]> git.baikalelectronics.ru Git - kernel.git/commit
gtp: fix an use-before-init in gtp_newlink()
authorMasahiro Fujiwara <fujiwara.masahiro@gmail.com>
Tue, 27 Oct 2020 11:48:46 +0000 (20:48 +0900)
committerJakub Kicinski <kuba@kernel.org>
Thu, 29 Oct 2020 16:43:21 +0000 (09:43 -0700)
commit0bf5a4bfd9dd26c6e713b1aa738ffe933a467372
tree4d1576d6cd250eebf1dc9ea072a25f4ddbf0cfc0
parent32ce846d7b4bf9cda00aa000b1b12c832605d0ee
gtp: fix an use-before-init in gtp_newlink()

*_pdp_find() from gtp_encap_recv() would trigger a crash when a peer
sends GTP packets while creating new GTP device.

RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp]
<SNIP>
Call Trace:
 <IRQ>
 gtp_encap_recv+0xc2/0x2e0 [gtp]
 ? gtp1_pdp_find.isra.0+0x90/0x90 [gtp]
 udp_queue_rcv_one_skb+0x1fe/0x530
 udp_queue_rcv_skb+0x40/0x1b0
 udp_unicast_rcv_skb.isra.0+0x78/0x90
 __udp4_lib_rcv+0x5af/0xc70
 udp_rcv+0x1a/0x20
 ip_protocol_deliver_rcu+0xc5/0x1b0
 ip_local_deliver_finish+0x48/0x50
 ip_local_deliver+0xe5/0xf0
 ? ip_protocol_deliver_rcu+0x1b0/0x1b0

gtp_encap_enable() should be called after gtp_hastable_new() otherwise
*_pdp_find() will access the uninitialized hash table.

Fixes: c470db6d2466 ("gtp: make GTP sockets in gtp_newlink optional")
Signed-off-by: Masahiro Fujiwara <fujiwara.masahiro@gmail.com>
Link: https://lore.kernel.org/r/20201027114846.3924-1-fujiwara.masahiro@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/gtp.c