netdev - Re: [PATCH net] ipv4: fib: Fix NULL pointer deref during fib_sync_down

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170729084804.sqm6gjz3u5r5xfk3@qmqm.qmqm.pl>
Date:   Sat, 29 Jul 2017 10:48:04 +0200
From:   Michał Mirosław <mirq-linux@...e.qmqm.pl>
To:     Ido Schimmel <idosch@...lanox.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net,
        xiyou.wangcong@...il.com
Subject: Re: [PATCH net] ipv4: fib: Fix NULL pointer deref during
 fib_sync_down_dev()

On Fri, Jul 28, 2017 at 11:27:44PM +0300, Ido Schimmel wrote:
> Michał reported a NULL pointer deref during fib_sync_down_dev() when
> unregistering a netdevice. The problem is that we don't check for
> 'in_dev' being NULL, which can happen in very specific cases.
> 
> Usually routes are flushed upon NETDEV_DOWN sent in either the netdev or
> the inetaddr notification chains. However, if an interface isn't
> configured with any IP address, then it's possible for host routes to be
> flushed following NETDEV_UNREGISTER, after NULLing dev->ip_ptr in
> inetdev_destroy().
> 
> To reproduce:
> $ ip link add type dummy
> $ ip route add local 1.1.1.0/24 dev dummy0
> $ ip link del dev dummy0
> 
> Fix this by checking for the presence of 'in_dev' before referencing it.
> 
> Fixes: 982acb97560c ("ipv4: fib: Notify about nexthop status changes")
> Signed-off-by: Ido Schimmel <idosch@...lanox.com>
> Reported-by: Michał Mirosław <mirq-linux@...e.qmqm.pl>

Tested-by: Michał Mirosław <mirq-linux@...e.qmqm.pl>

Thanks!