• Eric Dumazet's avatar
    veth: avoid a NULL deref in veth_stats_one · d0e2c55e
    Eric Dumazet authored
    commit 2681128f (veth: extend device features) added a NULL deref
    in veth_stats_one(), as veth_get_stats64() was not testing if the peer
    device was setup or not.
    
    At init time, we call dev_get_stats() before veth pair is fully setup.
    
    [  178.854758]  [<ffffffffa00f5677>] veth_get_stats64+0x47/0x70 [veth]
    [  178.861013]  [<ffffffff814f0a2d>] dev_get_stats+0x6d/0x130
    [  178.866486]  [<ffffffff81504efc>] rtnl_fill_ifinfo+0x47c/0x930
    [  178.872299]  [<ffffffff81505b93>] rtmsg_ifinfo+0x83/0x100
    [  178.877678]  [<ffffffff81505cc6>] rtnl_configure_link+0x76/0xa0
    [  178.883580]  [<ffffffffa00f52fa>] veth_newlink+0x16a/0x350 [veth]
    [  178.889654]  [<ffffffff815061cc>] rtnl_newlink+0x4dc/0x5e0
    [  178.895128]  [<ffffffff81505e1e>] ? rtnl_newlink+0x12e/0x5e0
    [  178.900769]  [<ffffffff8150587d>] rtnetlink_rcv_msg+0x11d/0x310
    [  178.906669]  [<ffffffff81505760>] ? __rtnl_unlock+0x20/0x20
    [  178.912225]  [<ffffffff81521f89>] netlink_rcv_skb+0xa9/0xd0
    [  178.917779]  [<ffffffff81502d55>] rtnetlink_rcv+0x25/0x40
    [  178.923159]  [<ffffffff815218d1>] netlink_unicast+0x1b1/0x230
    [  178.928887]  [<ffffffff81521c4e>] netlink_sendmsg+0x2fe/0x3b0
    [  178.934615]  [<ffffffff814dbe22>] sock_sendmsg+0xd2/0xf0
    
    So we must check if peer was setup in veth_get_stats64()
    
    As pointed out by Ben Hutchings, priv->peer is missing proper
    synchronization. Adding RCU protection is a safe and well documented
    way to make sure we don't access about to be freed or already
    freed data.
    Reported-by: default avatarTom Parkin <tparkin@katalix.com>
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    CC: Ben Hutchings <bhutchings@solarflare.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d0e2c55e
veth.c 10.1 KB