From patchwork Tue Nov 6 14:46:34 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gavin Guo X-Patchwork-Id: 993737 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 42qCVM3jSrz9sDN; Wed, 7 Nov 2018 02:03:39 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1gK2tC-0004bx-VY; Tue, 06 Nov 2018 15:03:34 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.86_2) (envelope-from ) id 1gK2cw-0001D9-5J for kernel-team@lists.ubuntu.com; Tue, 06 Nov 2018 14:46:46 +0000 Received: from mail-pf1-f197.google.com ([209.85.210.197]) by youngberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1gK2cv-0002P7-7z for kernel-team@lists.ubuntu.com; Tue, 06 Nov 2018 14:46:45 +0000 Received: by mail-pf1-f197.google.com with SMTP id n22-v6so12674893pff.2 for ; Tue, 06 Nov 2018 06:46:45 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=rtihix8F1qNXFMy7HE8XAKgpwQPUTKFCMMsyBL4VuDU=; b=cEOjVJFo3udavlnGJuTZDPF9rIGihM8pzzvq4Uw6rVBbvlxRfN6UYtKgvCgTgIUtzs CwT4kY12pAUsx86/ocH/njanLAKqnDo1iEV/IiicxzCpK6jnjQ/tdwIO+2SpchqMzrlO IbT+ekYQEYfI0Vy3Buhm6xbqXKYH4Oyvg3Q/WTdvSikdiVQ4rQN5y7flnZ7xIQtR8YnF O1KriWRjC9gDsDZaDY++kyaq852hnogOpRbJAkKvSUdzi7f5Fy8/8+aG/uaDtGlam9UD zj9Dtixyyb0eQ6SKmimcwRcbKAKLqk0skxWtkhwkpehBaDf4vRGhXMkPHRmGQvN+H3sG uSzA== X-Gm-Message-State: AGRZ1gKGBkNrLOGQGDxS3mu/U1Xp1UUIvWctHRSBGPtVG+LNOFDD6/wG 3d6bRekGlVvXAem6usoz/ReDfjBflSHd7OdZOsbHkto0DE26CsZ4mABqItwX3k76EZdMjPp/jD4 AASFzD5lYG/nfzaigPJKFU3CBUCCAUzJYthC3DB5dqA== X-Received: by 2002:a17:902:9897:: with SMTP id s23-v6mr8183939plp.229.1541515603675; Tue, 06 Nov 2018 06:46:43 -0800 (PST) X-Google-Smtp-Source: AJdET5dl44ETV5OeoW8gPmWONr7OfQN0yHUWEUlURMZMJcSjtIyabGkne/drSZQKlCaHV7w4Q0pmgg== X-Received: by 2002:a17:902:9897:: with SMTP id s23-v6mr8183928plp.229.1541515603417; Tue, 06 Nov 2018 06:46:43 -0800 (PST) Received: from gavin-P70.buildd (114-35-245-81.HINET-IP.hinet.net. [114.35.245.81]) by smtp.gmail.com with ESMTPSA id p87-v6sm47862744pfk.186.2018.11.06.06.46.41 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 06 Nov 2018 06:46:42 -0800 (PST) From: Gavin Guo To: kernel-team@lists.ubuntu.com Subject: [SRU][Xenial][Bionic][Cosmic][PATCH] xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry. Date: Tue, 6 Nov 2018 22:46:34 +0800 Message-Id: <1541515594-22183-2-git-send-email-gavin.guo@canonical.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1541515594-22183-1-git-send-email-gavin.guo@canonical.com> References: <1541515594-22183-1-git-send-email-gavin.guo@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Steffen Klassert BugLink: https://bugs.launchpad.net/bugs/1801878 Since commit 222d7dbd258d ("net: prevent dst uses after free") skb_dst_force() might clear the dst_entry attached to the skb. The xfrm code don't expect this to happen, so we crash with a NULL pointer dereference in this case. Fix it by checking skb_dst(skb) for NULL after skb_dst_force() and drop the packet in cast the dst_entry was cleared. Fixes: 222d7dbd258d ("net: prevent dst uses after free") Reported-by: Tobias Hommel Reported-by: Kristian Evensen Reported-by: Wolfgang Walter Signed-off-by: Steffen Klassert (cherry picked from commit 9e1437937807b0122e8da1ca8765be2adca9aee6) Signed-off-by: Gavin Guo Acked-by: Kleber Sacilotto de Souza Acked-by: Stefan Bader --- net/xfrm/xfrm_output.c | 4 ++++ net/xfrm/xfrm_policy.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index 35610cc881a9..c47660fba498 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -101,6 +101,10 @@ static int xfrm_output_one(struct sk_buff *skb, int err) spin_unlock_bh(&x->lock); skb_dst_force(skb); + if (!skb_dst(skb)) { + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); + goto error_nolock; + } if (xfrm_offload(skb)) { x->type_offload->encap(x, skb); diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 7bcd6f1b86a0..1690efebba8a 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -2544,6 +2544,10 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family) } skb_dst_force(skb); + if (!skb_dst(skb)) { + XFRM_INC_STATS(net, LINUX_MIB_XFRMFWDHDRERROR); + return 0; + } dst = xfrm_lookup(net, skb_dst(skb), &fl, NULL, XFRM_LOOKUP_QUEUE); if (IS_ERR(dst)) {