From patchwork Sun Mar 11 19:22:55 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Josh Elsasser X-Patchwork-Id: 884275 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=quarantine dis=none) header.from=appneta.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=appneta.com header.i=@appneta.com header.b="bWXoGl8h"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zzrfv6zK2z9sRN for ; Mon, 12 Mar 2018 06:25:11 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932280AbeCKTY5 (ORCPT ); Sun, 11 Mar 2018 15:24:57 -0400 Received: from mail-pf0-f194.google.com ([209.85.192.194]:39102 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932166AbeCKTYx (ORCPT ); Sun, 11 Mar 2018 15:24:53 -0400 Received: by mail-pf0-f194.google.com with SMTP id u5so3428844pfh.6 for ; Sun, 11 Mar 2018 12:24:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=appneta.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Ma/gtyU8jEHFiwVDecb14yecvM5eV0bTE+1obKTH3oI=; b=bWXoGl8htgDInDuVbBXJ4Y2WvQYe4cYXT2atgtac6DsSPjJY4340cU2IfwvK9MDSDK EHjDQI4c1IjwofO0Nund8ZJSSBVePl30ARX462sA6Umz7c4FQWxgsIv5mwiD9TeTMEk3 IJJojG1I+61nf/MmYbE/4Klzv8s+m8cKU7aMg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Ma/gtyU8jEHFiwVDecb14yecvM5eV0bTE+1obKTH3oI=; b=mmr+PApFLK/pTbifdY7uuiHIqwqJgS7CEbMKS3DTO5Ga1JVftB7AIbQCo7tZu5OEoE fgLRoyKrfbRB8Hjpcd8hUUyXjbac/qjVOancgRrwR6aH2FeAnvT9lwKbD2MTDbr9i6Cj /HPhHx8DPpee4JiQBFlGYqxQNi48Vo6uLjwDWHBXqCiZCmQbtdN7XNHrm683PhyWgIWj bqSs56L/6KFz6tt1+fc7WKdNx8nI3Hf58LkA1XmZhLDNCGTzJ0X5GreIWR4jCx506Eep rzJdewPONIqYDOwQ0Pxj+rIIAeEK0lBZoHiOTZw9XhaM+ja20efUOyTMSSuLh642NdFK /iaA== X-Gm-Message-State: AElRT7H5L+6pLSJTUsxBBqdAucmfmJ9pYSGRAg9Me3QJSb/7cuLLP968 r1RXDIllU4SMItS0TfQdsBgG X-Google-Smtp-Source: AG47ELu+iBITcGVGDjFIi2jB32jDjh+n+Ar3RoXtEhQKQs5Lq85h0RGq1oTgDaskkWZS3YsNkBIeQQ== X-Received: by 10.99.177.6 with SMTP id r6mr4586089pgf.76.1520796292914; Sun, 11 Mar 2018 12:24:52 -0700 (PDT) Received: from debian8-stable-jae.jaalam.net (d173-180-161-165.bchsia.telus.net. [173.180.161.165]) by smtp.gmail.com with ESMTPSA id l19sm11736753pgn.31.2018.03.11.12.24.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 11 Mar 2018 12:24:52 -0700 (PDT) From: Josh Elsasser To: davem@davemloft.net Cc: Josh Elsasser , Greg Kroah-Hartman , Eric Dumazet , Sasha Levin , Willem de Bruijn , Alexander Potapenko , Cong Wang , =?utf-8?q?Michal_Kube?= =?utf-8?q?=C4=8Dek?= , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/1] net: check dev->reg_state before deref of napi netdev_ops Date: Sun, 11 Mar 2018 12:22:55 -0700 Message-Id: <20180311192322.101598-2-jelsasser@appneta.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180311192322.101598-1-jelsasser@appneta.com> References: <20180311192322.101598-1-jelsasser@appneta.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org init_dummy_netdev() leaves its netdev_ops pointer zeroed. This leads to a NULL pointer dereference when sk_busy_loop fires against an iwlwifi wireless adapter and checks napi->dev->netdev_ops->ndo_busy_poll. Avoid this by ensuring that napi->dev is not a dummy device before dereferencing napi dev's netdev_ops, preventing the following panic: BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8 IP: [] sk_busy_loop+0x92/0x2f0 Call Trace: [] ? uart_write_room+0x74/0xf0 [] sock_poll+0x99/0xa0 [] do_sys_poll+0x2e2/0x520 [] ? get_page_from_freelist+0x3bc/0xa30 [] ? update_curr+0x62/0x140 [] ? __slab_free+0xa1/0x2a0 [] ? __slab_free+0xa1/0x2a0 [] ? skb_free_head+0x21/0x30 [] ? poll_initwait+0x50/0x50 [] ? kmem_cache_free+0x1c6/0x1e0 [] ? uart_write+0x124/0x1d0 [] ? remove_wait_queue+0x4d/0x60 [] ? __wake_up+0x44/0x50 [] ? tty_write_unlock+0x31/0x40 [] ? tty_ldisc_deref+0x16/0x20 [] ? tty_write+0x1e0/0x2f0 [] ? process_echoes+0x80/0x80 [] ? __vfs_write+0x2b/0x130 [] ? vfs_write+0x15a/0x1a0 [] SyS_poll+0x75/0x100 [] entry_SYSCALL_64_fastpath+0x24/0xcf Commit 79e7fff47b7b ("net: remove support for per driver ndo_busy_poll()") indirectly fixed this upstream in linux-4.11 by removing the offending pointer usage. No other users of napi->dev touch its netdev_ops. Fixes: 060212928670 ("net: add low latency socket poll") Fixes: ce6aea93f751 ("net: network drivers no longer need to implement ndo_busy_poll()") - 4.9.y Signed-off-by: Josh Elsasser --- net/core/dev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/dev.c b/net/core/dev.c index 8898618bf341..d0f67d544587 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5042,7 +5042,10 @@ bool sk_busy_loop(struct sock *sk, int nonblock) goto out; /* Note: ndo_busy_poll method is optional in linux-4.5 */ - busy_poll = napi->dev->netdev_ops->ndo_busy_poll; + if (napi->dev->reg_state != NETREG_DUMMY) + busy_poll = napi->dev->netdev_ops->ndo_busy_poll; + else + busy_poll = NULL; do { rc = 0;