• Taehee Yoo's avatar
    net: rmnet: fix NULL pointer dereference in rmnet_newlink() · 93b5cbfa
    Taehee Yoo authored
    rmnet registers IFLA_LINK interface as a lower interface.
    But, IFLA_LINK could be NULL.
    In the current code, rmnet doesn't check IFLA_LINK.
    So, panic would occur.
    
    Test commands:
        modprobe rmnet
        ip link add rmnet0 type rmnet mux_id 1
    
    Splat looks like:
    [   36.826109][ T1115] general protection fault, probably for non-canonical address 0xdffffc0000000000I
    [   36.838817][ T1115] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
    [   36.839908][ T1115] CPU: 1 PID: 1115 Comm: ip Not tainted 5.6.0-rc1+ #447
    [   36.840569][ T1115] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
    [   36.841408][ T1115] RIP: 0010:rmnet_newlink+0x54/0x510 [rmnet]
    [   36.841986][ T1115] Code: 83 ec 18 48 c1 e9 03 80 3c 01 00 0f 85 d4 03 00 00 48 8b 6a 28 48 b8 00 00 00 00 00 c
    [   36.843923][ T1115] RSP: 0018:ffff8880b7e0f1c0 EFLAGS: 00010247
    [   36.844756][ T1115] RAX: dffffc0000000000 RBX: ffff8880d14cca00 RCX: 1ffff11016fc1e99
    [   36.845859][ T1115] RDX: 0000000000000000 RSI: ffff8880c3d04000 RDI: 0000000000000004
    [   36.846961][ T1115] RBP: 0000000000000000 R08: ffff8880b7e0f8b0 R09: ffff8880b6ac2d90
    [   36.848020][ T1115] R10: ffffffffc0589a40 R11: ffffed1016d585b7 R12: ffffffff88ceaf80
    [   36.848788][ T1115] R13: ffff8880c3d04000 R14: ffff8880b7e0f8b0 R15: ffff8880c3d04000
    [   36.849546][ T1115] FS:  00007f50ab3360c0(0000) GS:ffff8880da000000(0000) knlGS:0000000000000000
    [   36.851784][ T1115] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   36.852422][ T1115] CR2: 000055871afe5ab0 CR3: 00000000ae246001 CR4: 00000000000606e0
    [   36.853181][ T1115] Call Trace:
    [   36.853514][ T1115]  __rtnl_newlink+0xbdb/0x1270
    [   36.853967][ T1115]  ? lock_downgrade+0x6e0/0x6e0
    [   36.854420][ T1115]  ? rtnl_link_unregister+0x220/0x220
    [   36.854936][ T1115]  ? lock_acquire+0x164/0x3b0
    [   36.855376][ T1115]  ? is_bpf_image_address+0xff/0x1d0
    [   36.855884][ T1115]  ? rtnl_newlink+0x4c/0x90
    [   36.856304][ T1115]  ? kernel_text_address+0x111/0x140
    [   36.856857][ T1115]  ? __kernel_text_address+0xe/0x30
    [   36.857440][ T1115]  ? unwind_get_return_address+0x5f/0xa0
    [   36.858063][ T1115]  ? create_prof_cpu_mask+0x20/0x20
    [   36.858644][ T1115]  ? arch_stack_walk+0x83/0xb0
    [   36.859171][ T1115]  ? stack_trace_save+0x82/0xb0
    [   36.859710][ T1115]  ? stack_trace_consume_entry+0x160/0x160
    [   36.860357][ T1115]  ? deactivate_slab.isra.78+0x2c5/0x800
    [   36.860928][ T1115]  ? kasan_unpoison_shadow+0x30/0x40
    [   36.861520][ T1115]  ? kmem_cache_alloc_trace+0x135/0x350
    [   36.862125][ T1115]  ? rtnl_newlink+0x4c/0x90
    [   36.864073][ T1115]  rtnl_newlink+0x65/0x90
    [ ... ]
    
    Fixes: ceed73a2 ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
    Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    93b5cbfa
rmnet_config.c 11.4 KB