Tommi Rantala ee3f34e857 sctp: fix CONFIG_SCTP_DBG_MSG=y null pointer dereference in sctp_v6_get_dst() ... Trinity (the syscall fuzzer) triggered the following BUG, reproducible only when the kernel is configured with CONFIG_SCTP_DBG_MSG=y. When CONFIG_SCTP_DBG_MSG is not set, the null pointer is never dereferenced. ---[ end trace a4de0bfcb38a3642 ]--- BUG: unable to handle kernel NULL pointer dereference at 0000000000000100 IP: [<ffffffff8136796e>] ip6_string+0x1e/0xa0 PGD 4eead067 PUD 4e472067 PMD 0 Oops: 0000 [#1] PREEMPT SMP Modules linked in: CPU 3 Pid: 21324, comm: trinity-child11 Tainted: G W 3.7.0-rc7+ #61 ASUSTeK Computer INC. EB1012/EB1012 RIP: 0010:[<ffffffff8136796e>] [<ffffffff8136796e>] ip6_string+0x1e/0xa0 RSP: 0018:ffff88004e4637a0 EFLAGS: 00010046 RAX: ffff88004e4637da RBX: ffff88004e4637da RCX: 0000000000000000 RDX: ffffffff8246e92a RSI: 0000000000000100 RDI: ffff88004e4637da RBP: ffff88004e4637a8 R08: 000000000000ffff R09: 000000000000ffff R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8289d600 R13: ffffffff8289d230 R14: ffffffff8246e928 R15: ffffffff8289d600 FS: 00007fed95153700(0000) GS:ffff88005fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000100 CR3: 000000004eeac000 CR4: 00000000000007e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process trinity-child11 (pid: 21324, threadinfo ffff88004e462000, task ffff8800524b0000) Stack: ffff88004e4637da ffff88004e463828 ffffffff81368eee 000000004e4637d8 ffffffff0000ffff ffff88000000ffff 0000000000000000 000000004e4637f8 ffffffff826285d8 ffff88004e4637f8 0000000000000000 ffff8800524b06b0 Call Trace: [<ffffffff81368eee>] ip6_addr_string.isra.11+0x3e/0xa0 [<ffffffff81369183>] pointer.isra.12+0x233/0x2d0 [<ffffffff810a413a>] ? vprintk_emit+0x1ba/0x450 [<ffffffff8110953d>] ? trace_hardirqs_on_caller+0x10d/0x1a0 [<ffffffff81369757>] vsnprintf+0x187/0x5d0 [<ffffffff81369c62>] vscnprintf+0x12/0x30 [<ffffffff810a4028>] vprintk_emit+0xa8/0x450 [<ffffffff81e5cb00>] printk+0x49/0x4b [<ffffffff81d17221>] sctp_v6_get_dst+0x731/0x780 [<ffffffff81d16e15>] ? sctp_v6_get_dst+0x325/0x780 [<ffffffff81d00a96>] sctp_transport_route+0x46/0x120 [<ffffffff81cff0f1>] sctp_assoc_add_peer+0x161/0x350 [<ffffffff81d0fd8d>] sctp_sendmsg+0x6cd/0xcb0 [<ffffffff81b55bf0>] ? inet_create+0x670/0x670 [<ffffffff81b55cfb>] inet_sendmsg+0x10b/0x220 [<ffffffff81b55bf0>] ? inet_create+0x670/0x670 [<ffffffff81a72a64>] ? sock_update_classid+0xa4/0x2b0 [<ffffffff81a72ab0>] ? sock_update_classid+0xf0/0x2b0 [<ffffffff81a6ac1c>] sock_sendmsg+0xdc/0xf0 [<ffffffff8118e9e5>] ? might_fault+0x85/0x90 [<ffffffff8118e99c>] ? might_fault+0x3c/0x90 [<ffffffff81a6e12a>] sys_sendto+0xfa/0x130 [<ffffffff810a9887>] ? do_setitimer+0x197/0x380 [<ffffffff81e960d5>] ? sysret_check+0x22/0x5d [<ffffffff81e960a9>] system_call_fastpath+0x16/0x1b Code: 01 eb 89 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 f8 31 c9 48 89 e5 53 eb 12 0f 1f 40 00 48 83 c1 01 48 83 c0 04 48 83 f9 08 74 70 <0f> b6 3c 4e 89 fb 83 e7 0f c0 eb 04 41 89 d8 41 83 e0 0f 0f b6 RIP [<ffffffff8136796e>] ip6_string+0x1e/0xa0 RSP <ffff88004e4637a0> CR2: 0000000000000100 ---[ end trace a4de0bfcb38a3643 ]--- Signed-off-by: Tommi Rantala <tt.rantala@gmail.com> Acked-by: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2012-11-30 12:21:27 -05:00
..
associola.c	sctp: Make sysctl tunables per net	2012-08-14 23:32:16 -07:00
auth.c	sctp: fix bogus if statement in sctp_auth_recv_cid()	2012-08-16 13:36:29 -07:00
bind_addr.c	sctp: Make sysctl tunables per net	2012-08-14 23:32:16 -07:00
chunk.c	sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall	2012-11-28 11:11:17 -05:00
command.c
debug.c	sctp: remove completely unsed EMPTY state	2011-04-20 01:51:03 -07:00
endpointola.c	sctp: Make sysctl tunables per net	2012-08-14 23:32:16 -07:00
input.c	sctp: fix a typo in prototype of __sctp_rcv_lookup()	2012-10-04 15:53:48 -04:00
inqueue.c	net/sctp: Use pr_fmt and pr_<level>	2010-08-26 14:11:48 -07:00
ipv6.c	sctp: fix CONFIG_SCTP_DBG_MSG=y null pointer dereference in sctp_v6_get_dst()	2012-11-30 12:21:27 -05:00
Kconfig	sctp: Make hmac algorithm selection for cookie generation dynamic	2012-10-26 02:22:18 -04:00
Makefile	sctp: implement sctp association probing module	2010-04-30 22:41:09 -04:00
objcnt.c	sctp: Make the proc files per network namespace.	2012-08-14 23:29:53 -07:00
output.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2012-09-15 11:43:53 -04:00
outqueue.c	sctp: check src addr when processing SACK to update transport state	2012-10-04 15:53:48 -04:00
primitive.c	sctp: Push struct net down to sctp_chunk_event_lookup	2012-08-14 23:30:37 -07:00
probe.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6	2010-10-23 11:47:02 -07:00
proc.c	sctp: fix /proc/net/sctp/ memory leak	2012-11-15 13:56:05 -05:00
protocol.c	sctp: Make hmac algorithm selection for cookie generation dynamic	2012-10-26 02:22:18 -04:00
sm_make_chunk.c	sctp: send abort chunk when max_retrans exceeded	2012-11-20 15:50:37 -05:00
sm_sideeffect.c	sctp: send abort chunk when max_retrans exceeded	2012-11-20 15:50:37 -05:00
sm_statefuns.c	sctp: check src addr when processing SACK to update transport state	2012-10-04 15:53:48 -04:00
sm_statetable.c	sctp: Make sysctl tunables per net	2012-08-14 23:32:16 -07:00
socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2012-11-29 12:51:17 -05:00
ssnmap.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
sysctl.c	sctp: Make hmac algorithm selection for cookie generation dynamic	2012-10-26 02:22:18 -04:00
transport.c	sctp: Error in calculation of RTTvar	2012-11-28 11:13:40 -05:00
tsnmap.c	sctp: use bitmap_weight	2012-11-17 22:01:18 -05:00
ulpevent.c	netvm: prevent a stream-specific deadlock	2012-07-31 18:42:47 -07:00
ulpqueue.c	sctp: Clean up type-punning in sctp_cmd_t union	2012-11-03 14:54:55 -04:00