forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
linux-pinenote/drivers
History
Guillaume Nault 1f461dcdd2 ppp: take reference on channels netns 
Let channels hold a reference on their network namespace.
Some channel types, like ppp_async and ppp_synctty, can have their
userspace controller running in a different namespace. Therefore they
can't rely on them to preclude their netns from being removed from
under them.

==================================================================
BUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at
addr ffff880064e217e0
Read of size 8 by task syz-executor/11581
=============================================================================
BUG net_namespace (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: Allocated in copy_net_ns+0x6b/0x1a0 age=92569 cpu=3 pid=6906
[<      none      >] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440
[<      none      >] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469
[<     inline     >] slab_alloc_node kernel/mm/slub.c:2532
[<     inline     >] slab_alloc kernel/mm/slub.c:2574
[<      none      >] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579
[<     inline     >] kmem_cache_zalloc kernel/include/linux/slab.h:597
[<     inline     >] net_alloc kernel/net/core/net_namespace.c:325
[<      none      >] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360
[<      none      >] create_new_namespaces+0x2f6/0x610 kernel/kernel/nsproxy.c:95
[<      none      >] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150
[<      none      >] copy_process.part.35+0x1bf4/0x5760 kernel/kernel/fork.c:1451
[<     inline     >] copy_process kernel/kernel/fork.c:1274
[<      none      >] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723
[<     inline     >] SYSC_clone kernel/kernel/fork.c:1832
[<      none      >] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826
[<      none      >] entry_SYSCALL_64_fastpath+0x16/0x7a kernel/arch/x86/entry/entry_64.S:185

INFO: Freed in net_drop_ns+0x67/0x80 age=575 cpu=2 pid=2631
[<      none      >] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650
[<     inline     >] slab_free kernel/mm/slub.c:2805
[<      none      >] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814
[<     inline     >] net_free kernel/net/core/net_namespace.c:341
[<      none      >] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348
[<      none      >] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448
[<      none      >] process_one_work+0x794/0x1440 kernel/kernel/workqueue.c:2036
[<      none      >] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170
[<      none      >] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303
[<      none      >] ret_from_fork+0x3f/0x70 kernel/arch/x86/entry/entry_64.S:468
INFO: Slab 0xffffea0001938800 objects=3 used=0 fp=0xffff880064e20000
flags=0x5fffc0000004080
INFO: Object 0xffff880064e20000 @offset=0 fp=0xffff880064e24200

CPU: 1 PID: 11581 Comm: syz-executor Tainted: G    B           4.4.0+
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
 00000000ffffffff ffff8800662c7790 ffffffff8292049d ffff88003e36a300
 ffff880064e20000 ffff880064e20000 ffff8800662c77c0 ffffffff816f2054
 ffff88003e36a300 ffffea0001938800 ffff880064e20000 0000000000000000
Call Trace:
 [<     inline     >] __dump_stack kernel/lib/dump_stack.c:15
 [<ffffffff8292049d>] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50
 [<ffffffff816f2054>] print_trailer+0xf4/0x150 kernel/mm/slub.c:654
 [<ffffffff816f875f>] object_err+0x2f/0x40 kernel/mm/slub.c:661
 [<     inline     >] print_address_description kernel/mm/kasan/report.c:138
 [<ffffffff816fb0c5>] kasan_report_error+0x215/0x530 kernel/mm/kasan/report.c:236
 [<     inline     >] kasan_report kernel/mm/kasan/report.c:259
 [<ffffffff816fb4de>] __asan_report_load8_noabort+0x3e/0x40 kernel/mm/kasan/report.c:280
 [<     inline     >] ? ppp_pernet kernel/include/linux/compiler.h:218
 [<ffffffff83ad71b2>] ? ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
 [<     inline     >] ppp_pernet kernel/include/linux/compiler.h:218
 [<ffffffff83ad71b2>] ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
 [<     inline     >] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293
 [<ffffffff83ad6f26>] ? ppp_unregister_channel+0xe6/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
 [<ffffffff83ae18f3>] ppp_asynctty_close+0xa3/0x130 kernel/drivers/net/ppp/ppp_async.c:241
 [<ffffffff83ae1850>] ? async_lcp_peek+0x5b0/0x5b0 kernel/drivers/net/ppp/ppp_async.c:1000
 [<ffffffff82c33239>] tty_ldisc_close.isra.1+0x99/0xe0 kernel/drivers/tty/tty_ldisc.c:478
 [<ffffffff82c332c0>] tty_ldisc_kill+0x40/0x170 kernel/drivers/tty/tty_ldisc.c:744
 [<ffffffff82c34943>] tty_ldisc_release+0x1b3/0x260 kernel/drivers/tty/tty_ldisc.c:772
 [<ffffffff82c1ef21>] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901
 [<ffffffff82c1e460>] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688
 [<ffffffff8174de36>] __fput+0x236/0x780 kernel/fs/file_table.c:208
 [<ffffffff8174e405>] ____fput+0x15/0x20 kernel/fs/file_table.c:244
 [<ffffffff813595ab>] task_work_run+0x16b/0x200 kernel/kernel/task_work.c:115
 [<     inline     >] exit_task_work kernel/include/linux/task_work.h:21
 [<ffffffff81307105>] do_exit+0x8b5/0x2c60 kernel/kernel/exit.c:750
 [<ffffffff813fdd20>] ? debug_check_no_locks_freed+0x290/0x290 kernel/kernel/locking/lockdep.c:4123
 [<ffffffff81306850>] ? mm_update_next_owner+0x6f0/0x6f0 kernel/kernel/exit.c:357
 [<ffffffff813215e6>] ? __dequeue_signal+0x136/0x470 kernel/kernel/signal.c:550
 [<ffffffff8132067b>] ? recalc_sigpending_tsk+0x13b/0x180 kernel/kernel/signal.c:145
 [<ffffffff81309628>] do_group_exit+0x108/0x330 kernel/kernel/exit.c:880
 [<ffffffff8132b9d4>] get_signal+0x5e4/0x14f0 kernel/kernel/signal.c:2307
 [<     inline     >] ? kretprobe_table_lock kernel/kernel/kprobes.c:1113
 [<ffffffff8151d355>] ? kprobe_flush_task+0xb5/0x450 kernel/kernel/kprobes.c:1158
 [<ffffffff8115f7d3>] do_signal+0x83/0x1c90 kernel/arch/x86/kernel/signal.c:712
 [<ffffffff8151d2a0>] ? recycle_rp_inst+0x310/0x310 kernel/include/linux/list.h:655
 [<ffffffff8115f750>] ? setup_sigcontext+0x780/0x780 kernel/arch/x86/kernel/signal.c:165
 [<ffffffff81380864>] ? finish_task_switch+0x424/0x5f0 kernel/kernel/sched/core.c:2692
 [<     inline     >] ? finish_lock_switch kernel/kernel/sched/sched.h:1099
 [<ffffffff81380560>] ? finish_task_switch+0x120/0x5f0 kernel/kernel/sched/core.c:2678
 [<     inline     >] ? context_switch kernel/kernel/sched/core.c:2807
 [<ffffffff85d794e9>] ? __schedule+0x919/0x1bd0 kernel/kernel/sched/core.c:3283
 [<ffffffff81003901>] exit_to_usermode_loop+0xf1/0x1a0 kernel/arch/x86/entry/common.c:247
 [<     inline     >] prepare_exit_to_usermode kernel/arch/x86/entry/common.c:282
 [<ffffffff810062ef>] syscall_return_slowpath+0x19f/0x210 kernel/arch/x86/entry/common.c:344
 [<ffffffff85d88022>] int_ret_from_sys_call+0x25/0x9f kernel/arch/x86/entry/entry_64.S:281
Memory state around the buggy address:
 ffff880064e21680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff880064e21700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff880064e21780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                       ^
 ffff880064e21800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff880064e21880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Fixes: 273ec51dd7 ("net: ppp_generic - introduce net-namespace functionality v2")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-03-23 14:35:31 -04:00
..
accessibility
acpi libnvdimm for 4.6 2016-03-16 17:45:56 -07:00
amba
android Merge 4.5-rc6 into char-misc-next 2016-03-01 16:38:16 -08:00
ata Merge branch 'for-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata 2016-03-18 20:06:46 -07:00
atm Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2016-03-17 21:38:27 -07:00
auxdisplay
base Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2016-03-19 16:31:54 -07:00
bcma bcma: move flash detection code to ChipCommon core driver 2016-03-07 14:41:08 +02:00
block Merge branch 'akpm' (patches from Andrew) 2016-03-18 19:26:54 -07:00
bluetooth Bluetooth: btmrvl_sdio: fix firmware activation failure 2016-03-10 19:51:29 +01:00
bus bus: mvebu-mbus: provide api for obtaining IO and DRAM window information 2016-03-14 12:19:46 -04:00
cdrom
char ipmi: do not probe ACPI devices if si_tryacpi is unset 2016-03-18 07:01:24 -05:00
clk Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2016-03-19 16:31:54 -07:00
clocksource One of the largest releases for KVM... Hardly any generic improvement, 2016-03-16 09:55:35 -07:00
connector
cpufreq Merge branch 'pm-cpufreq' 2016-03-14 14:22:03 +01:00
cpuidle
crypto Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2016-03-17 21:38:27 -07:00
dca
devfreq PM / devfreq: tegra: Set freq in rate callback 2016-02-23 14:27:42 +09:00
dio
dma dmaengine updates for 4.6 2016-03-17 12:34:54 -07:00
dma-buf
edac EDAC queue for 4.6 2016-03-16 08:36:55 -07:00
eisa
extcon extcon: palmas: Drop IRQF_EARLY_RESUME flag 2016-02-29 11:07:34 +09:00
firewire
firmware Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2016-03-19 16:31:54 -07:00
fmc
fpga
gpio - New Drivers 2016-03-18 10:15:11 -07:00
gpu Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2016-03-19 10:05:34 -07:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2016-03-17 21:32:20 -07:00
hsi
hv Char/Misc patches for 4.6-rc1 2016-03-17 13:47:50 -07:00
hwmon hwmon: Create an NSA320 hardware monitoring driver 2016-03-08 18:40:49 -08:00
hwspinlock
hwtracing drivers/hwtracing: make coresight-etm-perf.c explicitly non-modular 2016-03-05 12:19:39 -08:00
i2c i2c: designware: Add device HID for future AMD I2C controller 2016-03-10 21:34:47 +01:00
ide ide: hpt366: convert to use match_string() helper 2016-03-17 15:09:34 -07:00
idle
iio - New Drivers 2016-03-18 10:15:11 -07:00
infiniband Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2016-03-19 10:05:34 -07:00
input - New Drivers 2016-03-18 10:15:11 -07:00
iommu iommu/vt-d: Use BUS_NOTIFY_REMOVED_DEVICE in hotplug path 2016-02-29 23:55:16 +01:00
ipack
irqchip irqchip/irq-alpine-msi: Release the correct domain on error 2016-03-11 10:06:55 +01:00
isdn isdn: Use ktime_t instead of 'struct timeval' 2016-03-20 16:47:13 -04:00
leds leds: triggers: simplify led_trigger_store 2016-03-14 09:22:23 +01:00
lguest
lightnvm Merge branch 'for-4.6/drivers' of git://git.kernel.dk/linux-block 2016-03-18 17:13:31 -07:00
macintosh
mailbox Merge branches 'acpi-processor' and 'acpi-cppc' 2016-03-14 14:20:33 +01:00
mcb
md Merge branch 'for-4.6/drivers' of git://git.kernel.dk/linux-block 2016-03-18 17:13:31 -07:00
media Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2016-03-19 16:31:54 -07:00
memory
memstick
message mptbase: fixup error handling paths in mpt_attach() 2016-02-23 21:27:02 -05:00
mfd - New Drivers 2016-03-18 10:15:11 -07:00
misc powerpc updates for 4.6 2016-03-19 15:38:41 -07:00
mmc TTY/Serial patches for 4.6-rc1 2016-03-17 13:53:25 -07:00
mtd This is the bulk of GPIO changes for kernel v4.6: 2016-03-17 21:05:32 -07:00
net ppp: take reference on channels netns 2016-03-23 14:35:31 -04:00
nfc Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2016-03-19 10:05:34 -07:00
ntb
nubus
nvdimm Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2016-03-19 16:31:54 -07:00
nvme Merge branch 'for-4.6/drivers' of git://git.kernel.dk/linux-block 2016-03-18 17:13:31 -07:00
nvmem nvmem: mediatek: Fix later provider initialization 2016-03-05 12:20:29 -08:00
of DeviceTree updates for 4.6: 2016-03-19 15:15:07 -07:00
oprofile
parisc PCI changes for the v4.6 merge window: 2016-03-16 14:45:55 -07:00
parport
pci powerpc updates for 4.6 2016-03-19 15:38:41 -07:00
pcmcia
perf
phy phy: for 4.6 2016-03-05 12:22:41 -08:00
pinctrl Merge branch 'akpm' (patches from Andrew) 2016-03-18 19:26:54 -07:00
platform Staging driver patches for 4.6-rc1 2016-03-17 22:13:41 -07:00
pnp PNP / ACPI: add ACPI_RESOURCE_TYPE_SERIAL_BUS as a valid type 2016-03-09 23:50:55 +01:00
power Merge branch 'akpm' (patches from Andrew) 2016-03-18 19:26:54 -07:00
powercap powercap/rapl: track lead cpu per package 2016-03-09 00:26:44 +01:00
pps
ps3
ptp Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-03-15 12:13:56 -07:00
pwm
rapidio
ras
regulator - New Drivers 2016-03-18 10:15:11 -07:00
remoteproc
reset
rpmsg
rtc Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2016-03-17 21:38:27 -07:00
s390 TTY/Serial patches for 4.6-rc1 2016-03-17 13:53:25 -07:00
sbus
scsi powerpc updates for 4.6 2016-03-19 15:38:41 -07:00
sfi
sh Linux 4.5-rc6 2016-03-04 12:12:08 +01:00
sn
soc powerpc updates for 4.6 2016-03-19 15:38:41 -07:00
spi dmaengine updates for 4.6 2016-03-17 12:34:54 -07:00
spmi
ssb ssb: host_soc depends on sprom 2016-02-26 12:47:32 +02:00
staging Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2016-03-19 10:05:34 -07:00
target Configfs changes for the 4.6 merge window: 2016-03-17 16:25:46 -07:00
tc
thermal
thunderbolt
tty serial: 8250: describe CONFIG_SERIAL_8250_RSA 2016-03-07 16:11:14 -08:00
uio
usb Merge branch 'akpm' (patches from Andrew) 2016-03-18 19:26:54 -07:00
uwb
vfio VFIO updates for v4.6-rc1 2016-03-17 13:05:09 -07:00
vhost vhost: fix error path in vhost_init_used() 2016-03-02 17:01:49 +02:00
video This is the bulk of GPIO changes for kernel v4.6: 2016-03-17 21:05:32 -07:00
virt
virtio virtio_balloon: export 'available' memory to balloon statistics 2016-03-17 15:09:34 -07:00
vlynq
vme
w1
watchdog Become maintainer, add hardening tests for use-after-free and atomic wrapping. 2016-03-01 16:51:19 -08:00
xen xen_balloon: support memory auto onlining policy 2016-03-15 16:55:16 -07:00
zorro
Kconfig
Makefile