Remi Pommarel e6e9d78081 batman-adv: Do not get eth header before batadv_check_management_packet ... commit eac27a41ab641de074655d2932fc7f8cdb446881 upstream. If received skb in batadv_v_elp_packet_recv or batadv_v_ogm_packet_recv is either cloned or non linearized then its data buffer will be reallocated by batadv_check_management_packet when skb_cow or skb_linearize get called. Thus geting ethernet header address inside skb data buffer before batadv_check_management_packet had any chance to reallocate it could lead to the following kernel panic: Unable to handle kernel paging request at virtual address ffffff8020ab069a Mem abort info: ESR = 0x96000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000040f45000 [ffffff8020ab069a] pgd=180000007fffa003, p4d=180000007fffa003, pud=180000007fffa003, pmd=180000007fefe003, pte=0068000020ab0706 Internal error: Oops: 96000007 [#1] SMP Modules linked in: ahci_mvebu libahci_platform libahci dvb_usb_af9035 dvb_usb_dib0700 dib0070 dib7000m dibx000_common ath11k_pci ath10k_pci ath10k_core mwl8k_new nf_nat_sip nf_conntrack_sip xhci_plat_hcd xhci_hcd nf_nat_pptp nf_conntrack_pptp at24 sbsa_gwdt CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.15.42-00066-g3242268d425c-dirty #550 Hardware name: A8k (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : batadv_is_my_mac+0x60/0xc0 lr : batadv_v_ogm_packet_recv+0x98/0x5d0 sp : ffffff8000183820 x29: ffffff8000183820 x28: 0000000000000001 x27: ffffff8014f9af00 x26: 0000000000000000 x25: 0000000000000543 x24: 0000000000000003 x23: ffffff8020ab0580 x22: 0000000000000110 x21: ffffff80168ae880 x20: 0000000000000000 x19: ffffff800b561000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00dc098924ae0032 x14: 0f0405433e0054b0 x13: ffffffff00000080 x12: 0000004000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffffffc076dae000 x6 : ffffff8000183700 x5 : ffffffc00955e698 x4 : ffffff80168ae000 x3 : ffffff80059cf000 x2 : ffffff800b561000 x1 : ffffff8020ab0696 x0 : ffffff80168ae880 Call trace: batadv_is_my_mac+0x60/0xc0 batadv_v_ogm_packet_recv+0x98/0x5d0 batadv_batman_skb_recv+0x1b8/0x244 __netif_receive_skb_core.isra.0+0x440/0xc74 __netif_receive_skb_one_core+0x14/0x20 netif_receive_skb+0x68/0x140 br_pass_frame_up+0x70/0x80 br_handle_frame_finish+0x108/0x284 br_handle_frame+0x190/0x250 __netif_receive_skb_core.isra.0+0x240/0xc74 __netif_receive_skb_list_core+0x6c/0x90 netif_receive_skb_list_internal+0x1f4/0x310 napi_complete_done+0x64/0x1d0 gro_cell_poll+0x7c/0xa0 __napi_poll+0x34/0x174 net_rx_action+0xf8/0x2a0 _stext+0x12c/0x2ac run_ksoftirqd+0x4c/0x7c smpboot_thread_fn+0x120/0x210 kthread+0x140/0x150 ret_from_fork+0x10/0x20 Code: f9403844 eb03009f 54fffee1 f94 Thus ethernet header address should only be fetched after batadv_check_management_packet has been called. Fixes: 0da0035942 ("batman-adv: OGMv2 - add basic infrastructure") Cc: stable@vger.kernel.org Signed-off-by: Remi Pommarel <repk@triplefau.lt> Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-08-30 16:27:25 +02:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-09-15 09:47:31 +02:00
9p	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition	2023-04-20 12:07:36 +02:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2023-01-18 11:41:37 +01:00
8021q	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()	2023-05-30 12:44:06 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 14:47:41 +02:00
atm	atm: hide unused procfs functions	2023-06-09 10:28:59 +02:00
ax25	ax25: Fix UAF bugs in ax25 timers	2022-04-20 09:19:40 +02:00
batman-adv	batman-adv: Do not get eth header before batadv_check_management_packet	2023-08-30 16:27:25 +02:00
bluetooth	Bluetooth: L2CAP: Fix use-after-free	2023-08-30 16:27:11 +02:00
bpf	bpf: Move skb->len == 0 checks into __bpf_redirect	2023-01-18 11:41:04 +01:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-07-14 16:53:33 +02:00
bridge	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode	2023-07-27 08:37:23 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:32:51 +01:00
can	can: bcm: Fix UAF in bcm_proc_show()	2023-07-27 08:37:40 +02:00
ceph	libceph: fix potential hang in ceph_osdc_notify()	2023-08-11 11:53:58 +02:00
core	net: validate veth and vxcan peer ifindexes	2023-08-30 16:27:24 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 11:53:57 +02:00
dccp	dccp: annotate data-races in dccp_poll()	2023-08-30 16:27:23 +02:00
decnet	Remove DECnet support from kernel	2023-06-21 15:44:10 +02:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-23 10:36:45 +02:00
dsa	net: dsa: tag_sja1105: fix MAC DA patching from meta frames	2023-07-27 08:37:24 +02:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:20:06 +01:00
hsr	hsr: Avoid double remove of a node.	2023-01-18 11:41:09 +01:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-11-03 23:56:54 +09:00
ife	net: Fix Kconfig indentation	2019-09-26 08:56:17 +02:00
ipv4	net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled	2023-08-30 16:27:19 +02:00
ipv6	ip6_vti: fix slab-use-after-free in decode_session6	2023-08-30 16:27:16 +02:00
iucv	treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()	2023-04-20 12:07:32 +02:00
kcm	kcm: close race conditions on sk_receive_queue	2022-11-25 17:42:21 +01:00
key	net: af_key: fix sadb_x_filter validation	2023-08-30 16:27:16 +02:00
l2tp	inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().	2023-04-26 11:24:05 +02:00
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-27 13:50:47 +02:00
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:25:28 +01:00
llc	llc: Don't drop packet from non-root netns.	2023-07-27 08:37:44 +02:00
mac80211	wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta	2023-04-20 12:07:33 +02:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-14 11:30:45 +01:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:50:41 +01:00
ncsi	net/ncsi: Fix gma flag setting after response	2023-08-30 16:27:14 +02:00
netfilter	netfilter: set default timeout to 3 secs for sctp shutdown send and recv state	2023-08-30 16:27:19 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-04-15 14:18:35 +02:00
netlink	netlink: Add __sock_i_ino() for __netlink_diag_dump().	2023-07-27 08:37:12 +02:00
netrom	netrom: fix info-leak in nr_write_internal()	2023-06-09 10:28:52 +02:00
nfc	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-07-27 08:37:11 +02:00
nsh	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()	2023-05-30 12:44:05 +01:00
openvswitch	net: openvswitch: fix flow memory leak in ovs_flow_cmd_new	2023-02-22 12:50:25 +01:00
packet	net/packet: annotate data-races around tp->status	2023-08-16 18:19:23 +02:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:23:33 +01:00
psample	net: psample: fix skb_over_panic	2019-12-04 22:30:54 +01:00
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2021-09-03 10:08:12 +02:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-03-11 16:43:41 +01:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-24 13:29:05 +01:00
rose	net/rose: Fix to not accept on connected socket	2023-02-22 12:50:34 +01:00
rxrpc	rxrpc: Fix hard call timeout units	2023-05-17 11:35:59 +02:00
sched	net/sched: fix a qdisc modification with ambiguous command request	2023-08-30 16:27:24 +02:00
sctp	sock: annotate data-races around prot->memory_pressure	2023-08-30 16:27:23 +02:00
smc	net/smc: fix fallback failed while sendmsg with fastopen	2023-03-17 08:32:51 +01:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-17 09:48:48 +01:00
sunrpc	SUNRPC: Fix UAF in svc_tcp_listen_data_ready()	2023-07-27 08:37:35 +02:00
switchdev	net: switchdev: do not propagate bridge updates across bridges	2021-10-27 09:54:24 +02:00
tipc	net: tipc: resize nlattr array to correct size	2023-06-21 15:44:12 +02:00
tls	treewide: Remove uninitialized_var() usage	2023-06-09 10:29:01 +02:00
unix	af_unix: Fix null-ptr-deref in unix_stream_sendpage().	2023-08-30 16:27:19 +02:00
vmw_vsock	vsock: avoid to close connected socket after the timeout	2023-05-30 12:44:05 +01:00
wimax	wimax: no need to check return value of debugfs_create functions	2019-08-10 15:25:47 -07:00
wireless	wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()	2023-07-27 08:37:42 +02:00
x25	net/x25: Fix to not accept on connected socket	2023-02-22 12:50:26 +01:00
xdp	xsk: Honor SO_BINDTODEVICE on bind	2023-07-27 08:37:23 +02:00
xfrm	net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure	2023-08-30 16:27:20 +02:00
compat.c	net: Return the correct errno code	2021-06-18 09:59:00 +02:00
Kconfig	Remove DECnet support from kernel	2023-06-21 15:44:10 +02:00
Makefile	Remove DECnet support from kernel	2023-06-21 15:44:10 +02:00
socket.c	net: annotate sk->sk_err write from do_recvmmsg()	2023-05-30 12:44:01 +01:00
sysctl_net.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00