Eric Dumazet aa38bea47f ipv6: restrict IPV6_ADDRFORM operation ... commit b6f6118901 upstream. IPV6_ADDRFORM is able to transform IPv6 socket to IPv4 one. While this operation sounds illogical, we have to support it. One of the things it does for TCP socket is to switch sk->sk_prot to tcp_prot. We now have other layers playing with sk->sk_prot, so we should make sure to not interfere with them. This patch makes sure sk_prot is the default pointer for TCP IPv6 socket. syzbot reported : BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD a0113067 P4D a0113067 PUD a8771067 PMD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 10686 Comm: syz-executor.0 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246 RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40 RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5 R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098 R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000 FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_release+0x165/0x1c0 net/ipv4/af_inet.c:427 __sock_release net/socket.c:605 [inline] sock_close+0xe1/0x260 net/socket.c:1283 __fput+0x2e4/0x740 fs/file_table.c:280 ____fput+0x15/0x20 fs/file_table.c:313 task_work_run+0x176/0x1b0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:164 [inline] prepare_exit_to_usermode+0x480/0x5b0 arch/x86/entry/common.c:195 syscall_return_slowpath+0x113/0x4a0 arch/x86/entry/common.c:278 do_syscall_64+0x11f/0x1c0 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45c429 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f2ae75dac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: 0000000000000000 RBX: 00007f2ae75db6d4 RCX: 000000000045c429 RDX: 0000000000000001 RSI: 000000000000011a RDI: 0000000000000004 RBP: 000000000076bf20 R08: 0000000000000038 R09: 0000000000000000 R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000a9d R14: 00000000004ccfb4 R15: 000000000076bf2c Modules linked in: CR2: 0000000000000000 ---[ end trace 82567b5207e87bae ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246 RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40 RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5 R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098 R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000 FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 604326b41a ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot+1938db17e275e85dc328@syzkaller.appspotmail.com Cc: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-03-18 07:17:59 +01:00
..
ila	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
netfilter	netfilter: drop bridge nf reset from nf_reset	2019-10-01 18:42:15 +02:00
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	xfrm: make xfrm modes builtin	2019-04-08 09:15:17 +02:00
addrconf.c	net/ipv6: remove the old peer route if change it to a new one	2020-03-18 07:17:47 +01:00
addrconf_core.c	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2019-12-18 16:08:42 +01:00
addrlabel.c	netlink: make validation more configurable for future strictness	2019-04-27 17:07:21 -04:00
af_inet6.c	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2019-12-18 16:08:42 +01:00
ah6.c	ipv6: Use ipv6_authlen for len	2019-07-11 14:43:25 -07:00
anycast.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
calipso.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
datagram.c	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-18 16:08:40 +01:00
esp6.c	xfrm: remove get_mtu indirection from xfrm_type	2019-07-01 06:16:40 +02:00
esp6_offload.c	xfrm: support output_mark for offload ESP packets	2020-01-29 16:45:31 +01:00
exthdrs.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
exthdrs_core.c	ipv6: remove printk	2019-07-27 14:23:48 -07:00
exthdrs_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
fib6_notifier.c	net: Add module reference to FIB notifiers	2017-09-01 20:33:42 -07:00
fib6_rules.c	ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule	2019-09-26 09:34:25 +02:00
fou6.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
icmp.c	ipv6: icmp: allow flowlabel reflection in echo replies	2019-07-01 10:54:51 -07:00
inet6_connection_sock.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:18:58 +01:00
inet6_hashtables.c	net: annotate accesses to sk->sk_incoming_cpu	2019-10-30 13:24:25 -07:00
ip6_checksum.c	net: udp: fix handling of CHECKSUM_COMPLETE packets	2018-10-24 14:18:16 -07:00
ip6_fib.c	ipv6: Fix route replacement with dev-only route	2020-03-05 16:43:35 +01:00
ip6_flowlabel.c	ipv6: fix static key imbalance in fl_create()	2019-07-11 14:43:25 -07:00
ip6_gre.c	net: ip6_gre: fix moving ip6gre between namespaces	2020-01-29 16:45:20 +01:00
ip6_icmp.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ip6_input.c	ipv6: drop incoming packets having a v4mapped source address	2019-10-03 11:40:21 -04:00
ip6_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ip6_offload.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ip6_output.c	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-18 16:08:40 +01:00
ip6_tunnel.c	net, ip6_tunnel: fix namespaces move	2020-01-29 16:45:20 +01:00
ip6_udp_tunnel.c	treewide: Add SPDX license identifier for more missed files	2019-05-21 10:50:45 +02:00
ip6_vti.c	vti[6]: fix packet tx through bpf_redirect()	2020-02-05 21:22:48 +00:00
ip6mr.c	ipmr: remove hard code cache_resolve_queue_len limit	2019-09-07 17:49:00 +02:00
ipcomp6.c	xfrm: remove type and offload_type map from xfrm_state_afinfo	2019-06-06 08:34:50 +02:00
ipv6_sockglue.c	ipv6: restrict IPV6_ADDRFORM operation	2020-03-18 07:17:59 +01:00
mcast.c	mld: fix memory leak in mld_del_delrec()	2019-08-28 14:47:35 -07:00
mcast_snoop.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 343	2019-06-05 17:37:07 +02:00
mip6.c	xfrm: remove type and offload_type map from xfrm_state_afinfo	2019-06-06 08:34:50 +02:00
ndisc.c	net-ipv6-ndisc: add support for RFC7710 RA Captive Portal Identifier	2019-07-22 12:10:54 -07:00
netfilter.c	net: ensure correct skb->tstamp in various fragmenters	2019-10-18 10:02:37 -07:00
output_core.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
ping.c	ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'	2019-09-12 11:20:33 +01:00
proc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-07 11:00:14 -07:00
protocol.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
raw.c	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-18 16:08:40 +01:00
reassembly.c	inet: frags: re-introduce skb coalescing for local delivery	2019-08-08 15:55:10 -07:00
route.c	ipv6: Fix nlmsg_flags when splitting a multipath route	2020-03-05 16:43:35 +01:00
seg6.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
seg6_hmac.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
seg6_iptunnel.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
seg6_local.c	ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions	2020-01-29 16:45:20 +01:00
sit.c	sit: do not confirm neighbor when do pmtu update	2020-01-04 19:19:04 +01:00
syncookies.c	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-18 16:08:40 +01:00
sysctl_net_ipv6.c	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
tcp_ipv6.c	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-18 16:08:40 +01:00
tcpv6_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
tunnel6.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
udp.c	net: annotate accesses to sk->sk_incoming_cpu	2019-10-30 13:24:25 -07:00
udp_impl.h	udp6: add missing rehash callback to udplite	2019-01-17 15:01:08 -08:00
udp_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
udplite.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
xfrm6_input.c	net: use skb_sec_path helper in more places	2018-12-19 11:21:37 -08:00
xfrm6_output.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
xfrm6_policy.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:18:58 +01:00
xfrm6_protocol.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
xfrm6_state.c	xfrm: remove eth_proto value from xfrm_state_afinfo	2019-06-06 08:34:50 +02:00
xfrm6_tunnel.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00