[PATCH 3.16 173/328] ipv6: fix cleanup ordering for pingv6 registration

From: Ben Hutchings
Date: Sun Dec 09 2018 - 17:23:46 EST

3.16.62-rc1 review patch. If anyone has any objections, please let me know.


From: Sabrina Dubroca <sd@xxxxxxxxxxxxxxx>

commit a03dc36bdca6b614651fedfcd8559cf914d2d21d upstream.

Commit 6d0bfe226116 ("net: ipv6: Add IPv6 support to the ping socket.")
contains an error in the cleanup path of inet6_init(): when
proto_register(&pingv6_prot, 1) fails, we try to unregister
&pingv6_prot. When rawv6_init() fails, we skip unregistering

Example of panic (triggered by faking a failure of
proto_register(&pingv6_prot, 1)):

general protection fault: 0000 [#1] PREEMPT SMP KASAN PTI
RIP: 0010:__list_del_entry_valid+0x79/0x160
Call Trace:
? trace_preempt_on+0x6f0/0x6f0
? sock_no_shutdown+0x10/0x10

Fixes: 6d0bfe226116 ("net: ipv6: Add IPv6 support to the ping socket.")
Signed-off-by: Sabrina Dubroca <sd@xxxxxxxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
net/ipv6/af_inet6.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -860,14 +860,14 @@ static int __init inet6_init(void)

err = proto_register(&pingv6_prot, 1);
if (err)
- goto out_unregister_ping_proto;
+ goto out_unregister_raw_proto;

/* We MUST register RAW sockets before we create the ICMP6,
* IGMP6, or NDISC control sockets.
err = rawv6_init();
if (err)
- goto out_unregister_raw_proto;
+ goto out_unregister_ping_proto;

/* Register the family here so that the init calls below will
* be able to create sockets. (?? is this dangerous ??)