mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-01-18 22:18:44 -05:00
Code Issues Packages Projects Releases Wiki Activity
Files
e4fe082c38cd74a8fa384bc7542cf3edf1cb7318
linux/drivers
History
Vasiliy Kovalev 136cfaca22 gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() 
The gtp_net_ops pernet operations structure for the subsystem must be
registered before registering the generic netlink family.

Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug:

general protection fault, probably for non-canonical address
0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014
RIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]
Code: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86
      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>
      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74
RSP: 0018:ffff888014107220 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000
FS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
 <TASK>
 ? show_regs+0x90/0xa0
 ? die_addr+0x50/0xd0
 ? exc_general_protection+0x148/0x220
 ? asm_exc_general_protection+0x22/0x30
 ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]
 ? __alloc_skb+0x1dd/0x350
 ? __pfx___alloc_skb+0x10/0x10
 genl_dumpit+0x11d/0x230
 netlink_dump+0x5b9/0xce0
 ? lockdep_hardirqs_on_prepare+0x253/0x430
 ? __pfx_netlink_dump+0x10/0x10
 ? kasan_save_track+0x10/0x40
 ? __kasan_kmalloc+0x9b/0xa0
 ? genl_start+0x675/0x970
 __netlink_dump_start+0x6fc/0x9f0
 genl_family_rcv_msg_dumpit+0x1bb/0x2d0
 ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10
 ? genl_op_from_small+0x2a/0x440
 ? cap_capable+0x1d0/0x240
 ? __pfx_genl_start+0x10/0x10
 ? __pfx_genl_dumpit+0x10/0x10
 ? __pfx_genl_done+0x10/0x10
 ? security_capable+0x9d/0xe0

Cc: stable@vger.kernel.org
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Fixes: 459aa660eb ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Link: https://lore.kernel.org/r/20240214162733.34214-1-kovalev@altlinux.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-02-21 14:15:22 -08:00
..
accel
accel/ivpu: Add job status for jobs aborted by the driver
2024-02-06 13:37:34 +01:00
accessibility
…
acpi
cxl/cper: Fix errant CPER prints for CXL events
2024-02-03 18:31:17 +01:00
amba
…
android
binder: signal epoll threads of self-work
2024-01-31 14:08:28 -08:00
ata
ahci: Extend ASM1061 43-bit DMA address quirk to other ASM106x parts
2024-01-31 12:09:34 +01:00
atm
atm: idt77252: fix a memleak in open_card_ubr0
2024-02-03 12:46:13 +00:00
auxdisplay
Merge tag 'drm-next-2024-01-10' of git://anongit.freedesktop.org/drm/drm
2024-01-12 11:32:19 -08:00
base
regmap: kunit: Ensure that changed bytes are actually different
2024-02-12 13:55:51 +00:00
bcma
…
block
Merge tag 'block-6.8-2024-02-10' of git://git.kernel.dk/linux
2024-02-10 08:02:48 -08:00
bluetooth
Merge tag 'usb-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2024-01-18 11:43:55 -08:00
bus
Merge tag 'char-misc-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2024-01-17 16:47:17 -08:00
cache
…
cdrom
…
cdx
cdx: Unlock on error path in rescan_store()
2024-01-04 17:01:14 +01:00
char
Merge tag 'tty-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2024-01-18 11:37:24 -08:00
clk
clk: qcom: gcc-x1e80100: Replace of_device.h with explicit includes
2024-01-19 08:17:28 -06:00
clocksource
clocksource/drivers/ep93xx: Fix error handling during probe
2023-12-27 15:37:11 +01:00
comedi
…
connector
connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared"
2024-02-13 11:15:44 +01:00
counter
…
cpufreq
cpufreq/amd-pstate: Fix setting scaling max/min freq values
2024-01-22 20:35:58 +01:00
cpuidle
cpuidle: haltpoll: Do not enable interrupts when entering idle
2023-12-29 18:08:18 +01:00
crypto
crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
2024-02-02 18:08:12 +08:00
cxl
Merge tag 'efi-fixes-for-v6.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi
2024-02-09 10:40:50 -08:00
dax
Merge tag 'xfs-6.8-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
2024-01-10 08:45:22 -08:00
dca
…
devfreq
…
dio
…
dma
dmaengine: at_hdmac: add missing kernel-doc style description
2024-02-02 17:16:55 +01:00
dma-buf
dma-buf: heaps: Don't track CMA dma-buf pages under RssFile
2024-01-31 19:54:58 +05:30
dpll
dpll: fix possible deadlock during netlink dump operation
2024-02-08 18:29:21 -08:00
edac
Merge tag 'driver-core-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
2024-01-18 09:48:40 -08:00
eisa
…
extcon
…
firewire
firewire: core: send bus reset promptly on gap count error
2024-02-07 08:20:02 +09:00
firmware
Merge tag 'efi-fixes-for-v6.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi
2024-02-09 10:40:50 -08:00
fpga
Merge tag 'char-misc-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2024-01-17 16:47:17 -08:00
fsi
…
gnss
Merge tag 'tty-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2024-01-18 11:37:24 -08:00
gpio
gpio: remove GPIO device from the list unconditionally in error path
2024-02-08 10:33:03 +01:00
gpu
Merge tag 'drm-msm-fixes-2024-02-07' of https://gitlab.freedesktop.org/drm/msm into drm-fixes
2024-02-09 11:32:38 +10:00
greybus
Merge tag 'tty-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2024-01-18 11:37:24 -08:00
hid
HID: wacom: generic: Avoid reporting a serial of '0' to userspace
2024-02-13 11:40:23 +01:00
hsi
…
hte
…
hv
…
hwmon
hwmon: (coretemp) Enlarge per package core count limit
2024-02-04 06:43:45 -08:00
hwspinlock
…
hwtracing
…
i2c
Merge tag 'i2c-for-6.8-rc1-rebased' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
2024-01-18 17:29:01 -08:00
i3c
i3c: master: cdns: Update maximum prescaler value for i2c clock
2024-01-08 00:51:36 +01:00
idle
Merge tag 'pm-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2024-01-09 16:32:11 -08:00
iio
Merge tag 'tty-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2024-01-18 11:37:24 -08:00
infiniband
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
2024-01-12 13:52:21 -08:00
input
Merge tag 'input-for-v6.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2024-02-02 12:52:44 -08:00
interconnect
Merge tag 'char-misc-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2024-01-17 16:47:17 -08:00
iommu
iommu: Allow ops->default_domain to work when !CONFIG_IOMMU_DMA
2024-02-01 13:16:17 +01:00
ipack
Merge tag 'tty-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2024-01-18 11:37:24 -08:00
irqchip
Merge tag 'header_cleanup-2024-01-10' of https://evilpiepirate.org/git/bcachefs
2024-01-10 16:43:55 -08:00
isdn
…
leds
Merge tag 'leds-next-6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds
2024-01-17 15:25:27 -08:00
macintosh
…
mailbox
Merge tag 'mailbox-v6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox
2024-01-17 15:39:32 -08:00
mcb
…
md
dm-crypt, dm-verity: disable tasklets
2024-02-02 12:33:50 -05:00
media
media: vb2: refactor setting flags and caps, fix missing cap
2024-01-24 17:27:51 +01:00
memory
Merge tag 'iommu-updates-v6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu
2024-01-18 15:16:57 -08:00
memstick
…
message
…
mfd
Merge tag 'tty-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2024-01-18 11:37:24 -08:00
misc
misc: open-dice: Fix spurious lockdep warning
2024-01-30 16:20:54 -08:00
mmc
mmc: slot-gpio: Allow non-sleeping GPIO ro
2024-02-06 12:35:44 +01:00
most
…
mtd
Merge tag 'ubifs-for-linus-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs
2024-01-17 10:27:13 -08:00
mux
mux: mmio: use reg property when parent device is not a syscon
2024-01-04 17:01:14 +01:00
net
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
2024-02-21 14:15:22 -08:00
nfc
…
ntb
…
nubus
nubus: Make nubus_bus_type static and constant
2024-01-03 13:33:59 +01:00
nvdimm
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
2024-01-18 16:44:03 -08:00
nvme
nvme: use ns->head->pi_size instead of t10_pi_tuple structure size
2024-02-07 15:49:36 -08:00
nvmem
Merge tag 'char-misc-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2024-01-17 16:47:17 -08:00
of
Merge tag 'devicetree-fixes-for-6.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
2024-02-15 10:19:55 -08:00
opp
OPP: Rename 'rate_clk_single'
2024-01-05 15:55:41 +05:30
parisc
parisc/power: Fix power soft-off button emulation on qemu
2024-01-07 22:59:16 +01:00
parport
…
pci
Merge tag 'pci-v6.8-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
2024-02-09 10:37:59 -08:00
pcmcia
…
peci
…
perf
Merge tag 'acpi-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2024-01-09 16:12:44 -08:00
phy
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
2024-01-30 22:41:11 +05:30
pinctrl
pinctrl: amd: Add IRQF_ONESHOT to the interrupt request
2024-01-31 10:06:07 +01:00
platform
platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet
2024-01-26 20:21:47 +01:00
pmdomain
pmdomain: mediatek: fix race conditions with genpd
2024-01-23 13:19:15 +01:00
pnp
Merge tag 'acpi-6.8-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2024-01-17 14:37:40 -08:00
power
Revert "power: supply: qcom_battmgr: Register the power supplies after PDR is up"
2024-01-26 22:45:58 +01:00
powercap
…
pps
…
ps3
…
ptp
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-01-04 18:06:46 -08:00
pwm
pwm: jz4740: Don't use dev_err_probe() in .request()
2024-01-12 18:25:05 +01:00
rapidio
rapidio/tsi721: fix kernel-doc warnings
2023-12-20 15:02:57 -08:00
ras
…
regulator
regulator (max5970): Fix IRQ handler
2024-01-30 15:27:16 +00:00
remoteproc
…
reset
Merge tag 'soc-drivers-6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2024-01-11 11:31:46 -08:00
rpmsg
…
rtc
rtc: nuvoton: Compatible with NCT3015Y-R and NCT3018Y-R
2024-01-18 01:05:33 +01:00
s390
s390/qeth: Fix potential loss of L3-IP@ in case of network issues
2024-02-08 12:10:09 +01:00
sbus
…
scsi
scsi: lpfc: Use unsigned type for num_sge
2024-02-05 16:19:11 -05:00
sh
maple: make maple_bus_type static and const
2024-01-04 14:37:17 +01:00
siox
…
slimbus
…
soc
soc: apple: mailbox: error pointers are negative integers
2024-01-30 11:34:49 -08:00
soundwire
Merge tag 'soundwire-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire
2024-01-18 17:08:31 -08:00
spi
spi-mxs: Fix chipselect glitch
2024-02-13 15:48:22 +00:00
spmi
…
ssb
…
staging
Merge tag 'i2c-for-6.8-rc1-rebased' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
2024-01-18 17:29:01 -08:00
target
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2024-01-20 09:42:32 -08:00
tc
…
tee
Merge tag 'docs-6.8' of git://git.lwn.net/linux
2024-01-11 19:46:52 -08:00
thermal
thermal: intel: powerclamp: Remove dead code for target mwait value
2024-01-22 11:59:22 +01:00
thunderbolt
Merge tag 'usb-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2024-01-18 11:43:55 -08:00
tty
serial: max310x: prevent infinite while() loop in port startup
2024-01-27 19:09:10 -08:00
ufs
scsi: ufs: core: Remove the ufshcd_release() in ufshcd_err_handling_prepare()
2024-02-05 16:31:18 -05:00
uio
uio: Fix use-after-free in uio_open
2024-01-04 17:03:47 +01:00
usb
Merge tag 'usb-serial-6.8-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
2024-02-02 08:36:38 -08:00
vdpa
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
2024-01-18 16:44:03 -08:00
vfio
Merge tag 'vfio-v6.8-rc1' of https://github.com/awilliam/linux-vfio
2024-01-18 15:57:25 -08:00
vhost
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
2024-01-18 16:44:03 -08:00
video
fbdev: stifb: Fix crash in stifb_blank()
2024-01-23 09:13:24 +01:00
virt
Merge tag 'char-misc-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2024-01-17 16:47:17 -08:00
virtio
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
2024-01-18 16:44:03 -08:00
w1
w1: ds2433: add support for ds28ec20 eeprom
2023-12-20 09:25:25 +01:00
watchdog
Merge tag 'linux-watchdog-6.8-rc1' of git://www.linux-watchdog.org/linux-watchdog
2024-01-12 13:32:30 -08:00
xen
xen/events: close evtchn after mapping cleanup
2024-02-13 10:12:47 +01:00
zorro
…
Kconfig
…
Makefile
fbdev/intelfb: Remove driver
2024-01-12 12:38:37 +01:00