Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1587424

[PATCH 4.9 04/32] net/llc: avoid BUG_ON() in skb_orphan()

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>


[ Upstream commit 8b74d439e1697110c5e5c600643e823eb1dd0762 ]

It seems nobody used LLC since linux-3.12.

Fortunately fuzzers like syzkaller still know how to run this code,
otherwise it would be no fun.

Setting skb->sk without skb->destructor leads to all kinds of
bugs, we now prefer to be very strict about it.

Ideally here we would use skb_set_owner() but this helper does not exist yet,
only CAN seems to have a private helper for that.

Fixes: 376c7311bdb6 ("net: add a temporary sanity check in skb_orphan()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/llc/llc_conn.c |    3 +++
 net/llc/llc_sap.c  |    3 +++
 2 files changed, 6 insertions(+)

--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -821,7 +821,10 @@ void llc_conn_handler(struct llc_sap *sa
 		 * another trick required to cope with how the PROCOM state
 		 * machine works. -acme
 		 */
+		skb_orphan(skb);
+		sock_hold(sk);
 		skb->sk = sk;
+		skb->destructor = sock_efree;
 	}
 	if (!sock_owned_by_user(sk))
 		llc_conn_rcv(sk, skb);
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -290,7 +290,10 @@ static void llc_sap_rcv(struct llc_sap *
 
 	ev->type   = LLC_SAP_EV_TYPE_PDU;
 	ev->reason = 0;
+	skb_orphan(skb);
+	sock_hold(sk);
 	skb->sk = sk;
+	skb->destructor = sock_efree;
 	llc_sap_state_process(sap, skb);
 }
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.9 00/32] 4.9.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:40 +0100
  [PATCH 4.9 27/32] goldfish: Sanitize the broken interrupt handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 23/32] USB: serial: opticon: fix CTS retrieval at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 30/32] block: fix double-free in the failure path of cgwb_bdi_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 13/32] ip: fix IP_CHECKSUM handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 28/32] netfilter: nf_ct_helper: warn when not applying default helper assignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 31/32] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 17/32] USB: serial: cp210x: add new IDs for GE Bx50v3 boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 16/32] USB: serial: mos7840: fix another NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 25/32] USB: serial: console: fix uninitialised spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 11/32] irda: Fix lockdep annotations in hashbin_delete(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 24/32] USB: serial: ark3116: fix register-accessor error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 15/32] tty: serial: msm: Fix module autoload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 29/32] ACPICA: Linuxize: Restore and fix Intel compiler build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 32/32] xfs: clear delalloc and cache on buffered write failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 22/32] USB: serial: spcp8x5: fix modem-status handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 08/32] net: neigh: Fix netevent NETEVENT_DELAY_PROBE_TIME_UPDATE notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 26/32] x86/platform/goldfish: Prevent unconditional loading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
  [PATCH 4.9 12/32] ptr_ring: fix race conditions when resizing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 02/32] kcm: fix a null pointer dereference in kcm_sendmsg() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 07/32] packet: Do not call fanout_release from atomic contexts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 04/32] net/llc: avoid BUG_ON() in skb_orphan() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 14/32] net: socket: fix recvmmsg not returning error from sock_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 10/32] vxlan: fix oops in dev_fill_metadata_dst Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 03/32] net/mlx5e: Disable preemption when doing TC statistics upcall Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  [PATCH 4.9 19/32] USB: serial: ftdi_sio: fix extreme low-latency setting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 10:00 +0100
  Re: [PATCH 4.9 00/32] 4.9.13-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-24 18:30 +0100
  Re: [PATCH 4.9 00/32] 4.9.13-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-24 19:20 +0100
  Re: [PATCH 4.9 00/32] 4.9.13-stable review Alexandre Belloni <alexandre.belloni@free-electrons.com> - 2017-02-27 00:00 +0100

csiph-web