Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753232AbdFSTa4 (ORCPT + 2 others); Mon, 19 Jun 2017 15:30:56 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:51958 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752671AbdFSSfA (ORCPT ); Mon, 19 Jun 2017 14:35:00 -0400 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux@roeck-us.net Cc: Eric Dumazet , "David S . Miller" , Willy Tarreau Subject: [PATCH 3.10 253/268] net: neigh: guard against NULL solicit() method Date: Mon, 19 Jun 2017 20:32:32 +0200 Message-Id: <1497897167-14556-254-git-send-email-w@1wt.eu> X-Mailer: git-send-email 2.8.0.rc2.1.gbe9624a In-Reply-To: <1497897167-14556-1-git-send-email-w@1wt.eu> References: <1497897167-14556-1-git-send-email-w@1wt.eu> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: From: Eric Dumazet commit 48481c8fa16410ffa45939b13b6c53c2ca609e5f upstream. Dmitry posted a nice reproducer of a bug triggering in neigh_probe() when dereferencing a NULL neigh->ops->solicit method. This can happen for arp_direct_ops/ndisc_direct_ops and similar, which can be used for NUD_NOARP neighbours (created when dev->header_ops is NULL). Admin can then force changing nud_state to some other state that would fire neigh timer. Signed-off-by: Eric Dumazet Reported-by: Dmitry Vyukov Signed-off-by: David S. Miller Signed-off-by: Willy Tarreau --- net/core/neighbour.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index b49e8ba..fb82e8a 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -872,7 +872,8 @@ static void neigh_probe(struct neighbour *neigh) if (skb) skb = skb_copy(skb, GFP_ATOMIC); write_unlock(&neigh->lock); - neigh->ops->solicit(neigh, skb); + if (neigh->ops->solicit) + neigh->ops->solicit(neigh, skb); atomic_inc(&neigh->probes); kfree_skb(skb); } -- 2.8.0.rc2.1.gbe9624a