David Howells f0308fb070 rxrpc: Fix possible NULL pointer access in ICMP handling ... If an ICMP packet comes in on the UDP socket backing an AF_RXRPC socket as the UDP socket is being shut down, rxrpc_error_report() may get called to deal with it after sk_user_data on the UDP socket has been cleared, leading to a NULL pointer access when this local endpoint record gets accessed. Fix this by just returning immediately if sk_user_data was NULL. The oops looks like the following: #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page ... RIP: 0010:rxrpc_error_report+0x1bd/0x6a9 ... Call Trace: ? sock_queue_err_skb+0xbd/0xde ? __udp4_lib_err+0x313/0x34d __udp4_lib_err+0x313/0x34d icmp_unreach+0x1ee/0x207 icmp_rcv+0x25b/0x28f ip_protocol_deliver_rcu+0x95/0x10e ip_local_deliver+0xe9/0x148 __netif_receive_skb_one_core+0x52/0x6e process_backlog+0xdc/0x177 net_rx_action+0xf9/0x270 __do_softirq+0x1b6/0x39a ? smpboot_register_percpu_thread+0xce/0xce run_ksoftirqd+0x1d/0x42 smpboot_thread_fn+0x19e/0x1b3 kthread+0xf1/0xf6 ? kthread_delayed_work_timer_fn+0x83/0x83 ret_from_fork+0x24/0x30 Fixes: 17926a7932 ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Reported-by: syzbot+611164843bd48cc2190c@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-10-11 21:20:23 -07:00
..
af_rxrpc.c
ar-internal.h	rxrpc: Fix call crypto state cleanup	2019-10-07 11:05:05 +01:00
call_accept.c	rxrpc: Fix call crypto state cleanup	2019-10-07 11:05:05 +01:00
call_event.c
call_object.c	rxrpc: Fix call crypto state cleanup	2019-10-07 11:05:05 +01:00
conn_client.c	rxrpc: Fix call crypto state cleanup	2019-10-07 11:05:05 +01:00
conn_event.c
conn_object.c	rxrpc: Fix trace-after-put looking at the put connection record	2019-10-07 11:05:05 +01:00
conn_service.c	rxrpc: Fix trace-after-put looking at the put connection record	2019-10-07 11:05:05 +01:00
input.c
insecure.c
Kconfig
key.c
local_event.c
local_object.c
Makefile
misc.c
net_ns.c
output.c
peer_event.c	rxrpc: Fix possible NULL pointer access in ICMP handling	2019-10-11 21:20:23 -07:00
peer_object.c	rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record	2019-10-07 11:05:05 +01:00
proc.c
protocol.h
recvmsg.c	rxrpc: Fix call crypto state cleanup	2019-10-07 11:05:05 +01:00
rxkad.c
security.c
sendmsg.c	rxrpc: Fix call crypto state cleanup	2019-10-07 11:05:05 +01:00
skbuff.c
sysctl.c
utils.c