linux

mirror of https://github.com/torvalds/linux.git synced 2024-11-10 22:21:40 +00:00

A mirror of the official Linux kernel repository just in case

Go to file

Hoang Le 08e046c896 tipc: fix a null pointer deref In commit `c55c8edafa` ("tipc: smooth change between replicast and broadcast") we introduced new method to eliminate the risk of message reordering that happen in between different nodes. Unfortunately, we forgot checking at receiving side to ignore intra node. We fix this by checking and returning if arrived message from intra node. syzbot report: ================================================================== kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 7820 Comm: syz-executor418 Not tainted 5.0.0+ #61 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:tipc_mcast_filter_msg+0x21b/0x13d0 net/tipc/bcast.c:782 Code: 45 c0 0f 84 39 06 00 00 48 89 5d 98 e8 ce ab a5 fa 49 8d bc 24 c8 00 00 00 48 b9 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 9a 0e 00 00 49 8b 9c 24 c8 00 00 00 48 be 00 00 RSP: 0018:ffff8880959defc8 EFLAGS: 00010202 RAX: 0000000000000019 RBX: ffff888081258a48 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffffffff86cab862 RDI: 00000000000000c8 RBP: ffff8880959df030 R08: ffff8880813d0200 R09: ffffed1015d05bc8 R10: ffffed1015d05bc7 R11: ffff8880ae82de3b R12: 0000000000000000 R13: 000000000000002c R14: 0000000000000000 R15: ffff888081258a48 FS: 000000000106a880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020001cc0 CR3: 0000000094a20000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tipc_sk_filter_rcv+0x182d/0x34f0 net/tipc/socket.c:2168 tipc_sk_enqueue net/tipc/socket.c:2254 [inline] tipc_sk_rcv+0xc45/0x25a0 net/tipc/socket.c:2305 tipc_sk_mcast_rcv+0x724/0x1020 net/tipc/socket.c:1209 tipc_mcast_xmit+0x7fe/0x1200 net/tipc/bcast.c:410 tipc_sendmcast+0xb36/0xfc0 net/tipc/socket.c:820 __tipc_sendmsg+0x10df/0x18d0 net/tipc/socket.c:1358 tipc_sendmsg+0x53/0x80 net/tipc/socket.c:1291 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xdd/0x130 net/socket.c:661 ___sys_sendmsg+0x806/0x930 net/socket.c:2260 __sys_sendmsg+0x105/0x1d0 net/socket.c:2298 __do_sys_sendmsg net/socket.c:2307 [inline] __se_sys_sendmsg net/socket.c:2305 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2305 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4401c9 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffd887fa9d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004401c9 RDX: 0000000000000000 RSI: 0000000020002140 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a50 R13: 0000000000401ae0 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace ba79875754e1708f ]--- Reported-by: syzbot+be4bdf2cc3e85e952c50@syzkaller.appspotmail.com Fixes: `c55c8eda` ("tipc: smooth change between replicast and broadcast") Acked-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-03-21 09:56:55 -07:00
arch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2019-03-16 12:20:08 -07:00
block	mm: refactor readahead defines in mm.h	2019-03-12 10:04:01 -07:00
certs	kexec, KEYS: Make use of platform keyring for signature verify	2019-02-04 17:34:07 -05:00
crypto	lib/lzo: separate lzo-rle from lzo	2019-03-07 18:32:03 -08:00
Documentation	ipv6: Add icmp_echo_ignore_anycast for ICMPv6	2019-03-20 16:29:37 -07:00
drivers	net: isdn: Make isdn_ppp_mp_discard and isdn_ppp_mp_reassembly static	2019-03-20 12:25:59 -07:00
fs	filesystem-dax for 5.1	2019-03-13 09:37:09 -07:00
include	ipv6: Add icmp_echo_ignore_anycast for ICMPv6	2019-03-20 16:29:37 -07:00
init	init/main: add checks for the return value of memblock_alloc*()	2019-03-12 10:04:02 -07:00
ipc	Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 14:08:19 -07:00
kernel	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2019-03-16 12:20:08 -07:00
lib	Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 13:43:42 -07:00
LICENSES	LICENSES: Add GCC runtime library exception text	2019-01-16 14:54:15 -07:00
mm	filemap: pass vm_fault to the mmap ra helpers	2019-03-14 14:36:20 -07:00
net	tipc: fix a null pointer deref	2019-03-21 09:56:55 -07:00
samples	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-03-11 08:54:01 -07:00
scripts	Kconfig updates for v5.1	2019-03-13 10:06:28 -07:00
security	selinux/stable-5.1 PR 20190312	2019-03-13 11:10:42 -07:00
sound	Char/Misc driver patches for 5.1-rc1	2019-03-06 14:18:59 -08:00
tools	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2019-03-16 12:20:08 -07:00
usr	user/Makefile: Fix typo and capitalization in comment section	2018-12-11 00:18:03 +09:00
virt	ACPI updates for 5.1-rc1	2019-03-06 13:33:11 -08:00
.clang-format	Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 13:43:42 -07:00
.cocciconfig
.get_maintainer.ignore
.gitattributes	.gitattributes: set git diff driver for C source code files	2016-10-07 18:46:30 -07:00
.gitignore	kbuild: Add support for DT binding schema checks	2018-12-13 09:41:32 -06:00
.mailmap	.mailmap: Add Mathieu Othacehe	2019-02-21 11:41:19 +00:00
COPYING	COPYING: use the new text with points to the license files	2018-03-23 12:41:45 -06:00
CREDITS	Char/Misc driver patches for 5.1-rc1	2019-03-06 14:18:59 -08:00
Kbuild	Kbuild updates for v5.1	2019-03-10 17:48:21 -07:00
Kconfig	kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt	2018-08-02 08:06:55 +09:00
MAINTAINERS	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-03-14 09:28:12 -07:00
Makefile	Kbuild updates for v5.1	2019-03-10 17:48:21 -07:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.