remarkable-linux

redonkable

Fork of reMarkable kernel https://github.com/reMarkable/linux

Go to file

David Ahern 57d6f87ac3 net/ipv6: prevent use after free in ip6_route_mpath_notify commit `f7225172f2` upstream. syzbot reported a use-after-free: BUG: KASAN: use-after-free in ip6_route_mpath_notify+0xe9/0x100 net/ipv6/route.c:4180 Read of size 4 at addr ffff8801bf789cf0 by task syz-executor756/4555 CPU: 1 PID: 4555 Comm: syz-executor756 Not tainted 4.17.0-rc7+ #78 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 print_address_description+0x6c/0x20b mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432 ip6_route_mpath_notify+0xe9/0x100 net/ipv6/route.c:4180 ip6_route_multipath_add+0x615/0x1910 net/ipv6/route.c:4303 inet6_rtm_newroute+0xe3/0x160 net/ipv6/route.c:4391 ... Allocated by task 4555: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554 dst_alloc+0xbb/0x1d0 net/core/dst.c:104 __ip6_dst_alloc+0x35/0xa0 net/ipv6/route.c:361 ip6_dst_alloc+0x29/0xb0 net/ipv6/route.c:376 ip6_route_info_create+0x4d4/0x3a30 net/ipv6/route.c:2834 ip6_route_multipath_add+0xc7e/0x1910 net/ipv6/route.c:4240 inet6_rtm_newroute+0xe3/0x160 net/ipv6/route.c:4391 ... Freed by task 4555: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kmem_cache_free+0x86/0x2d0 mm/slab.c:3756 dst_destroy+0x267/0x3c0 net/core/dst.c:140 dst_release_immediate+0x71/0x9e net/core/dst.c:205 fib6_add+0xa40/0x1650 net/ipv6/ip6_fib.c:1305 __ip6_ins_rt+0x6c/0x90 net/ipv6/route.c:1011 ip6_route_multipath_add+0x513/0x1910 net/ipv6/route.c:4267 inet6_rtm_newroute+0xe3/0x160 net/ipv6/route.c:4391 ... The problem is that rt_last can point to a deleted route if the insert fails. One reproducer is to insert a route and then add a multipath route that has a duplicate nexthop.e.g,: $ ip -6 ro add vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::2 $ ip -6 ro append vrf red 2001:db8:101::/64 nexthop via 2001:db8:1::4 nexthop via 2001:db8:1::2 Fix by not setting rt_last until the it is verified the insert succeeded. Backport Note: - Upstream has replaced rt6_info usage with fib6_info in `8d1c802b28` ("net/ipv6: Flip FIB entries to fib6_info") - fib6_info_release was introduced upstream in `93531c6743` ("net/ipv6: separate handling of FIB entries from dst based routes"), but is not present in stable kernels; 4.14.y relies on dst_release/ ip6_rt_put/dst_release_immediate. Fixes: `3b1137fe74` ("net: ipv6: Change notifications for multipath add to RTA_MULTIPATH") Cc: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David Ahern <dsahern@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Zubin Mithra <zsm@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-09-26 08:38:14 +02:00
Documentation	inet: frags: break the 2GB limit for frags storage	2018-09-19 22:43:46 +02:00
arch	ARM: hisi: check of_iomap and fix missing of_node_put	2018-09-26 08:38:10 +02:00
block	blk-mq: avoid to synchronize rcu inside blk_cleanup_queue()	2018-09-26 08:38:13 +02:00
certs	Replace magic for trusting the secondary keyring with #define	2018-09-09 19:55:54 +02:00
crypto	evm: Don't deadlock if a crypto algorithm is unavailable	2018-09-26 08:38:09 +02:00
drivers	drm/i915: Apply the GTT write flush for all !llc machines	2018-09-26 08:38:14 +02:00
firmware	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
fs	configfs: fix registered group removal	2018-09-26 08:38:10 +02:00
include	evm: Don't deadlock if a crypto algorithm is unavailable	2018-09-26 08:38:09 +02:00
init	init: rename and re-order boot_cpu_state_init()	2018-08-15 18:12:48 +02:00
ipc	ipc/sem.c: prevent queue.status tearing in semop	2018-09-05 09:26:30 +02:00
kernel	sched/fair: Fix util_avg of new tasks for asymmetric systems	2018-09-26 08:38:12 +02:00
lib	rhashtable: add schedule points	2018-09-19 22:43:45 +02:00
mm	mm: get rid of vmacache_flush_all() entirely	2018-09-19 22:43:48 +02:00
net	net/ipv6: prevent use after free in ip6_route_mpath_notify	2018-09-26 08:38:14 +02:00
samples	samples/bpf: Check the error of write() and read()	2018-08-24 13:09:12 +02:00
scripts	kbuild: add .DELETE_ON_ERROR special target	2018-09-26 08:37:59 +02:00
security	security: check for kstrdup() failure in lsm_append()	2018-09-26 08:38:09 +02:00
sound	ASoC: samsung: Fix invalid argument when devm_gpiod_get is called	2018-09-26 08:38:14 +02:00
tools	selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress	2018-09-26 08:38:13 +02:00
usr	initramfs: fix initramfs rebuilds w/ compression after disabling	2017-11-03 07:39:19 -07:00
virt	KVM: arm/arm64: Fix vgic init race	2018-09-26 08:38:04 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	Add hch to .get_maintainer.ignore	2015-08-21 14:30:10 -07:00
.gitattributes	.gitattributes: set git diff driver for C source code files	2016-10-07 18:46:30 -07:00
.gitignore	kbuild: rpm-pkg: keep spec file until make mrproper	2018-02-13 10:19:46 +01:00
.mailmap	.mailmap: Add Maciej W. Rozycki's Imagination e-mail address	2017-11-10 12:16:15 -08:00
COPYING	…
CREDITS	MAINTAINERS: update TPM driver infrastructure changes	2017-11-09 17:58:40 -08:00
Kbuild	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
Kconfig	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
MAINTAINERS	dt-bindings: Document mti,mips-cpc binding	2018-03-15 10:54:35 +01:00
Makefile	Linux 4.14.71	2018-09-19 22:43:49 +02:00
README	README: add a new README file, pointing to the Documentation/	2016-10-24 08:12:35 -02:00

README

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.