From 7040404a78c0efebb8f699519a14061c4fed1909 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 2 Jul 2019 08:15:57 +0200 Subject: [PATCH] 4.4-stable patches added patches: net-check-before-dereferencing-netdev_ops-during-busy-poll.patch --- ...erencing-netdev_ops-during-busy-poll.patch | 72 +++++++++++++++++++ queue-4.4/series | 1 + 2 files changed, 73 insertions(+) create mode 100644 queue-4.4/net-check-before-dereferencing-netdev_ops-during-busy-poll.patch diff --git a/queue-4.4/net-check-before-dereferencing-netdev_ops-during-busy-poll.patch b/queue-4.4/net-check-before-dereferencing-netdev_ops-during-busy-poll.patch new file mode 100644 index 00000000000..09f9c6000fd --- /dev/null +++ b/queue-4.4/net-check-before-dereferencing-netdev_ops-during-busy-poll.patch @@ -0,0 +1,72 @@ +From jelsasser@appneta.com Tue Jul 2 07:48:39 2019 +From: Josh Elsasser +Date: Mon, 1 Jul 2019 16:48:47 -0700 +Subject: net: check before dereferencing netdev_ops during busy poll +To: stable@vger.kernel.org +Cc: Josh Elsasser , gregkh@linuxfoundation.org, netdev@vger.kernel.org, "David S. Miller" , Jiri Pirko , Edward Cree , Eric Dumazet , Alexander Duyck , Matteo Croce +Message-ID: <20190701234847.73385-1-jelsasser@appneta.com> + +From: Josh Elsasser + +init_dummy_netdev() leaves its netdev_ops pointer zeroed. This leads +to a NULL pointer dereference when sk_busy_loop fires against an iwlwifi +wireless adapter and checks napi->dev->netdev_ops->ndo_busy_poll. + +Avoid this by ensuring napi->dev->netdev_ops is valid before following +the pointer, avoiding the following panic when busy polling on a dummy +netdev: + + BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8 + IP: [] sk_busy_loop+0x92/0x2f0 + Call Trace: + [] ? uart_write_room+0x74/0xf0 + [] sock_poll+0x99/0xa0 + [] do_sys_poll+0x2e2/0x520 + [] ? get_page_from_freelist+0x3bc/0xa30 + [] ? update_curr+0x62/0x140 + [] ? __slab_free+0xa1/0x2a0 + [] ? __slab_free+0xa1/0x2a0 + [] ? skb_free_head+0x21/0x30 + [] ? poll_initwait+0x50/0x50 + [] ? kmem_cache_free+0x1c6/0x1e0 + [] ? uart_write+0x124/0x1d0 + [] ? remove_wait_queue+0x4d/0x60 + [] ? __wake_up+0x44/0x50 + [] ? tty_write_unlock+0x31/0x40 + [] ? tty_ldisc_deref+0x16/0x20 + [] ? tty_write+0x1e0/0x2f0 + [] ? process_echoes+0x80/0x80 + [] ? __vfs_write+0x2b/0x130 + [] ? vfs_write+0x15a/0x1a0 + [] SyS_poll+0x75/0x100 + [] entry_SYSCALL_64_fastpath+0x24/0xcf + +Commit 79e7fff47b7b ("net: remove support for per driver ndo_busy_poll()") +indirectly fixed this upstream in linux-4.11 by removing the offending +pointer usage. No other users of napi->dev touch its netdev_ops. + +Fixes: 8b80cda536ea ("net: rename include/net/ll_poll.h to include/net/busy_poll.h") # 4.4.y +Signed-off-by: Josh Elsasser +Signed-off-by: Greg Kroah-Hartman +--- + +This is a straightforward backport of the 4.9.y fix[1] for this crash, which doesn't +apply to the older LTS releases. Only build-tested on 4.4.y, as I don't have access +to wireless hardware and firmware that runs on older LTS kernels. + +[1]: https://lore.kernel.org/stable/20190701234143.72631-1-jelsasser@appneta.com/T/#u + + include/net/busy_poll.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/net/busy_poll.h ++++ b/include/net/busy_poll.h +@@ -93,7 +93,7 @@ static inline bool sk_busy_loop(struct s + goto out; + + ops = napi->dev->netdev_ops; +- if (!ops->ndo_busy_poll) ++ if (!ops || !ops->ndo_busy_poll) + goto out; + + do { diff --git a/queue-4.4/series b/queue-4.4/series index 313ab09844c..3388c147470 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -44,3 +44,4 @@ team-always-enable-vlan-tx-offload.patch ipv4-use-return-value-of-inet_iif-for-__raw_v4_lookup-in-the-while-loop.patch bonding-always-enable-vlan-tx-offload.patch af_packet-block-execution-of-tasks-waiting-for-transmit-to-complete-in-af_packet.patch +net-check-before-dereferencing-netdev_ops-during-busy-poll.patch -- 2.47.3