Eric Dumazet
a7137534b5
bonding: fix potential NULL deref in bond_update_slave_arr
syzbot got a NULL dereference in bond_update_slave_arr() [1],
happening after a failure to allocate bond->slave_arr
A workqueue (bond_slave_arr_handler) is supposed to retry
the allocation later, but if the slave is removed before
the workqueue had a chance to complete, bond->slave_arr
can still be NULL.
[1]
Failed to build slave-array.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
Modules linked in:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bond_update_slave_arr.cold+0xc6/0x198 drivers/net/bonding/bond_main.c:4039
RSP: 0018:ffff88018fe33678 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000290b000
RDX: 0000000000000000 RSI: ffffffff82b63037 RDI: ffff88019745ea20
RBP: ffff88018fe33760 R08: ffff880170754280 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88019745ea00 R14: 0000000000000000 R15: ffff88018fe338b0
FS: 00007febd837d700(0000) GS:ffff8801dad00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004540a0 CR3: 00000001c242e005 CR4: 00000000001626f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
[<ffffffff82b5b45e>] __bond_release_one+0x43e/0x500 drivers/net/bonding/bond_main.c:1923
[<ffffffff82b5b966>] bond_release drivers/net/bonding/bond_main.c:2039 [inline]
[<ffffffff82b5b966>] bond_do_ioctl+0x416/0x870 drivers/net/bonding/bond_main.c:3562
[<ffffffff83ae25f4>] dev_ifsioc+0x6f4/0x940 net/core/dev_ioctl.c:328
[<ffffffff83ae2e58>] dev_ioctl+0x1b8/0xc70 net/core/dev_ioctl.c:495
[<ffffffff83995ffd>] sock_do_ioctl+0x1bd/0x300 net/socket.c:1088
[<ffffffff83996a80>] sock_ioctl+0x300/0x5d0 net/socket.c:1196
[<ffffffff81b124db>] vfs_ioctl fs/ioctl.c:47 [inline]
[<ffffffff81b124db>] file_ioctl fs/ioctl.c:501 [inline]
[<ffffffff81b124db>] do_vfs_ioctl+0xacb/0x1300 fs/ioctl.c:688
[<ffffffff81b12dc6>] SYSC_ioctl fs/ioctl.c:705 [inline]
[<ffffffff81b12dc6>] SyS_ioctl+0xb6/0xe0 fs/ioctl.c:696
[<ffffffff8101ccc8>] do_syscall_64+0x528/0x770 arch/x86/entry/common.c:305
[<ffffffff84400091>] entry_SYSCALL_64_after_hwframe+0x42/0xb7
Fixes: ee63771474 ("bonding: Simplify the xmit function for modes that use xmit_hash")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
2019-10-09 16:07:27 -07:00
..
2019-09-28 08:14:15 -07:00
2019-09-22 09:39:09 -07:00
2019-09-19 12:21:44 -06:00
2019-09-25 13:54:45 +02:00
2019-09-17 16:22:26 -07:00
2019-09-24 15:54:11 -07:00
2019-09-13 16:44:49 +03:00
2019-10-04 09:56:51 -07:00
2019-09-15 14:17:27 +02:00
2019-09-30 10:04:28 -07:00
2019-10-02 13:49:43 -07:00
2019-09-29 11:20:41 -07:00
2019-10-02 16:16:07 -07:00
2019-09-17 19:15:14 -07:00
2019-09-17 19:15:14 -07:00
2019-09-24 16:10:23 -07:00
2019-09-22 09:30:30 -07:00
2019-09-22 09:39:09 -07:00
2019-09-19 14:14:28 -07:00
2019-09-30 10:04:28 -07:00
2019-09-18 11:14:31 -07:00
2019-09-27 12:19:47 -07:00
2019-10-04 16:31:06 +10:00
2019-09-24 12:36:31 -07:00
2019-09-22 12:02:21 -07:00
2019-09-24 12:36:31 -07:00
2019-09-29 11:20:41 -07:00
2019-09-18 11:14:31 -07:00
2019-09-28 20:44:12 +02:00
2019-09-19 14:14:28 -07:00
2019-09-28 17:47:33 -07:00
2019-09-19 14:14:28 -07:00
2019-09-29 10:00:14 -07:00
2019-09-22 09:30:30 -07:00
2019-09-24 16:37:18 +02:00
2019-09-12 20:45:52 +02:00
2019-09-05 13:17:01 -06:00
2019-09-17 00:54:29 -05:00
2019-09-24 16:31:50 -07:00
2019-09-25 17:51:41 -07:00
2019-09-11 16:11:01 +02:00
2019-09-29 10:24:23 -07:00
2019-09-24 16:48:02 -07:00
2019-09-27 20:48:20 +02:00
2019-09-22 09:30:30 -07:00
2019-10-09 16:07:27 -07:00
2019-10-08 16:52:26 -07:00
2019-09-23 17:20:40 -04:00
2019-09-29 10:33:41 -07:00
2019-09-27 13:17:37 -06:00
2019-09-18 11:14:31 -07:00
2019-09-28 17:47:33 -07:00
2019-09-19 13:27:23 -07:00
2019-09-18 11:14:31 -07:00
2019-09-28 08:14:15 -07:00
2019-09-28 08:14:15 -07:00
2019-09-23 19:16:01 -07:00
2019-09-19 14:19:33 -07:00
2019-09-24 12:39:40 -07:00
2019-09-22 12:04:59 -07:00
2019-09-17 19:15:14 -07:00
2019-10-07 14:55:46 -04:00
2019-09-27 12:19:47 -07:00
2019-09-17 18:40:42 -07:00
2019-09-22 10:55:08 -07:00
2019-09-30 10:04:28 -07:00
2019-09-17 15:33:31 -07:00
2019-09-22 11:05:43 -07:00
2019-10-05 08:44:02 -07:00
2019-10-05 12:53:27 -07:00
2019-09-16 15:52:38 -07:00
2019-09-22 10:52:23 -07:00
2019-09-17 18:40:42 -07:00
2019-09-13 17:23:18 +03:00
2019-10-01 18:42:15 +02:00
2019-09-24 15:54:08 -07:00
2019-09-25 17:51:41 -07:00
2019-09-29 10:24:23 -07:00
2019-09-28 08:14:15 -07:00
2019-09-18 11:14:31 -07:00
2019-09-24 12:33:34 -07:00
2019-09-25 17:51:41 -07:00
2019-09-15 14:17:27 +02:00
2019-10-05 15:29:49 +09:00
2019-09-09 10:43:15 -04:00
2019-09-04 14:34:31 +02:00
2019-09-27 11:17:38 -07:00
2019-10-04 11:13:09 -07:00
2019-09-18 11:05:34 -07:00
2019-09-18 11:05:34 -07:00