Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1313558

[PATCH 3.10 26/35] ipv6: sctp: clone options to avoid use after free

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 9470e24f35ab81574da54e69df90c1eb4a96b43f ]

SCTP is lacking proper np->opt cloning at accept() time.

TCP and DCCP use ipv6_dup_options() helper, do the same
in SCTP.

We might later factorize this code in a common helper to avoid
future mistakes.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/ipv6.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -639,6 +639,7 @@ static struct sock *sctp_v6_create_accep
 	struct sock *newsk;
 	struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
 	struct sctp6_sock *newsctp6sk;
+	struct ipv6_txoptions *opt;
 
 	newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot);
 	if (!newsk)
@@ -658,6 +659,13 @@ static struct sock *sctp_v6_create_accep
 
 	memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 
+	rcu_read_lock();
+	opt = rcu_dereference(np->opt);
+	if (opt)
+		opt = ipv6_dup_options(newsk, opt);
+	RCU_INIT_POINTER(newnp->opt, opt);
+	rcu_read_unlock();
+
 	/* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname()
 	 * and getpeername().
 	 */

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/35] 3.10.95-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:10 +0100
  [PATCH 3.10 07/35] net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:10 +0100
  [PATCH 3.10 26/35] ipv6: sctp: clone options to avoid use after free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:10 +0100
  [PATCH 3.10 34/35] KEYS: Fix race between read and revoke Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:10 +0100
  [PATCH 3.10 17/35] nfs: if we have no valid attrs, then dont declare the attribute cache valid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 32/35] KEYS: Fix race between key destruction and finding a keyring by name Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 24/35] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 30/35] bluetooth: Validate socket address length in sco_sock_bind(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 25/35] sctp: update the netstamp_needed counter when copying sockets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 35/35] KEYS: Fix keyring ref leak in join_session_keyring() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 28/35] sh_eth: fix kernel oops in skb_put() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 31/35] af_unix: Revert lock_interruptible in stream receive code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 16/35] nfs4: start callback_ident at idr 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 18/35] USB: cdc_acm: Ignore Infineon Flash Loader utility Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 33/35] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 19/35] USB: cp210x: Remove CP2110 ID from compatibility list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 14/35] ext4, jbd2: ensure entering into panic after recording an error in superblock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 29/35] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:20 +0100
  [PATCH 3.10 10/35] broadcom: fix PHY_ID_BCM5481 entry in the id table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 22/35] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 20/35] USB: add quirk for devices with broken LPM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 09/35] net: ip6mr: fix static mfc/dev leaks on table destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 11/35] ipv6: distinguish frag queues by device for multicast and link-local packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 08/35] net: ipmr: fix static mfc/dev leaks on table destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 05/35] tcp: md5: fix lockdep annotation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 12/35] ipv6: sctp: implement sctp_v6_destroy_sock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 23/35] gre6: allow to update all parameters via rtnl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 15/35] firewire: ohci: fix JMicron JMB38x IT context discovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 03/35] snmp: Remove duplicate OUTMCAST stat increment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 13/35] Btrfs: fix race leading to BUG_ON when running delalloc for nodatacow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 06/35] tcp: initialize tp->copied_seq in case of cross SYN connection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 02/35] sctp: translate host order to network order when setting a hmacid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 21/35] USB: whci-hcd: add check for dma mapping error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  [PATCH 3.10 01/35] unix: avoid use-after-free in ep_remove_wait_queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-20 23:30 +0100
  Re: [PATCH 3.10 00/35] 3.10.95-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-01-21 00:20 +0100
    Re: [PATCH 3.10 00/35] 3.10.95-stable review Willy Tarreau <w@1wt.eu> - 2016-01-21 08:10 +0100
      Re: [PATCH 3.10 00/35] 3.10.95-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-22 09:00 +0100
        Re: [PATCH 3.10 00/35] 3.10.95-stable review Willy Tarreau <w@1wt.eu> - 2016-01-22 09:40 +0100
  Re: [PATCH 3.10 00/35] 3.10.95-stable review Guenter Roeck <linux@roeck-us.net> - 2016-01-21 13:30 +0100

csiph-web