From patchwork Thu May 8 07:39:06 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: wangweidong X-Patchwork-Id: 346906 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 93F27141381 for ; Thu, 8 May 2014 17:40:03 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753145AbaEHHj6 (ORCPT ); Thu, 8 May 2014 03:39:58 -0400 Received: from szxga03-in.huawei.com ([119.145.14.66]:46781 "EHLO szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751552AbaEHHj5 (ORCPT ); Thu, 8 May 2014 03:39:57 -0400 Received: from 172.24.2.119 (EHLO szxeml206-edg.china.huawei.com) ([172.24.2.119]) by szxrg03-dlp.huawei.com (MOS 4.4.3-GA FastPath queued) with ESMTP id AOK32850; Thu, 08 May 2014 15:39:15 +0800 (CST) Received: from SZXEML460-HUB.china.huawei.com (10.82.67.203) by szxeml206-edg.china.huawei.com (172.24.2.59) with Microsoft SMTP Server (TLS) id 14.3.158.1; Thu, 8 May 2014 15:38:17 +0800 Received: from [127.0.0.1] (10.177.18.75) by szxeml460-hub.china.huawei.com (10.82.67.203) with Microsoft SMTP Server id 14.3.158.1; Thu, 8 May 2014 15:39:08 +0800 Message-ID: <536B349A.7020306@huawei.com> Date: Thu, 8 May 2014 15:39:06 +0800 From: Wang Weidong User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.0.1 MIME-Version: 1.0 To: Vlad Yasevich , Neil Horman , David Miller CC: Daniel Borkmann , , Subject: [PATCH net-next] sctp: fix kfree static array pointer in sctp_sysctl_net_unregister X-Originating-IP: [10.177.18.75] X-CFilter-Loop: Reflected Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org As commit efb842c45e("sctp: optimize the sctp_sysctl_net_register"), we don't kmemdup a sysctl_table for init_net, so the init_net->sctp.sysctl_header->ctl_table_arg points to sctp_net_table which is a static array pointer. So when doing sctp_sysctl_net_unregister, it will free sctp_net_table, then we will get a NULL pointer dereference like that: [ 262.948220] BUG: unable to handle kernel NULL pointer dereference at 000000000000006c [ 262.948232] IP: [] kfree+0x80/0x420 [ 262.948260] PGD db80a067 PUD dae12067 PMD 0 [ 262.948268] Oops: 0000 [#1] SMP [ 262.948273] Modules linked in: sctp(-) crc32c_generic libcrc32c ... [ 262.948338] task: ffff8800db830190 ti: ffff8800dad00000 task.ti: ffff8800dad00000 [ 262.948344] RIP: 0010:[] [] kfree+0x80/0x420 [ 262.948353] RSP: 0018:ffff8800dad01d88 EFLAGS: 00010046 [ 262.948358] RAX: 0100000000000000 RBX: ffffffffa0227940 RCX: ffffea0000707888 [ 262.948363] RDX: ffffea0000707888 RSI: 0000000000000001 RDI: ffffffffa0227940 [ 262.948369] RBP: ffff8800dad01de8 R08: 0000000000000000 R09: ffff8800d9e983a9 [ 262.948374] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffa0227940 [ 262.948380] R13: ffffffff8187cfc0 R14: 0000000000000000 R15: ffffffff8187da10 [ 262.948386] FS: 00007fa2a2658700(0000) GS:ffff880112800000(0000) knlGS:0000000000000000 [ 262.948394] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 262.948400] CR2: 000000000000006c CR3: 00000000cddc0000 CR4: 00000000000006e0 [ 262.948410] Stack: [ 262.948413] ffff8800dad01da8 0000000000000286 0000000020227940 ffffffffa0227940 [ 262.948422] ffff8800dad01dd8 ffffffff811b7fa1 ffffffffa0227940 ffffffffa0227940 [ 262.948431] ffffffff8187d960 ffffffff8187cfc0 ffffffff8187d960 ffffffff8187da10 [ 262.948440] Call Trace: [ 262.948457] [] ? unregister_sysctl_table+0x51/0xa0 [ 262.948476] [] sctp_sysctl_net_unregister+0x21/0x30 [sctp] [ 262.948490] [] sctp_net_exit+0x12d/0x150 [sctp] [ 262.948512] [] ops_exit_list+0x39/0x60 [ 262.948522] [] unregister_pernet_operations+0x3d/0x70 [ 262.948530] [] unregister_pernet_subsys+0x22/0x40 [ 262.948544] [] sctp_exit+0x3c/0x12d [sctp] [ 262.948562] [] SyS_delete_module+0x194/0x210 [ 262.948577] [] ? trace_hardirqs_on_thunk+0x3a/0x3f [ 262.948587] [] system_call_fastpath+0x16/0x1b So add a check net_namespace init_net before kfree the sysctl_table. Signed-off-by: Wang Weidong --- net/sctp/sysctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c index c82fdc1..844d2b0 100644 --- a/net/sctp/sysctl.c +++ b/net/sctp/sysctl.c @@ -459,7 +459,8 @@ void sctp_sysctl_net_unregister(struct net *net) table = net->sctp.sysctl_header->ctl_table_arg; unregister_net_sysctl_table(net->sctp.sysctl_header); - kfree(table); + if (!net_eq(net, &init_net)) + kfree(table); } static struct ctl_table_header *sctp_sysctl_header;