Eric Dumazet b6f6118901 ipv6: restrict IPV6_ADDRFORM operation ... IPV6_ADDRFORM is able to transform IPv6 socket to IPv4 one. While this operation sounds illogical, we have to support it. One of the things it does for TCP socket is to switch sk->sk_prot to tcp_prot. We now have other layers playing with sk->sk_prot, so we should make sure to not interfere with them. This patch makes sure sk_prot is the default pointer for TCP IPv6 socket. syzbot reported : BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD a0113067 P4D a0113067 PUD a8771067 PMD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 10686 Comm: syz-executor.0 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246 RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40 RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5 R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098 R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000 FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_release+0x165/0x1c0 net/ipv4/af_inet.c:427 __sock_release net/socket.c:605 [inline] sock_close+0xe1/0x260 net/socket.c:1283 __fput+0x2e4/0x740 fs/file_table.c:280 ____fput+0x15/0x20 fs/file_table.c:313 task_work_run+0x176/0x1b0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:164 [inline] prepare_exit_to_usermode+0x480/0x5b0 arch/x86/entry/common.c:195 syscall_return_slowpath+0x113/0x4a0 arch/x86/entry/common.c:278 do_syscall_64+0x11f/0x1c0 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45c429 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f2ae75dac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: 0000000000000000 RBX: 00007f2ae75db6d4 RCX: 000000000045c429 RDX: 0000000000000001 RSI: 000000000000011a RDI: 0000000000000004 RBP: 000000000076bf20 R08: 0000000000000038 R09: 0000000000000000 R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000a9d R14: 00000000004ccfb4 R15: 000000000076bf2c Modules linked in: CR2: 0000000000000000 ---[ end trace 82567b5207e87bae ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246 RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40 RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5 R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098 R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000 FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 604326b41a ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot+1938db17e275e85dc328@syzkaller.appspotmail.com Cc: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2020-02-26 20:20:58 -08:00
..
ila
netfilter	net: Fix Kconfig indentation, continued	2019-11-21 12:00:21 -08:00
addrconf_core.c	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2019-12-04 12:27:13 -08:00
addrconf.c	ipv6/addrconf: fix potential NULL deref in inet6_set_link_af()	2020-02-07 18:43:23 +01:00
addrlabel.c
af_inet6.c	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2019-12-04 12:27:13 -08:00
ah6.c
anycast.c
calipso.c
datagram.c	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-04 12:27:12 -08:00
esp6_offload.c	xfrm: support output_mark for offload ESP packets	2020-01-15 12:18:35 +01:00
esp6.c
exthdrs_core.c
exthdrs_offload.c
exthdrs.c
fib6_notifier.c	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
fib6_rules.c	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
fou6.c
icmp.c	net: icmp6: provide input address for traceroute6	2019-11-03 17:26:53 -08:00
inet6_connection_sock.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2019-12-24 22:28:54 -08:00
inet6_hashtables.c	net: annotate accesses to sk->sk_incoming_cpu	2019-10-30 13:24:25 -07:00
ip6_checksum.c
ip6_fib.c	ipv6: Fix route replacement with dev-only route	2020-02-16 18:34:31 -08:00
ip6_flowlabel.c
ip6_gre.c	net: ip6_gre: Distribute switch variables for initialization	2020-02-20 10:00:19 -08:00
ip6_icmp.c	icmp: introduce helper for nat'd source address in network device context	2020-02-13 14:19:00 -08:00
ip6_input.c	ipv6: introduce and uses route look hints for list input.	2019-11-21 14:45:55 -08:00
ip6_offload.c
ip6_offload.h
ip6_output.c	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-04 12:27:12 -08:00
ip6_tunnel.c	net: ip6_gre: Distribute switch variables for initialization	2020-02-20 10:00:19 -08:00
ip6_udp_tunnel.c
ip6_vti.c	vti[6]: fix packet tx through bpf_redirect()	2020-01-14 08:55:38 +01:00
ip6mr.c	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
ipcomp6.c
ipv6_sockglue.c	ipv6: restrict IPV6_ADDRFORM operation	2020-02-26 20:20:58 -08:00
Kconfig
Makefile
mcast_snoop.c
mcast.c
mip6.c
ndisc.c
netfilter.c	net: ensure correct skb->tstamp in various fragmenters	2019-10-18 10:02:37 -07:00
output_core.c
ping.c
proc.c
protocol.c
raw.c	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-04 12:27:12 -08:00
reassembly.c
route.c	ipv6: Fix nlmsg_flags when splitting a multipath route	2020-02-16 18:34:31 -08:00
seg6_hmac.c
seg6_iptunnel.c
seg6_local.c	ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions	2020-01-21 10:17:07 +01:00
seg6.c
sit.c	sit: do not confirm neighbor when do pmtu update	2019-12-24 22:28:55 -08:00
syncookies.c	mptcp: handle tcp fallback when using syn cookies	2020-01-29 17:45:20 +01:00
sysctl_net_ipv6.c
tcp_ipv6.c	mptcp: Fix undefined mptcp_handle_ipv6_mapped for modular IPV6	2020-01-30 10:55:54 +01:00
tcpv6_offload.c
tunnel6.c
udp_impl.h
udp_offload.c	udp: Support UDP fraglist GRO/GSO.	2020-01-27 11:00:21 +01:00
udp.c	net: udp: use skb_list_walk_safe helper for gso segments	2020-01-14 11:48:41 -08:00
udplite.c
xfrm6_input.c
xfrm6_output.c	netfilter: Support iif matches in POSTROUTING	2019-11-15 23:44:48 +01:00
xfrm6_policy.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2019-12-24 22:28:54 -08:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c