Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1558320
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 05/59] ipv6: handle -EFAULT from skb_copy_bits |
| Date | 2017-01-13 13:10 +0100 |
| Message-ID | <sZ8Qc-HA-63@gated-at.bofh.it> (permalink) |
| References | <sZ8Q9-HA-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jones <davej@codemonkey.org.uk>
[ Upstream commit a98f91758995cb59611e61318dddd8a6956b52c3 ]
By setting certain socket options on ipv6 raw sockets, we can confuse the
length calculation in rawv6_push_pending_frames triggering a BUG_ON.
RIP: 0010:[<ffffffff817c6390>] [<ffffffff817c6390>] rawv6_sendmsg+0xc30/0xc40
RSP: 0018:ffff881f6c4a7c18 EFLAGS: 00010282
RAX: 00000000fffffff2 RBX: ffff881f6c681680 RCX: 0000000000000002
RDX: ffff881f6c4a7cf8 RSI: 0000000000000030 RDI: ffff881fed0f6a00
RBP: ffff881f6c4a7da8 R08: 0000000000000000 R09: 0000000000000009
R10: ffff881fed0f6a00 R11: 0000000000000009 R12: 0000000000000030
R13: ffff881fed0f6a00 R14: ffff881fee39ba00 R15: ffff881fefa93a80
Call Trace:
[<ffffffff8118ba23>] ? unmap_page_range+0x693/0x830
[<ffffffff81772697>] inet_sendmsg+0x67/0xa0
[<ffffffff816d93f8>] sock_sendmsg+0x38/0x50
[<ffffffff816d982f>] SYSC_sendto+0xef/0x170
[<ffffffff816da27e>] SyS_sendto+0xe/0x10
[<ffffffff81002910>] do_syscall_64+0x50/0xa0
[<ffffffff817f7cbc>] entry_SYSCALL64_slow_path+0x25/0x25
Handle by jumping to the failure path if skb_copy_bits gets an EFAULT.
Reproducer:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#define LEN 504
int main(int argc, char* argv[])
{
int fd;
int zero = 0;
char buf[LEN];
memset(buf, 0, LEN);
fd = socket(AF_INET6, SOCK_RAW, 7);
setsockopt(fd, SOL_IPV6, IPV6_CHECKSUM, &zero, 4);
setsockopt(fd, SOL_IPV6, IPV6_DSTOPTS, &buf, LEN);
sendto(fd, buf, 1, 0, (struct sockaddr *) buf, 110);
}
Signed-off-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/raw.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -589,7 +589,11 @@ static int rawv6_push_pending_frames(str
}
offset += skb_transport_offset(skb);
- BUG_ON(skb_copy_bits(skb, offset, &csum, 2));
+ err = skb_copy_bits(skb, offset, &csum, 2);
+ if (err < 0) {
+ ip6_flush_pending_frames(sk);
+ goto out;
+ }
/* in case cksum was not initialized */
if (unlikely(csum))
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 46/59] ARM: zynq: Reserve correct amount of non-DMA RAM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 50/59] ARM: OMAP5: Fix mpuss_early_init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 47/59] ARM: qcom_defconfig: Fix MDM9515 LCC and GCC config Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 32/59] gro: Enter slow-path if there is no tailroom Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 35/59] net/mlx5e: Remove WARN_ONCE from adaptive moderation code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 28/59] r8152: split rtl8152_suspend function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 17/59] net: fix incorrect original ingress device index in PKTINFO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 33/59] gro: use min_t() in skb_gro_reset_offset() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 59/59] rtlwifi: rtl_usb: Fix missing entry in USB drivers private data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 08/59] net/sched: cls_flower: Fix missing addr_type in classify Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 39/59] ALSA: firewire-tascam: Fix to handle error from initialization of stream data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 53/59] ARM: 8631/1: clkdev: Detect errors in clk_hw_register_clkdev() for mass registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 29/59] r8152: fix rx issue for runtime suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 26/59] net: dsa: bcm_sf2: Do not clobber b53_switch_ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 58/59] rtlwifi: Fix enter/exit power_save Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 23/59] ipv4: Do not allow MAIN to be alias for new LOCAL w/ custom rules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 19/59] drop_monitor: add missing call to genlmsg_end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 42/59] arm64: dts: mt8173: Fix auxadc node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 13/59] net/mlx5: Prevent setting multicast macs for VFs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 02/59] net: vrf: Drop conntrack data after pass through VRF device on Tx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 05/59] ipv6: handle -EFAULT from skb_copy_bits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 30/59] net: dsa: Ensure validity of dst->ds[0] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 54/59] ARM: omap2+: am437x: rollback to use omap3_gptimer_timer_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 10/59] net/mlx5: Cancel recovery work in remove flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 06/59] net, sched: fix soft lockup in tc_classify Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 52/59] ARM: OMAP4+: Fix bad fallthrough for cpuidle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 01/59] net: vrf: Fix NAT within a VRF Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 16/59] rtnl: stats - add missing netlink message size checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 12/59] net/mlx5: Mask destination mac value in ethtool steering rules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 07/59] net: stmmac: Fix race between stmmac_drv_probe and stmmac_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 27/59] net: dsa: bcm_sf2: Utilize nested MDIO read/write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 48/59] svcrdma: Clear xpt_bc_xps in xprt_setup_rdma_bc() error exit arm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 38/59] HID: hid-cypress: validate length of report Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 11/59] net/mlx5: Avoid shadowing numa_node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 51/59] ARM: OMAP5: Fix build for PM code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 22/59] igmp: Make igmp group member RFC 3376 compliant Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 24/59] net: vrf: Add missing Rx counters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 56/59] ALSA: usb-audio: Add a quirk for Plantronics BT600 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 21/59] flow_dissector: Update pptp handling to avoid null pointer deref. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 41/59] tools/virtio: fix READ_ONCE() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 49/59] bus: arm-ccn: Prevent hotplug callback leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 03/59] sctp: sctp_transport_lookup_process should rcu_read_unlock when transport is null Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 09/59] net/mlx5: Check FW limitations on log_max_qp before setting it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 04/59] inet: fix IP(V6)_RECVORIGDSTADDR for udp sockets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 20/59] drop_monitor: consider inserted data in genlmsg_end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 40/59] powerpc: Fix build warning on 32-bit PPC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 18/59] net: ipv4: dst for local input routes should use l3mdev if relevant Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 45/59] ARM: pxa: fix pxa25x interrupt init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 37/59] net: vrf: do not allow table id 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 34/59] gro: Disable frag0 optimization on IPv6 ext headers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 15/59] net/mlx5e: Disable netdev after close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 14/59] net/mlx5e: Dont sync netdev state when not registered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 25/59] bpf: change back to orig prog on too many passes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 36/59] net: ipv4: Fix multipath selection with vrf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 43/59] ARM64: dts: bcm2837-rpi-3-b: remove incorrect pwr LED Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
Re: [PATCH 4.9 00/59] 4.9.4-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-13 21:30 +0100
Re: [PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-14 08:30 +0100
Re: [PATCH 4.9 00/59] 4.9.4-stable review Shuah Khan <shuah.kh@samsung.com> - 2017-01-13 23:00 +0100
Re: [PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-14 08:30 +0100
csiph-web