netdev - Re: [net] tipc: fix NULL deref in tipc_link

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210107112214.61ffc4f3@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Thu, 7 Jan 2021 11:22:14 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Hoang Huu Le <hoang.h.le@...tech.com.au>
Cc:     netdev@...r.kernel.org, ying.xue@...driver.com, maloy@...jonn.com,
        jmaloy@...hat.com
Subject: Re: [net] tipc: fix NULL deref in tipc_link_xmit()

On Thu,  7 Jan 2021 10:34:19 +0700 Hoang Huu Le wrote:
> From: Hoang Le <hoang.h.le@...tech.com.au>
> 
> The buffer list can have zero skb as following path:
> tipc_named_node_up()->tipc_node_xmit()->tipc_link_xmit(), so
> we need to check the list before casting an &sk_buff.
> 
> Fault report:
>  [] tipc: Bulk publication failure
>  [] general protection fault, probably for non-canonical [#1] PREEMPT [...]
>  [] KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
>  [] CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 5.10.0-rc4+ #2
>  [] Hardware name: Bochs ..., BIOS Bochs 01/01/2011
>  [] RIP: 0010:tipc_link_xmit+0xc1/0x2180
>  [] Code: 24 b8 00 00 00 00 4d 39 ec 4c 0f 44 e8 e8 d7 0a 10 f9 48 [...]
>  [] RSP: 0018:ffffc90000006ea0 EFLAGS: 00010202
>  [] RAX: dffffc0000000000 RBX: ffff8880224da000 RCX: 1ffff11003d3cc0d
>  [] RDX: 0000000000000019 RSI: ffffffff886007b9 RDI: 00000000000000c8
>  [] RBP: ffffc90000007018 R08: 0000000000000001 R09: fffff52000000ded
>  [] R10: 0000000000000003 R11: fffff52000000dec R12: ffffc90000007148
>  [] R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90000007018
>  [] FS:  0000000000000000(0000) GS:ffff888037400000(0000) knlGS:000[...]
>  [] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  [] CR2: 00007fffd2db5000 CR3: 000000002b08f000 CR4: 00000000000006f0
> 
> Acked-by: Jon Maloy <jmaloy@...hat.com>
> Signed-off-by: Hoang Le <hoang.h.le@...tech.com.au>

Can we get a Fixes tag?