Wei Yongjun
479be5229b
ip6_gre: fix null-ptr-deref in ip6gre_init_net()
[ Upstream commit 46ef5b89ec ]
KASAN report null-ptr-deref error when register_netdev() failed:
KASAN: null-ptr-deref in range [0x00000000000003c0-0x00000000000003c7]
CPU: 2 PID: 422 Comm: ip Not tainted 5.8.0-rc4+ #12
Call Trace:
ip6gre_init_net+0x4ab/0x580
? ip6gre_tunnel_uninit+0x3f0/0x3f0
ops_init+0xa8/0x3c0
setup_net+0x2de/0x7e0
? rcu_read_lock_bh_held+0xb0/0xb0
? ops_init+0x3c0/0x3c0
? kasan_unpoison_shadow+0x33/0x40
? __kasan_kmalloc.constprop.0+0xc2/0xd0
copy_net_ns+0x27d/0x530
create_new_namespaces+0x382/0xa30
unshare_nsproxy_namespaces+0xa1/0x1d0
ksys_unshare+0x39c/0x780
? walk_process_tree+0x2a0/0x2a0
? trace_hardirqs_on+0x4a/0x1b0
? _raw_spin_unlock_irq+0x1f/0x30
? syscall_trace_enter+0x1a7/0x330
? do_syscall_64+0x1c/0xa0
__x64_sys_unshare+0x2d/0x40
do_syscall_64+0x56/0xa0
entry_SYSCALL_64_after_hwframe+0x44/0xa9
ip6gre_tunnel_uninit() has set 'ign->fb_tunnel_dev' to NULL, later
access to ign->fb_tunnel_dev cause null-ptr-deref. Fix it by saving
'ign->fb_tunnel_dev' to local variable ndev.
Fixes: dafabb6590 ("ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-31 16:44:07 +02:00
..
2020-07-31 16:44:06 +02:00
2020-05-20 08:15:29 +02:00
2020-06-20 10:24:14 +02:00
2020-06-03 08:16:45 +02:00
2020-06-03 08:16:41 +02:00
2020-07-31 16:44:06 +02:00
2020-05-20 08:15:30 +02:00
2020-04-13 10:32:53 +02:00
2020-04-24 07:59:02 +02:00
2020-03-20 09:07:39 +01:00
2020-07-31 16:44:06 +02:00
2020-07-31 16:44:07 +02:00
2020-07-22 09:10:47 +02:00
2020-07-22 09:10:47 +02:00
2020-07-31 16:44:01 +02:00
2020-05-20 08:15:30 +02:00
2020-07-09 09:35:57 +02:00
2020-05-20 08:15:39 +02:00
2020-07-22 09:10:48 +02:00
2020-05-02 17:23:08 +02:00
2020-03-20 09:07:40 +01:00
2020-06-03 08:16:29 +02:00
2020-07-31 16:44:06 +02:00
2020-06-30 15:38:37 -04:00
2020-06-30 15:38:39 -04:00
2020-06-30 15:38:45 -04:00
2020-05-20 08:15:30 +02:00
2020-06-11 09:22:21 +02:00
2020-03-20 09:07:57 +01:00
2020-05-02 17:23:08 +02:00
2020-06-03 08:16:44 +02:00
2020-05-27 16:42:00 +02:00