Files
android_kernel_xiaomi_sm8450/include/uapi/linux
David Ahern 557c44be91 net: ipv6: RTF_PCPU should not be settable from userspace
Andrey reported a fault in the IPv6 route code:

kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 1 PID: 4035 Comm: a.out Not tainted 4.11.0-rc7+ #250
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880069809600 task.stack: ffff880062dc8000
RIP: 0010:ip6_rt_cache_alloc+0xa6/0x560 net/ipv6/route.c:975
RSP: 0018:ffff880062dced30 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff8800670561c0 RCX: 0000000000000006
RDX: 0000000000000003 RSI: ffff880062dcfb28 RDI: 0000000000000018
RBP: ffff880062dced68 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff880062dcfb28 R14: dffffc0000000000 R15: 0000000000000000
FS:  00007feebe37e7c0(0000) GS:ffff88006cb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000205a0fe4 CR3: 000000006b5c9000 CR4: 00000000000006e0
Call Trace:
 ip6_pol_route+0x1512/0x1f20 net/ipv6/route.c:1128
 ip6_pol_route_output+0x4c/0x60 net/ipv6/route.c:1212
...

Andrey's syzkaller program passes rtmsg.rtmsg_flags with the RTF_PCPU bit
set. Flags passed to the kernel are blindly copied to the allocated
rt6_info by ip6_route_info_create making a newly inserted route appear
as though it is a per-cpu route. ip6_rt_cache_alloc sees the flag set
and expects rt->dst.from to be set - which it is not since it is not
really a per-cpu copy. The subsequent call to __ip6_dst_alloc then
generates the fault.

Fix by checking for the flag and failing with EINVAL.

Fixes: d52d3997f8 ("ipv6: Create percpu rt6_info")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-21 13:55:33 -04:00
..
2014-09-23 23:15:46 -07:00
2017-01-05 13:02:25 +00:00
2016-11-29 09:00:30 +01:00
2013-04-26 16:08:16 +10:00
2016-10-18 10:05:42 -06:00
2014-07-01 10:48:05 -06:00
2014-03-20 14:55:18 +01:00
2015-08-25 14:41:50 -05:00
2014-11-19 14:48:02 -06:00
2016-01-20 17:09:18 -08:00
2015-04-12 21:25:13 -04:00
2016-10-01 07:32:32 +02:00
2015-12-14 12:19:37 -06:00
2013-12-11 12:57:55 -08:00
2017-01-10 14:05:11 -05:00
2017-02-03 15:16:45 -05:00
2016-11-03 15:41:11 -04:00
2016-11-03 15:41:11 -04:00
2014-12-02 13:52:53 -07:00
2016-03-22 15:36:02 -07:00
2016-06-27 16:31:25 +01:00
2016-04-12 19:54:58 +01:00
2015-08-03 17:30:00 -07:00
2014-08-08 15:57:31 -07:00
2015-07-21 10:39:05 -07:00
2017-01-17 14:38:43 -05:00
2015-01-20 13:51:06 +01:00
2014-12-13 12:42:52 -08:00
2017-02-20 11:13:37 -05:00
2015-04-23 15:16:14 -04:00
2015-07-20 14:58:46 -04:00
2017-02-09 15:17:30 +01:00
2016-05-17 17:14:21 -06:00
2017-02-09 22:59:34 -05:00
2017-02-15 11:56:07 -06:00
2017-02-17 12:08:05 -05:00
2016-09-27 21:52:00 -04:00
2016-09-27 21:52:00 -04:00
2015-09-04 16:54:41 -07:00
2016-05-08 23:46:14 -04:00
2016-04-26 12:00:48 -04:00
2017-02-20 11:13:37 -05:00
2017-01-09 16:07:38 -05:00
2016-04-04 22:11:20 -04:00
2017-01-29 19:17:23 -05:00
2014-12-09 14:10:41 +08:00
2013-03-22 16:19:59 -07:00
2017-01-10 18:31:55 -08:00
2015-06-11 23:37:37 +02:00
2015-12-18 17:48:51 -08:00
2015-10-27 18:55:31 -07:00
2016-05-20 17:58:30 -07:00
2016-11-17 08:33:20 -07:00
2016-12-16 00:13:38 +02:00
2016-12-16 00:13:32 +02:00
2015-03-29 12:13:52 +10:30
2016-04-30 09:26:55 -07:00