Patch "rxrpc: Fix possible NULL pointer access in ICMP handling" has been added to the 4.14-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix possible NULL pointer access in ICMP handling

to the 4.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-possible-null-pointer-access-in-icmp-handl.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1bcff3580326ea38a91d431e3535a53e11b53b06
Author: David Howells <dhowells@xxxxxxxxxx>
Date:   Thu Oct 10 15:52:34 2019 +0100

    rxrpc: Fix possible NULL pointer access in ICMP handling
    
    [ Upstream commit f0308fb0708078d6c1d8a4d533941a7a191af634 ]
    
    If an ICMP packet comes in on the UDP socket backing an AF_RXRPC socket as
    the UDP socket is being shut down, rxrpc_error_report() may get called to
    deal with it after sk_user_data on the UDP socket has been cleared, leading
    to a NULL pointer access when this local endpoint record gets accessed.
    
    Fix this by just returning immediately if sk_user_data was NULL.
    
    The oops looks like the following:
    
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    ...
    RIP: 0010:rxrpc_error_report+0x1bd/0x6a9
    ...
    Call Trace:
     ? sock_queue_err_skb+0xbd/0xde
     ? __udp4_lib_err+0x313/0x34d
     __udp4_lib_err+0x313/0x34d
     icmp_unreach+0x1ee/0x207
     icmp_rcv+0x25b/0x28f
     ip_protocol_deliver_rcu+0x95/0x10e
     ip_local_deliver+0xe9/0x148
     __netif_receive_skb_one_core+0x52/0x6e
     process_backlog+0xdc/0x177
     net_rx_action+0xf9/0x270
     __do_softirq+0x1b6/0x39a
     ? smpboot_register_percpu_thread+0xce/0xce
     run_ksoftirqd+0x1d/0x42
     smpboot_thread_fn+0x19e/0x1b3
     kthread+0xf1/0xf6
     ? kthread_delayed_work_timer_fn+0x83/0x83
     ret_from_fork+0x24/0x30
    
    Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
    Reported-by: syzbot+611164843bd48cc2190c@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
index 7f749505e699..7d73e8ce6660 100644
--- a/net/rxrpc/peer_event.c
+++ b/net/rxrpc/peer_event.c
@@ -150,6 +150,9 @@ void rxrpc_error_report(struct sock *sk)
 	struct rxrpc_peer *peer;
 	struct sk_buff *skb;
 
+	if (unlikely(!local))
+		return;
+
 	_enter("%p{%d}", sk, local->debug_id);
 
 	skb = sock_dequeue_err_skb(sk);