffffff84c8da7b>] netlink_rcv_skb+0xab/0xc0
[  532.376055]  [<ffffffff84c63708>] rtnetlink_rcv+0x28/0x30
[  532.377204]  [<ffffffff84c8d400>] netlink_unicast+0x170/0x210
[  532.378333]  [<ffffffff84c8d7a8>] netlink_sendmsg+0x308/0x420
[  532.379465]  [<ffffffff84c2f3a6>] sock_sendmsg+0xb6/0xf0
[  532.380710]  [<ffffffffc034a56e>] ? __xfs_filemap_fault+0x8e/0x1d0 [xfs]
[  532.381868]  [<ffffffffc034a75c>] ? xfs_filemap_fault+0x2c/0x30 [xfs]
[  532.383037]  [<ffffffff847ec23a>] ? __do_fault.isra.61+0x8a/0x100
[  532.384144]  [<ffffffff84c30269>] ___sys_sendmsg+0x3e9/0x400
[  532.385268]  [<ffffffff847f3fad>] ? handle_mm_fault+0x39d/0x9b0
[  532.386387]  [<ffffffff84d88678>] ? __do_page_fault+0x238/0x500
[  532.387472]  [<ffffffff84c31921>] __sys_sendmsg+0x51/0x90
[  532.388560]  [<ffffffff84c31972>] SyS_sendmsg+0x12/0x20
[  532.389636]  [<ffffffff84d8dede>] system_call_fastpath+0x25/0x2a
[  532.390704]  [<ffffffff84d8de21>] ? system_call_after_swapgs+0xae/0x146
[  532.391753] Code: 00 00 00 00 00 00 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 53 48 8b b7 48 01 00 00 48 89 fb <48> 8b 8e a8 00 00 00 48 85 c9 74 43 48 89 ca eb 0f 0f 1f 80 00
[  532.394036] RIP  [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[  532.395127]  RSP <ffff8b7c9fdbf8e0>
[  532.396179] CR2: 00000000000000a8

Null pointer dereference happens on master->slaves dereference in
teql_destroy() as master is null-pointer.

When qdisc_create() calls teql_qdisc_init() it imediately fails after
check "if (m->dev == dev)" because both devices are teql0, and it does
not set qdisc_priv(sch)->m leaving it zero on error path, then
qdisc_create() imediately calls teql_destroy() which does not expect
zero master pointer and we get OOPS.

Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_teql.c |    3 +++
 1 file changed, 3 insertions(+)

Message ID	20210415144413.772430268@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Pavel Tikhomirov <ptikhomirov@virtuozzo.com>, Eric Dumazet <edumazet@google.com>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 4.4 13/38] net: sched: sch_teql: fix null-pointer dereference Date: Thu, 15 Apr 2021 16:47:07 +0200 Message-Id: <20210415144413.772430268@linuxfoundation.org> In-Reply-To: <20210415144413.352638802@linuxfoundation.org> References: <20210415144413.352638802@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.4,02/38] ALSA: aloop: Fix initialization of controls [4.4,03/38] nfc: fix refcount leak in llcp_sock_bind() [4.4,04/38] nfc: fix refcount leak in llcp_sock_connect() [4.4,05/38] nfc: fix memory leak in llcp_sock_connect() [4.4,06/38] nfc: Avoid endless loops caused by repeated llcp_sock_connect() [4.4,07/38] xen/evtchn: Change irq_info lock to raw_spinlock_t [4.4,08/38] net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh [4.4,09/38] ia64: fix user_stack_pointer() for ptrace() [4.4,10/38] fs: direct-io: fix missing sdio->boundary [4.4,11/38] parisc: parisc-agp requires SBA IOMMU driver [4.4,12/38] batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field [4.4,13/38] net: sched: sch_teql: fix null-pointer dereference [4.4,14/38] sch_red: fix off-by-one checks in red_check_params() [4.4,15/38] gianfar: Handle error code at MAC address change [4.4,16/38] net:tipc: Fix a double free in tipc_sk_mcast_rcv [4.4,17/38] clk: fix invalid usage of list cursor in unregister [4.4,18/38] workqueue: Move the position of debug_work_activate() in __queue_work() [4.4,19/38] s390/cpcmd: fix inline assembly register clobbering [4.4,20/38] RDMA/cxgb4: check for ipv6 address properly while destroying listener [4.4,21/38] clk: socfpga: fix iomem pointer cast on 64-bit [4.4,22/38] cfg80211: remove WARN_ON() in cfg80211_sme_connect [4.4,23/38] net: tun: set tun->dev->addr_len during TUNSETLINK processing [4.4,24/38] drivers: net: fix memory leak in atusb_probe [4.4,25/38] drivers: net: fix memory leak in peak_usb_create_dev [4.4,26/38] net: mac802154: Fix general protection fault [4.4,27/38] net: ieee802154: nl-mac: fix check on panid [4.4,28/38] net: ieee802154: fix nl802154 del llsec key [4.4,29/38] net: ieee802154: fix nl802154 del llsec dev [4.4,30/38] net: ieee802154: fix nl802154 add llsec key [4.4,31/38] net: ieee802154: fix nl802154 del llsec devkey [4.4,32/38] net: ieee802154: forbid monitor for set llsec params [4.4,33/38] net: ieee802154: forbid monitor for del llsec seclevel [4.4,34/38] net: ieee802154: stop dump llsec params for monitors [4.4,35/38] drm/imx: imx-ldb: fix out of bounds array access warning [4.4,36/38] netfilter: x_tables: fix compat match/target pad out-of-bound write [4.4,37/38] perf map: Tighten snprintf() string precision to pass gcc check on some 32-bit arches [4.4,38/38] xen/events: fix setting irq affinity

[4.4,13/38] net: sched: sch_teql: fix null-pointer dereference

Commit Message

Patch