queue-4.4/ppp-deflate-fix-possible-crash-in-deflate_init.patch

   1 From foo@baz Wed 22 May 2019 07:38:16 PM CEST
   2 From: YueHaibing <yuehaibing@huawei.com>
   3 Date: Tue, 14 May 2019 22:55:32 +0800
   4 Subject: ppp: deflate: Fix possible crash in deflate_init
   5
   6 From: YueHaibing <yuehaibing@huawei.com>
   7
   8 [ Upstream commit 3ebe1bca58c85325c97a22d4fc3f5b5420752e6f ]
   9
  10 BUG: unable to handle kernel paging request at ffffffffa018f000
  11 PGD 3270067 P4D 3270067 PUD 3271063 PMD 2307eb067 PTE 0
  12 Oops: 0000 [#1] PREEMPT SMP
  13 CPU: 0 PID: 4138 Comm: modprobe Not tainted 5.1.0-rc7+ #1
  14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
  15 rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
  16 RIP: 0010:ppp_register_compressor+0x3e/0xd0 [ppp_generic]
  17 Code: 98 4a 3f e2 48 8b 15 c1 67 00 00 41 8b 0c 24 48 81 fa 40 f0 19 a0
  18 75 0e eb 35 48 8b 12 48 81 fa 40 f0 19 a0 74
  19 RSP: 0018:ffffc90000d93c68 EFLAGS: 00010287
  20 RAX: ffffffffa018f000 RBX: ffffffffa01a3000 RCX: 000000000000001a
  21 RDX: ffff888230c750a0 RSI: 0000000000000000 RDI: ffffffffa019f000
  22 RBP: ffffc90000d93c80 R08: 0000000000000001 R09: 0000000000000000
  23 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffa0194080
  24 R13: ffff88822ee1a700 R14: 0000000000000000 R15: ffffc90000d93e78
  25 FS:  00007f2339557540(0000) GS:ffff888237a00000(0000)
  26 knlGS:0000000000000000
  27 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  28 CR2: ffffffffa018f000 CR3: 000000022bde4000 CR4: 00000000000006f0
  29 Call Trace:
  30  ? 0xffffffffa01a3000
  31  deflate_init+0x11/0x1000 [ppp_deflate]
  32  ? 0xffffffffa01a3000
  33  do_one_initcall+0x6c/0x3cc
  34  ? kmem_cache_alloc_trace+0x248/0x3b0
  35  do_init_module+0x5b/0x1f1
  36  load_module+0x1db1/0x2690
  37  ? m_show+0x1d0/0x1d0
  38  __do_sys_finit_module+0xc5/0xd0
  39  __x64_sys_finit_module+0x15/0x20
  40  do_syscall_64+0x6b/0x1d0
  41  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  42
  43 If ppp_deflate fails to register in deflate_init,
  44 module initialization failed out, however
  45 ppp_deflate_draft may has been regiestred and not
  46 unregistered before return.
  47 Then the seconed modprobe will trigger crash like this.
  48
  49 Reported-by: Hulk Robot <hulkci@huawei.com>
  50 Signed-off-by: YueHaibing <yuehaibing@huawei.com>
  51 Acked-by: Guillaume Nault <gnault@redhat.com>
  52 Signed-off-by: David S. Miller <davem@davemloft.net>
  53 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  54 ---
  55  drivers/net/ppp/ppp_deflate.c |   20 ++++++++++++++------
  56  1 file changed, 14 insertions(+), 6 deletions(-)
  57
  58 --- a/drivers/net/ppp/ppp_deflate.c
  59 +++ b/drivers/net/ppp/ppp_deflate.c
  60 @@ -610,12 +610,20 @@ static struct compressor ppp_deflate_dra
  61
  62  static int __init deflate_init(void)
  63  {
  64 -        int answer = ppp_register_compressor(&ppp_deflate);
  65 -        if (answer == 0)
  66 -                printk(KERN_INFO
  67 -                      "PPP Deflate Compression module registered\n");
  68 -       ppp_register_compressor(&ppp_deflate_draft);
  69 -        return answer;
  70 +       int rc;
  71 +
  72 +       rc = ppp_register_compressor(&ppp_deflate);
  73 +       if (rc)
  74 +               return rc;
  75 +
  76 +       rc = ppp_register_compressor(&ppp_deflate_draft);
  77 +       if (rc) {
  78 +               ppp_unregister_compressor(&ppp_deflate);
  79 +               return rc;
  80 +       }
  81 +
  82 +       pr_info("PPP Deflate Compression module registered\n");
  83 +       return 0;
  84  }
  85
  86  static void __exit deflate_cleanup(void)