netdev - Re: [PATCH net] ipv4: fib: Fix NULL pointer deref during fib_sync_down

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20170731.175141.2110537819573316012.davem@davemloft.net>
Date:   Mon, 31 Jul 2017 17:51:41 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     idosch@...lanox.com
Cc:     netdev@...r.kernel.org, mirq-linux@...e.qmqm.pl,
        xiyou.wangcong@...il.com
Subject: Re: [PATCH net] ipv4: fib: Fix NULL pointer deref during
 fib_sync_down_dev()

From: Ido Schimmel <idosch@...lanox.com>
Date: Fri, 28 Jul 2017 23:27:44 +0300

> Micha┅ reported a NULL pointer deref during fib_sync_down_dev() when
> unregistering a netdevice. The problem is that we don't check for
> 'in_dev' being NULL, which can happen in very specific cases.
> 
> Usually routes are flushed upon NETDEV_DOWN sent in either the netdev or
> the inetaddr notification chains. However, if an interface isn't
> configured with any IP address, then it's possible for host routes to be
> flushed following NETDEV_UNREGISTER, after NULLing dev->ip_ptr in
> inetdev_destroy().
> 
> To reproduce:
> $ ip link add type dummy
> $ ip route add local 1.1.1.0/24 dev dummy0
> $ ip link del dev dummy0
> 
> Fix this by checking for the presence of 'in_dev' before referencing it.
> 
> Fixes: 982acb97560c ("ipv4: fib: Notify about nexthop status changes")
> Signed-off-by: Ido Schimmel <idosch@...lanox.com>
> Reported-by: Micha┅ Miros┅aw <mirq-linux@...e.qmqm.pl>
> ---
> Please consider this for -stable.

Applied and queued up for -stable, thanks!