Artem Savkov 6b6ebb6b01 ip6_offload: check segs for NULL in ipv6_gso_segment. ... segs needs to be checked for being NULL in ipv6_gso_segment() before calling skb_shinfo(segs), otherwise kernel can run into a NULL-pointer dereference: [ 97.811262] BUG: unable to handle kernel NULL pointer dereference at 00000000000000cc [ 97.819112] IP: [<ffffffff816e52f9>] ipv6_gso_segment+0x119/0x2f0 [ 97.825214] PGD 0 [ 97.827047] [ 97.828540] Oops: 0000 [#1] SMP [ 97.831678] Modules linked in: vhost_net vhost macvtap macvlan nfsv3 rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter bridge stp llc snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic snd_hda_intel snd_hda_codec edac_mce_amd snd_hda_core edac_core snd_hwdep kvm_amd snd_seq kvm snd_seq_device snd_pcm irqbypass snd_timer ppdev parport_serial snd parport_pc k10temp pcspkr soundcore parport sp5100_tco shpchp sg wmi i2c_piix4 acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sr_mod cdrom sd_mod ata_generic pata_acpi amdkfd amd_iommu_v2 radeon broadcom bcm_phy_lib i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm ahci serio_raw tg3 firewire_ohci libahci pata_atiixp drm ptp libata firewire_core pps_core i2c_core crc_itu_t fjes dm_mirror dm_region_hash dm_log dm_mod [ 97.927721] CPU: 1 PID: 3504 Comm: vhost-3495 Not tainted 4.9.0-7.el7.test.x86_64 #1 [ 97.935457] Hardware name: AMD Snook/Snook, BIOS ESK0726A 07/26/2010 [ 97.941806] task: ffff880129a1c080 task.stack: ffffc90001bcc000 [ 97.947720] RIP: 0010:[<ffffffff816e52f9>] [<ffffffff816e52f9>] ipv6_gso_segment+0x119/0x2f0 [ 97.956251] RSP: 0018:ffff88012fc43a10 EFLAGS: 00010207 [ 97.961557] RAX: 0000000000000000 RBX: ffff8801292c8700 RCX: 0000000000000594 [ 97.968687] RDX: 0000000000000593 RSI: ffff880129a846c0 RDI: 0000000000240000 [ 97.975814] RBP: ffff88012fc43a68 R08: ffff880129a8404e R09: 0000000000000000 [ 97.982942] R10: 0000000000000000 R11: ffff880129a84076 R12: 00000020002949b3 [ 97.990070] R13: ffff88012a580000 R14: 0000000000000000 R15: ffff88012a580000 [ 97.997198] FS: 0000000000000000(0000) GS:ffff88012fc40000(0000) knlGS:0000000000000000 [ 98.005280] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 98.011021] CR2: 00000000000000cc CR3: 0000000126c5d000 CR4: 00000000000006e0 [ 98.018149] Stack: [ 98.020157] 00000000ffffffff ffff88012fc43ac8 ffffffffa017ad0a 000000000000000e [ 98.027584] 0000001300000000 0000000077d59998 ffff8801292c8700 00000020002949b3 [ 98.035010] ffff88012a580000 0000000000000000 ffff88012a580000 ffff88012fc43a98 [ 98.042437] Call Trace: [ 98.044879] <IRQ> [ 98.046803] [<ffffffffa017ad0a>] ? tg3_start_xmit+0x84a/0xd60 [tg3] [ 98.053156] [<ffffffff815eeee0>] skb_mac_gso_segment+0xb0/0x130 [ 98.059158] [<ffffffff815eefd3>] __skb_gso_segment+0x73/0x110 [ 98.064985] [<ffffffff815ef40d>] validate_xmit_skb+0x12d/0x2b0 [ 98.070899] [<ffffffff815ef5d2>] validate_xmit_skb_list+0x42/0x70 [ 98.077073] [<ffffffff81618560>] sch_direct_xmit+0xd0/0x1b0 [ 98.082726] [<ffffffff815efd86>] __dev_queue_xmit+0x486/0x690 [ 98.088554] [<ffffffff8135c135>] ? cpumask_next_and+0x35/0x50 [ 98.094380] [<ffffffff815effa0>] dev_queue_xmit+0x10/0x20 [ 98.099863] [<ffffffffa09ce057>] br_dev_queue_push_xmit+0xa7/0x170 [bridge] [ 98.106907] [<ffffffffa09ce161>] br_forward_finish+0x41/0xc0 [bridge] [ 98.113430] [<ffffffff81627cf2>] ? nf_iterate+0x52/0x60 [ 98.118735] [<ffffffff81627d6b>] ? nf_hook_slow+0x6b/0xc0 [ 98.124216] [<ffffffffa09ce32c>] __br_forward+0x14c/0x1e0 [bridge] [ 98.130480] [<ffffffffa09ce120>] ? br_dev_queue_push_xmit+0x170/0x170 [bridge] [ 98.137785] [<ffffffffa09ce4bd>] br_forward+0x9d/0xb0 [bridge] [ 98.143701] [<ffffffffa09cfbb7>] br_handle_frame_finish+0x267/0x560 [bridge] [ 98.150834] [<ffffffffa09d0064>] br_handle_frame+0x174/0x2f0 [bridge] [ 98.157355] [<ffffffff8102fb89>] ? sched_clock+0x9/0x10 [ 98.162662] [<ffffffff810b63b2>] ? sched_clock_cpu+0x72/0xa0 [ 98.168403] [<ffffffff815eccf5>] __netif_receive_skb_core+0x1e5/0xa20 [ 98.174926] [<ffffffff813659f9>] ? timerqueue_add+0x59/0xb0 [ 98.180580] [<ffffffff815ed548>] __netif_receive_skb+0x18/0x60 [ 98.186494] [<ffffffff815ee625>] process_backlog+0x95/0x140 [ 98.192145] [<ffffffff815edccd>] net_rx_action+0x16d/0x380 [ 98.197713] [<ffffffff8170cff1>] __do_softirq+0xd1/0x283 [ 98.203106] [<ffffffff8170b2bc>] do_softirq_own_stack+0x1c/0x30 [ 98.209107] <EOI> [ 98.211029] [<ffffffff8108a5c0>] do_softirq+0x50/0x60 [ 98.216166] [<ffffffff815ec853>] netif_rx_ni+0x33/0x80 [ 98.221386] [<ffffffffa09eeff7>] tun_get_user+0x487/0x7f0 [tun] [ 98.227388] [<ffffffffa09ef3ab>] tun_sendmsg+0x4b/0x60 [tun] [ 98.233129] [<ffffffffa0b68932>] handle_tx+0x282/0x540 [vhost_net] [ 98.239392] [<ffffffffa0b68c25>] handle_tx_kick+0x15/0x20 [vhost_net] [ 98.245916] [<ffffffffa0abacfe>] vhost_worker+0x9e/0xf0 [vhost] [ 98.251919] [<ffffffffa0abac60>] ? vhost_umem_alloc+0x40/0x40 [vhost] [ 98.258440] [<ffffffff81003a47>] ? do_syscall_64+0x67/0x180 [ 98.264094] [<ffffffff810a44d9>] kthread+0xd9/0xf0 [ 98.268965] [<ffffffff810a4400>] ? kthread_park+0x60/0x60 [ 98.274444] [<ffffffff8170a4d5>] ret_from_fork+0x25/0x30 [ 98.279836] Code: 8b 93 d8 00 00 00 48 2b 93 d0 00 00 00 4c 89 e6 48 89 df 66 89 93 c2 00 00 00 ff 10 48 3d 00 f0 ff ff 49 89 c2 0f 87 52 01 00 00 <41> 8b 92 cc 00 00 00 48 8b 80 d0 00 00 00 44 0f b7 74 10 06 66 [ 98.299425] RIP [<ffffffff816e52f9>] ipv6_gso_segment+0x119/0x2f0 [ 98.305612] RSP <ffff88012fc43a10> [ 98.309094] CR2: 00000000000000cc [ 98.312406] ---[ end trace 726a2c7a2d2d78d0 ]--- Signed-off-by: Artem Savkov <asavkov@redhat.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-12-02 13:34:58 -05:00
..
6lowpan	6lowpan: ndisc: no overreact if no short address is available	2016-09-19 20:19:34 +02:00
9p	IB/core: add support to create a unsafe global rkey to ib_create_pd	2016-09-23 13:47:44 -04:00
802	net: Kill dev_rebuild_header	2015-03-02 16:43:41 -05:00
8021q	net: add recursion limit to GRO	2016-10-20 14:32:22 -04:00
appletalk	appletalk: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:10 -07:00
atm	lec: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:10 -07:00
ax25	AX.25: Close socket connection on session completion	2016-06-18 20:55:34 -07:00
batman-adv	batman-adv: Detect missing primaryif during tp_send as error	2016-11-04 12:27:39 +01:00
bluetooth	Bluetooth: Fix using the correct source address type	2016-11-22 22:50:46 +01:00
bridge	bridge: multicast: restore perm router ports on multicast enable	2016-10-18 13:52:13 -04:00
caif	caif: Remove unneeded header file	2016-06-28 05:26:14 -04:00
can	can: bcm: fix support for CAN FD frames	2016-11-23 15:22:18 +01:00
ceph	libceph: initialize last_linger_id with a large integer	2016-11-10 20:13:08 +01:00
core	net/rtnetlink: fix attribute name in nlmsg_size() comments	2016-12-02 10:34:59 -05:00
dcb	net/dcb: make dcbnl.c explicitly non-modular	2015-10-09 07:52:27 -07:00
dccp	net/dccp: fix use-after-free in dccp_invalid_packet	2016-11-29 20:37:26 -05:00
decnet	net: fix decnet rtnexthop parsing	2016-07-05 14:08:47 -07:00
dns_resolver	KEYS: Add a facility to restrict new links into a keyring	2016-04-11 22:37:37 +01:00
dsa	net: dsa: slave: fix fixed-link phydev leaks	2016-11-29 23:17:02 -05:00
ethernet	net: add recursion limit to GRO	2016-10-20 14:32:22 -04:00
hsr	net/hsr: Remove unused but set variable	2016-10-18 10:28:18 -04:00
ieee802154	ieee802154: 6lowpan: fix intra pan id check	2016-07-08 13:23:12 +02:00
ipv4	ipv4: Set skb->protocol properly for local output	2016-12-02 12:34:22 -05:00
ipv6	ip6_offload: check segs for NULL in ipv6_gso_segment.	2016-12-02 13:34:58 -05:00
ipx	net: Pass kern from net_proto_family.create to sk_alloc	2015-05-11 10:50:17 -04:00
irda	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-09-23 06:46:57 -04:00
iucv	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2016-07-29 17:38:46 -07:00
kcm	Merge branch 'work.splice_read' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-10-07 15:36:58 -07:00
key	af_key: fix two typos	2015-10-23 03:05:19 -07:00
l2tp	l2tp: fix address test in __l2tp_ip6_bind_lookup()	2016-11-30 14:14:08 -05:00
l3mdev	net: ipv6: Remove l3mdev_get_saddr6	2016-09-10 23:12:53 -07:00
lapb	net/lapb: tuse %*ph to dump buffers	2016-05-29 22:33:25 -07:00
llc	llc: switch type to bool as the timeout is only tested versus 0	2016-09-17 10:05:05 -04:00
mac80211	mac80211: fix A-MSDU aggregation with fast-xmit + txq	2016-11-15 14:37:30 +01:00
mac802154	mac802154: use rate limited warnings for malformed frames	2016-09-19 20:19:34 +02:00
mpls	mpls: move mpls_hdr to a common location	2016-10-03 02:00:21 -04:00
ncsi	net/ncsi: Improve HNCDSC AEN handler	2016-10-20 11:23:08 -04:00
netfilter	netfilter: nft_range: add the missing NULL pointer check	2016-11-24 14:43:35 +01:00
netlabel	netlabel: Implement CALIPSO config functions for SMACK.	2016-06-27 15:06:18 -04:00
netlink	netlink: Call cb->done from a worker thread	2016-11-29 19:48:38 -05:00
netrom	netfilter: Remove spurios included of netfilter.h	2015-06-18 21:14:32 +02:00
nfc	NFC: digital: Fix RTOX supervisor PDU handling	2016-07-11 02:02:03 +02:00
openvswitch	openvswitch: Fix skb leak in IPv6 reassembly.	2016-11-30 11:00:45 -05:00
packet	packet: fix race condition in packet_set_ring	2016-12-02 12:16:49 -05:00
phonet	sock: struct proto hash function may error	2016-02-11 03:54:14 -05:00
qrtr	Merge tag 'qcom-soc-for-4.7-2' into net-next	2016-05-17 14:11:19 -04:00
rds	RDS: TCP: unregister_netdevice_notifier() in error path of rds_tcp_init_net	2016-12-02 13:29:26 -05:00
rfkill	rfkill: Use switch to demux userspace operations	2016-04-05 10:48:53 +02:00
rose	rose: limit sk_filter trim to payload	2016-07-13 11:53:40 -07:00
rxrpc	rxrpc: Fix checking of error from ip6_route_output()	2016-10-13 08:43:17 +01:00
sched	sched: cls_flower: remove from hashtable only in case skip sw flag is not set	2016-11-29 20:44:38 -05:00
sctp	sctp: change sk state only when it has assocs in sctp_shutdown	2016-11-14 16:22:33 -05:00
strparser	strparser: Propagate correct error code in strp_recv()	2016-10-12 01:51:49 -04:00
sunrpc	One fix for an NFS/RDMA crash.	2016-11-18 16:32:21 -08:00
switchdev	switchdev: Execute bridge ndos only for bridge ports	2016-10-19 10:58:04 -04:00
tipc	tipc: fix link statistics counter errors	2016-11-27 20:35:55 -05:00
unix	af_unix: conditionally use freezable blocking calls in read	2016-11-18 13:58:39 -05:00
vmw_vsock	VSOCK: Don't dec ack backlog twice for rejected connections	2016-09-27 07:59:25 -04:00
wimax	net:wimax: Fix doucble word "the the" in networking.xml	2015-08-09 22:43:52 -07:00
wireless	cfg80211: limit scan results cache size	2016-11-18 08:44:44 +01:00
x25	net: x25: remove null checks on arrays calling_ae and called_ae	2016-09-09 18:13:30 -07:00
xfrm	xfrm_user: fix return value from xfrm_user_rcv_msg	2016-11-30 10:58:53 +01:00
compat.c	packet: compat support for sock_fprog	2016-06-09 23:41:03 -07:00
Kconfig	strparser: Stream parser for messages	2016-08-17 19:36:23 -04:00
Makefile	strparser: Stream parser for messages	2016-08-17 19:36:23 -04:00
socket.c	xattr: Fix setting security xattrs on sockfs	2016-11-17 00:00:23 -05:00
sysctl_net.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2016-10-06 09:52:23 -07:00