Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754077AbbLOPcZ (ORCPT ); Tue, 15 Dec 2015 10:32:25 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:35273 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751996AbbLOPcX (ORCPT ); Tue, 15 Dec 2015 10:32:23 -0500 Date: Tue, 15 Dec 2015 15:32:20 +0000 From: Nikolay Aleksandrov To: Greg Kroah-Hartman Cc: David Ahern , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Nikolay Aleksandrov , "David S. Miller" Message-ID: <20151215153220.GP28542@decadent.org.uk> References: <56702E7E.5000604@cumulusnetworks.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="uGrbifh0UoBBidu/" Content-Disposition: inline In-Reply-To: <56702E7E.5000604@cumulusnetworks.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: nikolay@cumulusnetworks.com Subject: [PATCH 4.3 2/2] vrf: fix double free and memory corruption on register_netdevice failure X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000) X-SA-Exim-Scanned: Yes (on shadbolt.decadent.org.uk) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 5348 Lines: 128 --uGrbifh0UoBBidu/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable commit 7f109f7cc37108cba7243bc832988525b0d85909 upstream. When vrf's ->newlink is called, if register_netdevice() fails then it does free_netdev(), but that's also done by rtnl_newlink() so a second free happens and memory gets corrupted, to reproduce execute the following line a couple of times (1 - 5 usually is enough): $ for i in `seq 1 5`; do ip link add vrf: type vrf table 1; done; This works because we fail in register_netdevice() because of the wrong name "vrf:". And here's a trace of one crash: [ 28.792157] ------------[ cut here ]------------ [ 28.792407] kernel BUG at fs/namei.c:246! [ 28.792608] invalid opcode: 0000 [#1] SMP [ 28.793240] Modules linked in: vrf nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace sunrpc crct10dif_pclmul crc32_pclmul crc32c_intel qxl drm_kms_helper ttm drm aesni_intel aes_x86_64 psmouse glue_helper lrw evdev gf128mul i2c_piix4 ablk_helper cryptd ppdev parport_pc parport serio_raw pcspkr virtio_balloon virtio_console i2c_core acpi_cpufreq button 9pnet_virtio 9p 9pnet fscache ipv6 autofs4 ext4 crc16 mbcache jbd2 virtio_blk virtio_net sg sr_mod cdrom ata_generic ehci_pci uhci_hcd ehci_hcd e1000 usbcore usb_common ata_piix libata virtio_pci virtio_ring virtio scsi_mod floppy [ 28.796016] CPU: 0 PID: 1148 Comm: ld-linux-x86-64 Not tainted 4.4.0-rc1+ #24 [ 28.796016] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 [ 28.796016] task: ffff8800352561c0 ti: ffff88003592c000 task.ti: ffff88003592c000 [ 28.796016] RIP: 0010:[] [] putname+0x43/0x60 [ 28.796016] RSP: 0018:ffff88003592fe88 EFLAGS: 00010246 [ 28.796016] RAX: 0000000000000000 RBX: ffff8800352561c0 RCX: 0000000000000001 [ 28.796016] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003784f000 [ 28.796016] RBP: ffff88003592ff08 R08: 0000000000000001 R09: 0000000000000000 [ 28.796016] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 28.796016] R13: 000000000000047c R14: ffff88003784f000 R15: ffff8800358c4a00 [ 28.796016] FS: 0000000000000000(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000 [ 28.796016] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.796016] CR2: 00007ffd583bc2d9 CR3: 0000000035a99000 CR4: 00000000000406f0 [ 28.796016] Stack: [ 28.796016] ffffffff8121045d ffffffff812102d3 ffff8800352561c0 ffff880035a91660 [ 28.796016] ffff8800008a9880 0000000000000000 ffffffff81a49940 00ffffff81218684 [ 28.796016] ffff8800352561c0 000000000000047c 0000000000000000 ffff880035b36d80 [ 28.796016] Call Trace: [ 28.796016] [] ? do_execveat_common.isra.34+0x74d/0x930 [ 28.796016] [] ? do_execveat_common.isra.34+0x5c3/0x930 [ 28.796016] [] do_execve+0x2c/0x30 [ 28.796016] [] call_usermodehelper_exec_async+0xf0/0x140 [ 28.796016] [] ? umh_complete+0x40/0x40 [ 28.796016] [] ret_from_fork+0x3f/0x70 [ 28.796016] Code: 48 8d 47 1c 48 89 e5 53 48 8b 37 48 89 fb 48 39 c6 74 1a 48 8b 3d 7e e9 8f 00 e8 49 fa fc ff 48 89 df e8 f1 01 fd ff 5b 5d f3 c3 <0f> 0b 48 89 fe 48 8b 3d 61 e9 8f 00 e8 2c fa fc ff 5b 5d eb e9 [ 28.796016] RIP [] putname+0x43/0x60 [ 28.796016] RSP Fixes: 193125dbd8eb ("net: Introduce VRF device driver") Signed-off-by: Nikolay Aleksandrov Acked-by: David Ahern Signed-off-by: David S. Miller [bwh: For 4.3, retain the kfree() on failure] Signed-off-by: Ben Hutchings --- drivers/net/vrf.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c index 488c6f5..374feba 100644 --- a/drivers/net/vrf.c +++ b/drivers/net/vrf.c @@ -608,7 +608,6 @@ static int vrf_newlink(struct net *src_net, struct net_= device *dev, =20 out_fail: kfree(vrf_ptr); - free_netdev(dev); return err; } =20 --uGrbifh0UoBBidu/ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBVnAyhOe/yOyVhhEJAQpSKhAAxbDNSrHOPbOkhAJ+vHa6C2r2U8TA+uU/ DOYmJsqIQyoPTh6RUYeSIHKENIXKGeJQ4YZ2vBKdoekEGXo0aVY4jLqhPH/iMF76 GWzqdIJQsUi9MTecJFRP7HC/FyFhJpbdhcostZl1EAIvBEKiUfFlxqQyKf07yOT2 EIGUNQHJwcBfZ9X17UPIBLwQ/fShysDEGFTvwH8oKsqISAR8C1EcCuiFa3DE3XLu 5b82k4GCR0mNTpcWEHuDAl6qn4vtlVVQd8ENccCQPzX6SQxHzI2ltLWdqxyhPVOj B5KUGKiCZvmuAg6W4jFKJY9xt1SiZIqzR0nJW635MYiJw+MHa9hTNIPO8n6O5eXT lRJdxy31lFxP641vCtVQj1HyPapOMXwp4DIoLmSJqNfqJfIuNiL0e9sWJGgN4iHQ YK9PB5bS0U5EGQmEhUSBm/HsQr+41ZvPWoW8G57yxM38W3mUwUaAHp7gbHsVVkKm mtIGgBJoVjXgh8LJIpN0FKWDHMzwBZ3R0P/bP2G8VZQgmvf7IkHtjj3s7JPG+bLa lRKJ25O7gLZtpt1bGl6fdT9tKmPjl1GlbRaEzJ8Vu2MkjBrZNA+KBxTAdq4whIYU cewqXyrBIGgceF1JgdGo9ZEEIeoyx+Fg/BctA3tboE879/f/V7qxYgLSPe86ixHc tqrkqUcQ3TM= =/gA5 -----END PGP SIGNATURE----- --uGrbifh0UoBBidu/-- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/