Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1172073

[PATCH 3.16.y-ckt 41/71] ipv4/udp: Verify multicast group is ours in upd_v4_early_demux()

From Luis Henriques <luis.henriques@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.16.y-ckt 41/71] ipv4/udp: Verify multicast group is ours in upd_v4_early_demux()
Date 2015-06-25 12:20 +0200
Message-ID <pFcqf-5Nm-49@gated-at.bofh.it> (permalink)
References <pFcgx-5Bx-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shawn Bohrer <sbohrer@rgmadvisors.com>

commit 6e540309326188f769e03bb4c6dd8ff6752930c2 upstream.

421b3885bf6d56391297844f43fb7154a6396e12 "udp: ipv4: Add udp early
demux" introduced a regression that allowed sockets bound to INADDR_ANY
to receive packets from multicast groups that the socket had not joined.
For example a socket that had joined 224.168.2.9 could also receive
packets from 225.168.2.9 despite not having joined that group if
ip_early_demux is enabled.

Fix this by calling ip_check_mc_rcu() in udp_v4_early_demux() to verify
that the multicast packet is indeed ours.

Signed-off-by: Shawn Bohrer <sbohrer@rgmadvisors.com>
Reported-by: Yurij M. Plotnikov <Yurij.Plotnikov@oktetlabs.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/ipv4/udp.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 688658dd7958..4d94056ce452 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -90,6 +90,7 @@
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/igmp.h>
+#include <linux/inetdevice.h>
 #include <linux/in.h>
 #include <linux/errno.h>
 #include <linux/timer.h>
@@ -1953,6 +1954,7 @@ void udp_v4_early_demux(struct sk_buff *skb)
 	struct sock *sk;
 	struct dst_entry *dst;
 	int dif = skb->dev->ifindex;
+	int ours;
 
 	/* validate the packet */
 	if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
@@ -1962,14 +1964,24 @@ void udp_v4_early_demux(struct sk_buff *skb)
 	uh = udp_hdr(skb);
 
 	if (skb->pkt_type == PACKET_BROADCAST ||
-	    skb->pkt_type == PACKET_MULTICAST)
+	    skb->pkt_type == PACKET_MULTICAST) {
+		struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+
+		if (!in_dev)
+			return;
+
+		ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
+				       iph->protocol);
+		if (!ours)
+			return;
 		sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
 						   uh->source, iph->saddr, dif);
-	else if (skb->pkt_type == PACKET_HOST)
+	} else if (skb->pkt_type == PACKET_HOST) {
 		sk = __udp4_lib_demux_lookup(net, uh->dest, iph->daddr,
 					     uh->source, iph->saddr, dif);
-	else
+	} else {
 		return;
+	}
 
 	if (!sk)
 		return;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.16.y-ckt stable] Linux 3.16.7-ckt14 stable review Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 47/71] btrfs: cleanup orphans while looking up default subvolume Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 62/71] iser-target: Fix variable-length response error completion Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 13/71] ozwpan: Use unsigned ints to prevent heap overflow Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 01/71] iio: adis16400: Report pressure channel scale Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 15/71] ozwpan: unchecked signed subtraction leads to DoS Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 70/71] drm/radeon: fix freeze for laptop with Turks/Thames GPU. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 61/71] block: fix ext_dev_lock lockdep report Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 14/71] ozwpan: divide-by-zero leading to panic Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 50/71] iommu/vt-d: Allow RMRR on graphics devices too Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 56/71] Input: synaptics - add min/max quirk for Lenovo S540 Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 10/71] usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 46/71] btrfs: incorrect handling for fiemap_fill_next_extent return Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 55/71] pata_octeon_cf: fix broken build Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 65/71] drm/mgag200: Reject non-character-cell-aligned mode widths Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 67/71] crypto: caam - improve initalization for context state saves Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 57/71] drm/i915: Fix DDC probe for passive adapters Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 51/71] iommu/vt-d: Fix passthrough mode with translation-disabled devices Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 68/71] crypto: caam - fix RNG buffer cache alignment Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 12/71] ozwpan: Use proper check to prevent heap overflow Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 63/71] iser-target: release stale iser connections Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 54/71] irqchip: sunxi-nmi: Fix off-by-one error in irq iterator Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 71/71] Revert "tools/vm: fix page-flags build" Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 11/71] ALSA: usb-audio: Add mic volume fix quirk for Logitech Quickcam Fusion Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 69/71] tracing: Have filter check for balanced ops Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 59/71] mm/memory_hotplug.c: set zone->wait_table to null after freeing it Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 66/71] crypto: caam - fix uninitialized state->buf_dma field Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 52/71] ata: ahci_mvebu: Fix wrongly set base address for the MBus window setting Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 60/71] ring-buffer-benchmark: Fix the wrong sched_priority of producer Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 64/71] ALSA: hda - adding a DAC/pin preference map for a HP Envy TS machine Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 35/71] net: dp83640: fix broken calibration routine. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 36/71] net: dp83640: reinforce locking rules. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 29/71] scripts/sortextable: suppress warning: `relocs_size' may be used uninitialized Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 30/71] thermal: step_wise: Revert optimization Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 20/71] Input: elantech - fix detection of touchpads where the revision matches a known rate Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 37/71] unix/caif: sk_socket can disappear when state is unlocked Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 24/71] USB: cp210x: add ID for HubZ dual ZigBee and Z-Wave dongle Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 21/71] ALSA: hda/realtek - Add a fixup for another Acer Aspire 9420 Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 28/71] kconfig: Fix warning "‘jump’ may be used uninitialized" Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 23/71] ALSA: usb-audio: fix missing input volume controls in MAYA44 USB(+) Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 31/71] MIPS: KVM: Do not sign extend on unsigned MMIO load Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 38/71] xen/netback: Properly initialize credit_bytes Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 27/71] xfrm: fix a race in xfrm_state_lookup_byspi Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 42/71] bridge: disable softirqs around br_fdb_update to avoid lockup Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 39/71] udp: fix behavior of wrong checksums Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 22/71] ALSA: usb-audio: add MAYA44 USB+ mixer control names Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 41/71] ipv4/udp: Verify multicast group is ours in upd_v4_early_demux() Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 40/71] xen: netback: read hotplug script once at start of day. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 43/71] drm/i915: Assume dual channel LVDS if pixel clock necessitates it Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 44/71] Btrfs: send, add missing check for dead clone root Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 33/71] net: core: Correct an over-stringent device loop detection. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 34/71] net: phy: Allow EEE for all RGMII variants Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 32/71] arch/x86/kvm/mmu.c: work around gcc-4.4.4 bug Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 18/71] x86/asm/irq: Stop relying on magic JMP behavior for early_idt_handlers Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 48/71] Drivers: hv: vmbus: Add support for VMBus panic notifier handler Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 25/71] Input: elantech - add new icbody type Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 26/71] MIPS: Fix enabling of DEBUG_STACKOVERFLOW Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 45/71] Btrfs: send, don't leave without decrementing clone root's send_progress Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200

csiph-web