Eric Dumazet aab456dfa4 net/neigh: fix NULL deref in pneigh_dump_table() ...

pneigh can have NULL device pointer, so we need to make
neigh_master_filtered() and neigh_ifindex_filtered() more robust.

syzbot report :

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15867 Comm: syz-executor2 Not tainted 4.19.0+ #276
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:179 [inline]
RIP: 0010:list_empty include/linux/list.h:203 [inline]
RIP: 0010:netdev_master_upper_dev_get+0xa1/0x250 net/core/dev.c:6467
RSP: 0018:ffff8801bfaf7220 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90005e92000
RDX: 0000000000000016 RSI: ffffffff860b44d9 RDI: 0000000000000005
RBP: ffff8801bfaf72b0 R08: ffff8801c4c84080 R09: fffffbfff139a580
R10: fffffbfff139a580 R11: ffffffff89cd2c07 R12: 1ffff10037f5ee45
R13: 0000000000000000 R14: ffff8801bfaf7288 R15: 00000000000000b0
FS:  00007f65cc68d700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33a21000 CR3: 00000001c6116000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 neigh_master_filtered net/core/neighbour.c:2367 [inline]
 pneigh_dump_table net/core/neighbour.c:2456 [inline]
 neigh_dump_info+0x7a9/0x1ce0 net/core/neighbour.c:2577
 netlink_dump+0x606/0x1080 net/netlink/af_netlink.c:2244
 __netlink_dump_start+0x59a/0x7c0 net/netlink/af_netlink.c:2352
 netlink_dump_start include/linux/netlink.h:216 [inline]
 rtnetlink_rcv_msg+0x809/0xc20 net/core/rtnetlink.c:4898
 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4953
 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 netlink_unicast+0x5a5/0x760 net/netlink/af_netlink.c:1336
 netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
 sock_write_iter+0x35e/0x5c0 net/socket.c:900
 call_write_iter include/linux/fs.h:1808 [inline]
 new_sync_write fs/read_write.c:474 [inline]
 __vfs_write+0x6b8/0x9f0 fs/read_write.c:487
 vfs_write+0x1fc/0x560 fs/read_write.c:549
 ksys_write+0x101/0x260 fs/read_write.c:598
 __do_sys_write fs/read_write.c:610 [inline]
 __se_sys_write fs/read_write.c:607 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:607
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569

Fixes: 6f52f80e85 ("net/neigh: Extend dump filter to proxy neighbor dumps")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Ahern <dsahern@gmail.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Tested-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2018-10-26 16:03:51 -07:00

..

datagram.c

net: udp: fix handling of CHECKSUM_COMPLETE packets

2018-10-24 14:18:16 -07:00

dev_addr_lists.c

net: change the comment of dev_mc_init

2018-04-19 12:58:20 -04:00

dev_ioctl.c

net: remove redundant input checks in SIOCSIFTXQLEN case of dev_ifsioc

2018-07-24 11:36:15 -07:00

dev.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

2018-10-15 23:21:07 -07:00

devlink.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-10-12 21:38:46 -07:00

drop_monitor.c

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

dst_cache.c

net: core: dst_cache_set_ip6: Rename 'addr' parameter to 'saddr' for consistency

2018-03-05 12:52:45 -05:00

dst.c

netfilter: nf_tables: add tunnel support

2018-08-03 21:12:12 +02:00

ethtool.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-10-19 11:03:06 -07:00

failover.c

net: Introduce generic failover module

2018-05-28 22:59:54 -04:00

fib_notifier.c

net: Fix fib notifer to return errno

2018-03-29 14:10:30 -04:00

fib_rules.c

net/fib_rules: Update fib_nl_dumprule for strict data checking

2018-10-08 10:39:05 -07:00

filter.c

bpf: sk_msg program helper bpf_msg_push_data

2018-10-20 21:37:11 +02:00

flow_dissector.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

2018-09-25 20:29:38 -07:00

gen_estimator.c

net: core: protect rate estimator statistics pointer with lock

2018-08-11 12:37:10 -07:00

gen_stats.c

net/core: make function ___gnet_stats_copy_basic() static

2018-09-28 10:25:11 -07:00

gro_cells.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

hwbm.c

net: hwbm: Fix unbalanced spinlock in error case

2016-05-25 12:35:09 -07:00

link_watch.c

net: linkwatch: add check for netdevice being present to linkwatch_do_dev

2018-09-19 21:06:46 -07:00

lwt_bpf.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

2018-08-07 11:02:05 -07:00

lwtunnel.c

ipv6: sr: define core operations for seg6local lightweight tunnel

2017-08-07 14:16:22 -07:00

Makefile

bpf, sockmap: convert to generic sk_msg interface

2018-10-15 12:23:19 -07:00

neighbour.c

net/neigh: fix NULL deref in pneigh_dump_table()

2018-10-26 16:03:51 -07:00

net_namespace.c

net/namespace: Update rtnl_net_dumpid for strict data checking

2018-10-08 10:39:05 -07:00

net-procfs.c

proc: introduce proc_create_net{,_data}

2018-05-16 07:24:30 +02:00

net-sysfs.c

net: allow to call netif_reset_xps_queues() under cpus_read_lock

2018-08-09 14:25:06 -07:00

net-sysfs.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

net-traces.c

net/ipv6: Udate fib6_table_lookup tracepoint

2018-05-24 23:01:15 -04:00

netclassid_cgroup.c

cgroup: add @flags to css_task_iter_start() and implement CSS_TASK_ITER_PROCS

2017-07-21 11:14:51 -04:00

netevent.c

netevent: remove automatic variable in register_netevent_notifier()

2015-05-31 00:03:21 -07:00

netpoll.c

netpoll: allow cleanup to be synchronous

2018-10-19 17:01:43 -07:00

netprio_cgroup.c

net: remove duplicate includes

2017-12-13 13:18:46 -05:00

page_pool.c

net/page_pool: Fix inconsistent lock state warning

2018-07-19 23:23:01 -07:00

pktgen.c

pktgen: Fix fall-through annotation

2018-09-13 15:36:41 -07:00

ptp_classifier.c

ptp: Change ptp_class to a proper bitmask

2015-11-03 11:08:22 -05:00

request_sock.c

ipv4: Namespaceify tcp_max_syn_backlog knob

2016-12-29 11:38:31 -05:00

rtnetlink.c

net: rtnl_dump_all needs to propagate error from dumpit function

2018-10-24 14:06:25 -07:00

scm.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/user.h>

2017-03-02 08:42:29 +01:00

secure_seq.c

infiniband: i40iw, nes: don't use wall time for TCP sequence numbers

2018-07-11 12:10:19 -06:00

skbuff.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-10-21 11:54:28 -07:00

skmsg.c

tls: convert to generic sk_msg interface

2018-10-15 12:23:19 -07:00

sock_diag.c

net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd()

2018-08-14 10:01:24 -07:00

sock_map.c

bpf: skmsg, fix psock create on existing kcm/tls port

2018-10-20 00:40:45 +02:00

sock_reuseport.c

bpf: Enable BPF_PROG_TYPE_SK_REUSEPORT bpf prog in reuseport selection

2018-08-11 01:58:46 +02:00

sock.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

2018-10-15 23:21:07 -07:00

stream.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

sysctl_net_core.c

headers: untangle kmemleak.h from mm.h

2018-04-05 21:36:27 -07:00

timestamping.c

net: skb_defer_rx_timestamp should check for phydev before setting up classify

2015-07-09 14:17:15 -07:00

tso.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

utils.c

net: Remove some unneeded semicolon

2018-08-04 13:05:39 -07:00

xdp.c

xdp: remove redundant variable 'headroom'

2018-09-01 01:35:53 +02:00