Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1582801
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 28/32] l2tp: do not use udp_ioctl() |
| Date | 2017-02-16 19:10 +0100 |
| Message-ID | <tbyFd-1Cv-71@gated-at.bofh.it> (permalink) |
| References | <tbyvw-1iO-9@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 72fb96e7bdbbdd4421b0726992496531060f3636 ]
udp_ioctl(), as its name suggests, is used by UDP protocols,
but is also used by L2TP :(
L2TP should use its own handler, because it really does not
look the same.
SIOCINQ for instance should not assume UDP checksum or headers.
Thanks to Andrey and syzkaller team for providing the report
and a nice reproducer.
While crashes only happen on recent kernels (after commit
7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")), this
probably needs to be backported to older kernels.
Fixes: 7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")
Fixes: 85584672012e ("udp: Fix udp_poll() and ioctl()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_core.h | 1 +
net/l2tp/l2tp_ip.c | 27 ++++++++++++++++++++++++++-
net/l2tp/l2tp_ip6.c | 2 +-
3 files changed, 28 insertions(+), 2 deletions(-)
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -273,6 +273,7 @@ int l2tp_xmit_skb(struct l2tp_session *s
int l2tp_nl_register_ops(enum l2tp_pwtype pw_type,
const struct l2tp_nl_cmd_ops *ops);
void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type);
+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg);
/* Session reference counts. Incremented when code obtains a reference
* to a session.
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -11,6 +11,7 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <asm/ioctls.h>
#include <linux/icmp.h>
#include <linux/module.h>
#include <linux/skbuff.h>
@@ -560,6 +561,30 @@ out:
return err ? err : copied;
}
+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+{
+ struct sk_buff *skb;
+ int amount;
+
+ switch (cmd) {
+ case SIOCOUTQ:
+ amount = sk_wmem_alloc_get(sk);
+ break;
+ case SIOCINQ:
+ spin_lock_bh(&sk->sk_receive_queue.lock);
+ skb = skb_peek(&sk->sk_receive_queue);
+ amount = skb ? skb->len : 0;
+ spin_unlock_bh(&sk->sk_receive_queue.lock);
+ break;
+
+ default:
+ return -ENOIOCTLCMD;
+ }
+
+ return put_user(amount, (int __user *)arg);
+}
+EXPORT_SYMBOL(l2tp_ioctl);
+
static struct proto l2tp_ip_prot = {
.name = "L2TP/IP",
.owner = THIS_MODULE,
@@ -568,7 +593,7 @@ static struct proto l2tp_ip_prot = {
.bind = l2tp_ip_bind,
.connect = l2tp_ip_connect,
.disconnect = l2tp_ip_disconnect,
- .ioctl = udp_ioctl,
+ .ioctl = l2tp_ioctl,
.destroy = l2tp_ip_destroy_sock,
.setsockopt = ip_setsockopt,
.getsockopt = ip_getsockopt,
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -729,7 +729,7 @@ static struct proto l2tp_ip6_prot = {
.bind = l2tp_ip6_bind,
.connect = l2tp_ip6_connect,
.disconnect = l2tp_ip6_disconnect,
- .ioctl = udp_ioctl,
+ .ioctl = l2tp_ioctl,
.destroy = l2tp_ip6_destroy_sock,
.setsockopt = ipv6_setsockopt,
.getsockopt = ipv6_getsockopt,
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 00/32] 4.9.11-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 08/32] net: use a work queue to defer net_disable_timestamp() work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 27/32] net: dsa: Do not destroy invalid network devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 24/32] net: introduce device min_header_len Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 17/32] rtl8150: Use heap buffers for all register access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 21/32] sctp: avoid BUG_ON on sctp_wait_for_sndbuf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 04/32] ipv6: fix ip6_tnl_parse_tlv_enc_lim() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 07/32] stmmac: Discard masked flags in interrupt status register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 05/32] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 32/32] net/mlx5: Dont unlock fte while still using it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 09/32] ipv4: keep skb->dst around in presence of IP options Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 29/32] mld: do not remove mld souce list info when set link down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 06/32] tcp: fix 0 divide in __tcp_select_window() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:00 +0100
[PATCH 4.9 23/32] sit: fix a double free on error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 03/32] net/sched: matchall: Fix configuration race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 19/32] catc: Use heap buffer for memory size test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 22/32] lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 11/32] ip6_gre: fix ip6gre_err() invalid reads Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 15/32] macvtap: read vnet_hdr_size once Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 20/32] mlx4: Invoke softirqs after napi_reschedule Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 14/32] tun: read vnet_hdr_sz once Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 13/32] tcp: avoid infinite loop in tcp_splice_read() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 18/32] catc: Combine failure cleanup code in catc_probe() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 02/32] net/mlx5e: Fix update of hash function/key via ethtool Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 12/32] ipv6: tcp: add a missing tcp_v6_restore_cb() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 28/32] l2tp: do not use udp_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 25/32] packet: round up linear to header len Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 10/32] netlabel: out of bound access in cipso_v4_validate() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
[PATCH 4.9 01/32] can: Fix kernel panic at security_sock_rcv_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-16 19:10 +0100
Re: [PATCH 4.9 00/32] 4.9.11-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-17 11:40 +0100
Re: [PATCH 4.9 00/32] 4.9.11-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-17 19:20 +0100
Re: [PATCH 4.9 00/32] 4.9.11-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-18 00:50 +0100
Re: [PATCH 4.9 00/32] 4.9.11-stable review Kevin Hilman <khilman@baylibre.com> - 2017-02-20 23:40 +0100
csiph-web