diff options
author | Sasha Levin <levinsasha928@gmail.com> | 2012-04-14 12:37:46 -0400 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2012-04-25 05:16:12 -0400 |
commit | 7118c07a844d367560ee91adb2071bde2fabcdbf (patch) | |
tree | baaba6f805195e3af22a62332b832e771d93bca7 | |
parent | 6ba900676bec8baaf61aa2f85b7345c0e65774d9 (diff) |
ipvs: Verify that IP_VS protocol has been registered
The registration of a protocol might fail, there were no checks
and all registrations were assumed to be correct. This lead to
NULL ptr dereferences when apps tried registering.
For example:
[ 1293.226051] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
[ 1293.227038] IP: [<ffffffff822aacb0>] tcp_register_app+0x60/0xb0
[ 1293.227038] PGD 391de067 PUD 6c20b067 PMD 0
[ 1293.227038] Oops: 0000 [#1] PREEMPT SMP
[ 1293.227038] CPU 1
[ 1293.227038] Pid: 19609, comm: trinity Tainted: G W 3.4.0-rc1-next-20120405-sasha-dirty #57
[ 1293.227038] RIP: 0010:[<ffffffff822aacb0>] [<ffffffff822aacb0>] tcp_register_app+0x60/0xb0
[ 1293.227038] RSP: 0018:ffff880038c1dd18 EFLAGS: 00010286
[ 1293.227038] RAX: ffffffffffffffc0 RBX: 0000000000001500 RCX: 0000000000010000
[ 1293.227038] RDX: 0000000000000000 RSI: ffff88003a2d5888 RDI: 0000000000000282
[ 1293.227038] RBP: ffff880038c1dd48 R08: 0000000000000000 R09: 0000000000000000
[ 1293.227038] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003a2d5668
[ 1293.227038] R13: ffff88003a2d5988 R14: ffff8800696a8ff8 R15: 0000000000000000
[ 1293.227038] FS: 00007f01930d9700(0000) GS:ffff88007ce00000(0000) knlGS:0000000000000000
[ 1293.227038] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 1293.227038] CR2: 0000000000000018 CR3: 0000000065dfc000 CR4: 00000000000406e0
[ 1293.227038] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1293.227038] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 1293.227038] Process trinity (pid: 19609, threadinfo ffff880038c1c000, task ffff88002dc73000)
[ 1293.227038] Stack:
[ 1293.227038] ffff880038c1dd48 00000000fffffff4 ffff8800696aada0 ffff8800694f5580
[ 1293.227038] ffffffff8369f1e0 0000000000001500 ffff880038c1dd98 ffffffff822a716b
[ 1293.227038] 0000000000000000 ffff8800696a8ff8 0000000000000015 ffff8800694f5580
[ 1293.227038] Call Trace:
[ 1293.227038] [<ffffffff822a716b>] ip_vs_app_inc_new+0xdb/0x180
[ 1293.227038] [<ffffffff822a7258>] register_ip_vs_app_inc+0x48/0x70
[ 1293.227038] [<ffffffff822b2fea>] __ip_vs_ftp_init+0xba/0x140
[ 1293.227038] [<ffffffff821c9060>] ops_init+0x80/0x90
[ 1293.227038] [<ffffffff821c90cb>] setup_net+0x5b/0xe0
[ 1293.227038] [<ffffffff821c9416>] copy_net_ns+0x76/0x100
[ 1293.227038] [<ffffffff810dc92b>] create_new_namespaces+0xfb/0x190
[ 1293.227038] [<ffffffff810dca21>] unshare_nsproxy_namespaces+0x61/0x80
[ 1293.227038] [<ffffffff810afd1f>] sys_unshare+0xff/0x290
[ 1293.227038] [<ffffffff8187622e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[ 1293.227038] [<ffffffff82665539>] system_call_fastpath+0x16/0x1b
[ 1293.227038] Code: 89 c7 e8 34 91 3b 00 89 de 66 c1 ee 04 31 de 83 e6 0f 48 83 c6 22 48 c1 e6 04 4a 8b 14 26 49 8d 34 34 48 8d 42 c0 48 39 d6 74 13 <66> 39 58 58 74 22 48 8b 48 40 48 8d 41 c0 48 39 ce 75 ed 49 8d
[ 1293.227038] RIP [<ffffffff822aacb0>] tcp_register_app+0x60/0xb0
[ 1293.227038] RSP <ffff880038c1dd18>
[ 1293.227038] CR2: 0000000000000018
[ 1293.379284] ---[ end trace 364ab40c7011a009 ]---
[ 1293.381182] Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r-- | net/netfilter/ipvs/ip_vs_proto.c | 27 |
1 files changed, 18 insertions, 9 deletions
diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c index f843a8833250..a62360e29037 100644 --- a/net/netfilter/ipvs/ip_vs_proto.c +++ b/net/netfilter/ipvs/ip_vs_proto.c | |||
@@ -59,9 +59,6 @@ static int __used __init register_ip_vs_protocol(struct ip_vs_protocol *pp) | |||
59 | return 0; | 59 | return 0; |
60 | } | 60 | } |
61 | 61 | ||
62 | #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP) || \ | ||
63 | defined(CONFIG_IP_VS_PROTO_SCTP) || defined(CONFIG_IP_VS_PROTO_AH) || \ | ||
64 | defined(CONFIG_IP_VS_PROTO_ESP) | ||
65 | /* | 62 | /* |
66 | * register an ipvs protocols netns related data | 63 | * register an ipvs protocols netns related data |
67 | */ | 64 | */ |
@@ -86,7 +83,6 @@ register_ip_vs_proto_netns(struct net *net, struct ip_vs_protocol *pp) | |||
86 | 83 | ||
87 | return 0; | 84 | return 0; |
88 | } | 85 | } |
89 | #endif | ||
90 | 86 | ||
91 | /* | 87 | /* |
92 | * unregister an ipvs protocol | 88 | * unregister an ipvs protocol |
@@ -316,22 +312,35 @@ ip_vs_tcpudp_debug_packet(int af, struct ip_vs_protocol *pp, | |||
316 | */ | 312 | */ |
317 | int __net_init ip_vs_protocol_net_init(struct net *net) | 313 | int __net_init ip_vs_protocol_net_init(struct net *net) |
318 | { | 314 | { |
315 | int i, ret; | ||
316 | static struct ip_vs_protocol *protos[] = { | ||
319 | #ifdef CONFIG_IP_VS_PROTO_TCP | 317 | #ifdef CONFIG_IP_VS_PROTO_TCP |
320 | register_ip_vs_proto_netns(net, &ip_vs_protocol_tcp); | 318 | &ip_vs_protocol_tcp, |
321 | #endif | 319 | #endif |
322 | #ifdef CONFIG_IP_VS_PROTO_UDP | 320 | #ifdef CONFIG_IP_VS_PROTO_UDP |
323 | register_ip_vs_proto_netns(net, &ip_vs_protocol_udp); | 321 | &ip_vs_protocol_udp, |
324 | #endif | 322 | #endif |
325 | #ifdef CONFIG_IP_VS_PROTO_SCTP | 323 | #ifdef CONFIG_IP_VS_PROTO_SCTP |
326 | register_ip_vs_proto_netns(net, &ip_vs_protocol_sctp); | 324 | &ip_vs_protocol_sctp, |
327 | #endif | 325 | #endif |
328 | #ifdef CONFIG_IP_VS_PROTO_AH | 326 | #ifdef CONFIG_IP_VS_PROTO_AH |
329 | register_ip_vs_proto_netns(net, &ip_vs_protocol_ah); | 327 | &ip_vs_protocol_ah, |
330 | #endif | 328 | #endif |
331 | #ifdef CONFIG_IP_VS_PROTO_ESP | 329 | #ifdef CONFIG_IP_VS_PROTO_ESP |
332 | register_ip_vs_proto_netns(net, &ip_vs_protocol_esp); | 330 | &ip_vs_protocol_esp, |
333 | #endif | 331 | #endif |
332 | }; | ||
333 | |||
334 | for (i = 0; i < ARRAY_SIZE(protos); i++) { | ||
335 | ret = register_ip_vs_proto_netns(net, protos[i]); | ||
336 | if (ret < 0) | ||
337 | goto cleanup; | ||
338 | } | ||
334 | return 0; | 339 | return 0; |
340 | |||
341 | cleanup: | ||
342 | ip_vs_protocol_net_cleanup(net); | ||
343 | return ret; | ||
335 | } | 344 | } |
336 | 345 | ||
337 | void __net_exit ip_vs_protocol_net_cleanup(struct net *net) | 346 | void __net_exit ip_vs_protocol_net_cleanup(struct net *net) |