[5.5,47/65] net: rmnet: fix NULL pointer dereference in rmnet_changelink()

From: Taehee Yoo <ap420073@gmail.com>

From: Taehee Yoo <ap420073@gmail.com>

[ Upstream commit 1eb1f43a6e37282348a41e3d68f5e9a6a4359212 ]

In the rmnet_changelink(), it uses IFLA_LINK without checking
NULL pointer.
tb[IFLA_LINK] could be NULL pointer.
So, NULL-ptr-deref could occur.

rmnet already has a lower interface (real_dev).
So, after this patch, rmnet_changelink() does not use IFLA_LINK anymore.

Test commands:
    modprobe rmnet
    ip link add dummy0 type dummy
    ip link add rmnet0 link dummy0 type rmnet mux_id 1
    ip link set rmnet0 type rmnet mux_id 2

Splat looks like:
[   90.578726][ T1131] general protection fault, probably for non-canonical address 0xdffffc0000000000I
[   90.581121][ T1131] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[   90.582380][ T1131] CPU: 2 PID: 1131 Comm: ip Not tainted 5.6.0-rc1+ #447
[   90.584285][ T1131] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   90.587506][ T1131] RIP: 0010:rmnet_changelink+0x5a/0x8a0 [rmnet]
[   90.588546][ T1131] Code: 83 ec 20 48 c1 ea 03 80 3c 02 00 0f 85 6f 07 00 00 48 8b 5e 28 48 b8 00 00 00 00 00 0
[   90.591447][ T1131] RSP: 0018:ffff8880ce78f1b8 EFLAGS: 00010247
[   90.592329][ T1131] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff8880ce78f8b0
[   90.593253][ T1131] RDX: 0000000000000000 RSI: ffff8880ce78f4a0 RDI: 0000000000000004
[   90.594058][ T1131] RBP: ffff8880cf543e00 R08: 0000000000000002 R09: 0000000000000002
[   90.594859][ T1131] R10: ffffffffc0586a40 R11: 0000000000000000 R12: ffff8880ca47c000
[   90.595690][ T1131] R13: ffff8880ca47c000 R14: ffff8880cf545000 R15: 0000000000000000
[   90.596553][ T1131] FS:  00007f21f6c7e0c0(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000
[   90.597504][ T1131] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   90.599418][ T1131] CR2: 0000556e413db458 CR3: 00000000c917a002 CR4: 00000000000606e0
[   90.600289][ T1131] Call Trace:
[   90.600631][ T1131]  __rtnl_newlink+0x922/0x1270
[   90.601194][ T1131]  ? lock_downgrade+0x6e0/0x6e0
[   90.601724][ T1131]  ? rtnl_link_unregister+0x220/0x220
[   90.602309][ T1131]  ? lock_acquire+0x164/0x3b0
[   90.602784][ T1131]  ? is_bpf_image_address+0xff/0x1d0
[   90.603331][ T1131]  ? rtnl_newlink+0x4c/0x90
[   90.603810][ T1131]  ? kernel_text_address+0x111/0x140
[   90.604419][ T1131]  ? __kernel_text_address+0xe/0x30
[   90.604981][ T1131]  ? unwind_get_return_address+0x5f/0xa0
[   90.605616][ T1131]  ? create_prof_cpu_mask+0x20/0x20
[   90.606304][ T1131]  ? arch_stack_walk+0x83/0xb0
[   90.606985][ T1131]  ? stack_trace_save+0x82/0xb0
[   90.607656][ T1131]  ? stack_trace_consume_entry+0x160/0x160
[   90.608503][ T1131]  ? deactivate_slab.isra.78+0x2c5/0x800
[   90.609336][ T1131]  ? kasan_unpoison_shadow+0x30/0x40
[   90.610096][ T1131]  ? kmem_cache_alloc_trace+0x135/0x350
[   90.610889][ T1131]  ? rtnl_newlink+0x4c/0x90
[   90.611512][ T1131]  rtnl_newlink+0x65/0x90
[ ... ]

Fixes: 23790ef12082 ("net: qualcomm: rmnet: Allow to configure flags for existing devices")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

Message ID	20200319123941.236811843@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=1QoN=5E=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Taehee Yoo <ap420073@gmail.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.5 47/65] net: rmnet: fix NULL pointer dereference in rmnet_changelink() Date: Thu, 19 Mar 2020 14:04:29 +0100 Message-Id: <20200319123941.236811843@linuxfoundation.org> In-Reply-To: <20200319123926.466988514@linuxfoundation.org> References: <20200319123926.466988514@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.5,02/65] pinctrl: qcom: ssbi-gpio: Fix fwspec parsing bug [5.5,05/65] mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY [5.5,07/65] mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command [5.5,08/65] mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard [5.5,09/65] ACPI: watchdog: Allow disabling WDAT at boot [5.5,10/65] HID: apple: Add support for recent firmware on Magic Keyboards [5.5,11/65] ACPI: watchdog: Set default timeout in probe [5.5,13/65] mips: vdso: fix jalr t9 crash in vdso code [5.5,16/65] HID: hid-bigbenff: fix general protection fault caused by double kfree [5.5,17/65] HID: hid-bigbenff: call hid_hw_stop() in case of error [5.5,19/65] riscv: set pmp configuration if kernel is running in M-mode [5.5,20/65] MIPS: vdso: Wrap -mexplicit-relocs in cc-option [5.5,22/65] selftests/rseq: Fix out-of-tree compilation [5.5,25/65] scsi: libfc: free response frame from GPN_ID [5.5,27/65] net: ks8851-ml: Fix IRQ handling and locking [5.5,29/65] net: ll_temac: Fix race condition causing TX hang [5.5,32/65] net: ll_temac: Handle DMA halt condition caused by buffer underrun [5.5,35/65] drm/amdgpu: fix memory leak during TDR test(v2) [5.5,38/65] kbuild: add dt_binding_check to PHONY in a correct place [5.5,39/65] signal: avoid double atomic counter increments for user accounting [5.5,41/65] slip: not call free_netdev before rtnl_unlock in slip_open [5.5,43/65] hinic: fix a irq affinity bug [5.5,46/65] net: rmnet: fix NULL pointer dereference in rmnet_newlink() [5.5,47/65] net: rmnet: fix NULL pointer dereference in rmnet_changelink() [5.5,48/65] net: rmnet: fix suspicious RCU usage [5.5,49/65] net: rmnet: remove rcu_read_lock in rmnet_force_unassociate_device() [5.5,51/65] net: rmnet: use upper/lower device infrastructure [5.5,52/65] net: rmnet: fix bridge mode bugs [5.5,54/65] sfc: fix timestamp reconstruction at 16-bit rollover points [5.5,56/65] net: dsa: mv88e6xxx: Fix masking of egress port [5.5,59/65] ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional() [5.5,62/65] HID: google: add moonball USB id [5.5,64/65] ARM: 8961/2: Fix Kbuild issue caused by per-task stack protector GCC plugin

[5.5,47/65] net: rmnet: fix NULL pointer dereference in rmnet_changelink()

Commit Message

Patch