[5.4,121/123] ipv6: restrict IPV6_ADDRFORM operation

From: Eric Dumazet <edumazet@google.com>

From: Eric Dumazet <edumazet@google.com>

commit b6f6118901d1e867ac9177bbff3b00b185bd4fdc upstream.

IPV6_ADDRFORM is able to transform IPv6 socket to IPv4 one.
While this operation sounds illogical, we have to support it.

One of the things it does for TCP socket is to switch sk->sk_prot
to tcp_prot.

We now have other layers playing with sk->sk_prot, so we should make
sure to not interfere with them.

This patch makes sure sk_prot is the default pointer for TCP IPv6 socket.

syzbot reported :
BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD a0113067 P4D a0113067 PUD a8771067 PMD 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 10686 Comm: syz-executor.0 Not tainted 5.6.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246
RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40
RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5
R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098
R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000
FS:  00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 inet_release+0x165/0x1c0 net/ipv4/af_inet.c:427
 __sock_release net/socket.c:605 [inline]
 sock_close+0xe1/0x260 net/socket.c:1283
 __fput+0x2e4/0x740 fs/file_table.c:280
 ____fput+0x15/0x20 fs/file_table.c:313
 task_work_run+0x176/0x1b0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop arch/x86/entry/common.c:164 [inline]
 prepare_exit_to_usermode+0x480/0x5b0 arch/x86/entry/common.c:195
 syscall_return_slowpath+0x113/0x4a0 arch/x86/entry/common.c:278
 do_syscall_64+0x11f/0x1c0 arch/x86/entry/common.c:304
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45c429
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f2ae75dac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: 0000000000000000 RBX: 00007f2ae75db6d4 RCX: 000000000045c429
RDX: 0000000000000001 RSI: 000000000000011a RDI: 0000000000000004
RBP: 000000000076bf20 R08: 0000000000000038 R09: 0000000000000000
R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000a9d R14: 00000000004ccfb4 R15: 000000000076bf2c
Modules linked in:
CR2: 0000000000000000
---[ end trace 82567b5207e87bae ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246
RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40
RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5
R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098
R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000
FS:  00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot+1938db17e275e85dc328@syzkaller.appspotmail.com
Cc: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv6/ipv6_sockglue.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Message ID	20200317103319.630972026@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=f8y2=5C=vger.kernel.org=stable-owner@kernel.org> X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7669DC18E5B for <stable@archiver.kernel.org>; Tue, 17 Mar 2020 11:06:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4A09620738 for <stable@archiver.kernel.org>; Tue, 17 Mar 2020 11:06:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1584443174; bh=4SNdgRmaeIWhQvOy1czsZYidzBtecEqXmikf3ykWbRA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=W6elrh63ij5I5i3Vv//bTb1HZQufup1ifgkZXreBoy5WV/1duVo4qGUDQgLQu6TN5 3wRYNVBAur/Ye9GBoaeTAqw3BZsjSn2wwHG3rH/VscB3mT7Jl61sxBQ7Nk9MHxclr8 wCVdfnSe2rb65JU4ZzIUvk0MerSf+rbGJx7z55J0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727720AbgCQLGN (ORCPT <rfc822;stable@archiver.kernel.org>); Tue, 17 Mar 2020 07:06:13 -0400 Received: from mail.kernel.org ([198.145.29.99]:47262 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727737AbgCQLGM (ORCPT <rfc822;stable@vger.kernel.org>); Tue, 17 Mar 2020 07:06:12 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3246A20714; Tue, 17 Mar 2020 11:06:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1584443171; bh=4SNdgRmaeIWhQvOy1czsZYidzBtecEqXmikf3ykWbRA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tvP9jioxVhQfBiqerb+o7jmuOeWDWIoQ7ItBXvHxM0FKfz6BfvNm5pPfVDEsTOs2M oX1I/bvikm6uf1A1cVAgAtdbcBaRFahXpdaDfABhR1Hti9nfTuzd1rsjWiS0t7/xe9 bHOfxvxI4y3g+OJrqfGeEiW+8t2JQVVm+adtfeKg= From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>, syzbot+1938db17e275e85dc328@syzkaller.appspotmail.com, Daniel Borkmann <daniel@iogearbox.net>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 5.4 121/123] ipv6: restrict IPV6_ADDRFORM operation Date: Tue, 17 Mar 2020 11:55:48 +0100 Message-Id: <20200317103319.630972026@linuxfoundation.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200317103307.343627747@linuxfoundation.org> References: <20200317103307.343627747@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: <stable.vger.kernel.org> X-Mailing-List: stable@vger.kernel.org
Series	None \| expand [5.4,002/123] ALSA: hda/realtek - More constifications [5.4,003/123] ALSA: hda/realtek - Add Headset Mic supported for HP cPC [5.4,004/123] ALSA: hda/realtek - Fixed one of HP ALC671 platform Headset Mic supported [5.4,005/123] cgroup, netclassid: periodically release file_lock on classid updating [5.4,007/123] inet_diag: return classid for all socket types [5.4,009/123] ipvlan: add cond_resched_rcu() while processing muticast backlog [5.4,011/123] ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast() [5.4,012/123] ipvlan: dont deref eth hdr before checking its set [5.4,015/123] net: dsa: mv88e6xxx: fix lockup on warm boot [5.4,016/123] net: fec: validate the new settings in fec_enet_set_coalesce() [5.4,018/123] net/ipv6: use configured metric when add peer route [5.4,022/123] net/packet: tpacket_rcv: do not increment ring index on drop [5.4,023/123] net: phy: bcm63xx: fix OOPS due to missing driver name [5.4,025/123] net: systemport: fix index check to avoid an array out of bounds access [5.4,028/123] slip: make slhc_compress() more robust against malicious packets [5.4,031/123] bnxt_en: reinitialize IRQs when MTU is modified [5.4,032/123] bnxt_en: fix error handling when flashing from file [5.4,033/123] cgroup: memcg: net: do not associate sock with unrelated cgroup [5.4,034/123] net: memcg: late association of sock to memcg [5.4,035/123] net: memcg: fix lockdep splat in inet_csk_accept() [5.4,036/123] devlink: validate length of param values [5.4,039/123] nl802154: add missing attribute validation [5.4,042/123] macsec: add missing attribute validation for port [5.4,044/123] net: taprio: add missing attribute validation for txtime delay [5.4,045/123] team: add missing attribute validation for port ifindex [5.4,048/123] nfc: add missing attribute validation for SE API [5.4,052/123] net: phy: fix MDIO bus PM PHY resuming [5.4,053/123] net/ipv6: need update peer route when modify metric [5.4,056/123] net: dsa: Dont instantiate phylink for CPU/DSA ports unless needed [5.4,058/123] cgroup: cgroup_procs_next should increase position index [5.4,059/123] cgroup: Iterate tasks that did not finish do_exit() [5.4,062/123] virtio-blk: fix hw_queue stopped on arbitrary error [5.4,063/123] iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint [5.4,068/123] workqueue: dont use wq_select_unbound_cpu() for bound works [5.4,069/123] drm/amd/display: remove duplicated assignment to grph_obj_type [5.4,074/123] ktest: Add timeout for ssh sync testing [5.4,076/123] gfs2_atomic_open(): fix O_EXCL\|O_CREAT handling on cold dcache [5.4,079/123] ARC: define __ALIGN_STR and __ALIGN symbols for ARC [5.4,081/123] s390/dasd: fix data corruption for thin provisioned devices [5.4,083/123] blk-iocost: fix incorrect vtime comparison in iocg_is_idle() [5.4,085/123] macintosh: windfarm: fix MODINFO regression [5.4,087/123] efi: Fix a race and a buffer overflow while reading efivars via sysfs [5.4,088/123] efi: Add a sanity check to efivar_store_raw() [5.4,090/123] mt76: fix array overflow on receiving too many fragments for a packet [5.4,091/123] perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag [5.4,092/123] x86/mce: Fix logic and comments around MSR_PPIN_CTL [5.4,095/123] iommu/vt-d: Fix RCU list debugging warnings [5.4,098/123] clk: imx8mn: Fix incorrect clock defines [5.4,099/123] pinctrl: meson-gxl: fix GPIOX sdio pins [5.4,101/123] virtio_ring: Fix mem leak with vring_new_virtqueue() [5.4,104/123] drm/i915/gvt: Fix unnecessary schedule timer when no vGPU exits [5.4,107/123] i2c: gpio: suppress error on probe defer [5.4,108/123] nl80211: add missing attribute validation for critical protocol indication [5.4,109/123] nl80211: add missing attribute validation for beacon report scanning [5.4,110/123] nl80211: add missing attribute validation for channel switch [5.4,111/123] perf bench futex-wake: Restore thread count default to online CPU count [5.4,113/123] netfilter: nft_payload: add missing attribute validation for payload csum flags [5.4,116/123] netfilter: nft_chain_nat: inet family is missing module ownership [5.4,117/123] iommu/vt-d: Fix the wrong printing in RHSA parsing [5.4,119/123] i2c: acpi: put device when verifying client fails [5.4,121/123] ipv6: restrict IPV6_ADDRFORM operation [5.4,123/123] net/smc: cancel event worker during device removal

[5.4,121/123] ipv6: restrict IPV6_ADDRFORM operation

Commit Message

Patch