Files
linux/include/linux
Ziyang Xuan 4920327601 team: fix null-ptr-deref when team device type is changed
Get a null-ptr-deref bug as follows with reproducer [1].

BUG: kernel NULL pointer dereference, address: 0000000000000228
...
RIP: 0010:vlan_dev_hard_header+0x35/0x140 [8021q]
...
Call Trace:
 <TASK>
 ? __die+0x24/0x70
 ? page_fault_oops+0x82/0x150
 ? exc_page_fault+0x69/0x150
 ? asm_exc_page_fault+0x26/0x30
 ? vlan_dev_hard_header+0x35/0x140 [8021q]
 ? vlan_dev_hard_header+0x8e/0x140 [8021q]
 neigh_connected_output+0xb2/0x100
 ip6_finish_output2+0x1cb/0x520
 ? nf_hook_slow+0x43/0xc0
 ? ip6_mtu+0x46/0x80
 ip6_finish_output+0x2a/0xb0
 mld_sendpack+0x18f/0x250
 mld_ifc_work+0x39/0x160
 process_one_work+0x1e6/0x3f0
 worker_thread+0x4d/0x2f0
 ? __pfx_worker_thread+0x10/0x10
 kthread+0xe5/0x120
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x34/0x50
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1b/0x30

[1]
$ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}'
$ ip link add name t-dummy type dummy
$ ip link add link t-dummy name t-dummy.100 type vlan id 100
$ ip link add name t-nlmon type nlmon
$ ip link set t-nlmon master team0
$ ip link set t-nlmon nomaster
$ ip link set t-dummy up
$ ip link set team0 up
$ ip link set t-dummy.100 down
$ ip link set t-dummy.100 master team0

When enslave a vlan device to team device and team device type is changed
from non-ether to ether, header_ops of team device is changed to
vlan_header_ops. That is incorrect and will trigger null-ptr-deref
for vlan->real_dev in vlan_dev_hard_header() because team device is not
a vlan device.

Cache eth_header_ops in team_setup(), then assign cached header_ops to
header_ops of team net device when its type is changed from non-ether
to ether to fix the bug.

Fixes: 1d76efe157 ("team: add support for non-ethernet devices")
Suggested-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230918123011.1884401-1-william.xuanziyang@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2023-09-19 16:28:37 +02:00
..
2023-06-16 12:27:04 -06:00
2023-05-20 19:20:30 +02:00
2023-05-19 23:23:52 +05:30
2023-08-23 08:21:37 +01:00
2023-08-25 20:55:47 +02:00
2023-01-19 14:46:25 +01:00
2023-08-09 08:21:22 +02:00
2023-05-31 13:06:57 +02:00
2023-02-03 08:20:55 -07:00
2023-01-13 11:48:15 +01:00
2023-05-25 09:26:19 +02:00
2023-04-17 18:01:23 +02:00
2023-08-24 16:20:30 -07:00
2023-01-19 16:07:40 +01:00
2023-03-06 15:49:07 -06:00
2023-01-29 15:18:33 -07:00
2023-01-29 15:18:33 -07:00
2023-02-06 19:06:58 +01:00
2023-09-01 00:29:34 +02:00
2023-03-19 10:02:04 -07:00
2023-08-31 12:47:15 +02:00
2023-06-13 16:49:23 +02:00
2023-06-09 17:30:47 +02:00
2023-05-01 17:50:18 -07:00
2023-08-04 11:02:46 +01:00
2023-08-05 08:18:04 -04:00
2023-07-14 13:47:07 -06:00
2023-08-18 10:12:10 -07:00
2023-08-15 14:57:25 -07:00
2023-08-18 10:18:59 -07:00
2023-07-11 14:12:19 -07:00
2023-01-19 09:24:30 +01:00
2023-06-20 20:17:10 -07:00
2023-05-24 18:08:49 +02:00
2023-06-19 15:08:12 -04:00
2023-08-18 10:12:25 -07:00
2023-08-21 14:28:45 -07:00
2023-06-23 16:59:30 -07:00
2023-06-05 09:36:39 +02:00
2023-07-18 10:07:47 +02:00
2023-03-06 09:57:07 +01:00
2022-12-20 03:13:45 +01:00
2023-08-12 09:18:47 -07:00
2023-05-23 12:55:12 -07:00
2023-09-02 15:17:33 -07:00
2023-07-15 11:34:49 -07:00
2023-06-23 16:59:28 -07:00
2023-01-19 15:01:19 +01:00
2023-05-18 19:52:31 -07:00
2023-06-11 18:22:47 +02:00
2023-07-18 10:07:47 +02:00
2023-06-05 09:36:39 +02:00
2023-06-24 15:50:13 -07:00
2023-08-21 13:37:26 -07:00
2023-08-06 08:24:55 +01:00
2023-08-07 17:55:54 +00:00
2023-08-11 21:12:47 +02:00
2023-03-16 13:08:39 -07:00
2023-03-23 17:25:46 +01:00
2023-08-24 13:27:47 -05:00
2023-03-29 08:19:38 +01:00
2023-04-05 20:03:01 -07:00
2023-04-21 03:02:34 -04:00
2023-08-21 14:52:16 +02:00
2023-08-21 13:37:27 -07:00