netdev - Re: NULL pointer dereference at skb_queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201501052150.CIG69242.FFVOLQOJFHtMSO@I-love.SAKURA.ne.jp>
Date:	Mon, 5 Jan 2015 21:50:33 +0900
From:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:	netdev@...r.kernel.org
Subject: Re: NULL pointer dereference at skb_queue_tail()

Tetsuo Handa wrote:
> I can reproduce below oops when testing Linux 3.18 with memory allocation
> failure injection module at https://lkml.org/lkml/2014/12/25/64 .

I can reliably reproduce this oops with current linux.git using memory
allocation failure injection module. There is a possibility of memory
corruption since this oops always occurs immediately after memory
allocation failure within GPU/DRM code. I want to check whether
fields of structures have expected values or not.

> void skb_queue_tail(struct sk_buff_head *list, struct sk_buff *newsk)
> {
>         unsigned long flags;
> 

Could you tell me what are expected values (i.e. what BUG_ON() test
should I try) at this location?

>         spin_lock_irqsave(&list->lock, flags);
>         __skb_queue_tail(list, newsk);
>         spin_unlock_irqrestore(&list->lock, flags);
> }
> 
> static inline void __skb_queue_tail(struct sk_buff_head *list,
>                                    struct sk_buff *newsk)
> {
>         __skb_queue_before(list, (struct sk_buff *)list, newsk);
> }
> 
> static inline void __skb_queue_before(struct sk_buff_head *list,
>                                       struct sk_buff *next,
>                                       struct sk_buff *newsk)
> {
>         __skb_insert(newsk, next->prev, next, list);
> }
> 
> static inline void __skb_insert(struct sk_buff *newsk,
>                                 struct sk_buff *prev, struct sk_buff *next,
>                                 struct sk_buff_head *list)
> {
>         newsk->next = next;
>         newsk->prev = prev;
>         next->prev  = prev->next = newsk; // <= ffffffff81535e27 is here.
>         list->qlen++;
> }
> 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html