Commit baefcdc2 authored by Salvatore Bonaccorso's avatar Salvatore Bonaccorso

ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt

parent 594e44c9
linux (4.9.185-2) UNRELEASED; urgency=medium
[ Aurelien Jarno ]
* [arm64] compat: Provide definition for COMPAT_SIGMINSTKSZ (Closes:
#904385).
[ Salvatore Bonaccorso ]
* ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt
-- Aurelien Jarno <aurel32@debian.org> Mon, 29 Jul 2019 22:28:45 +0200
linux (4.9.185-1) stretch; urgency=medium
From: Xin Long <lucien.xin@gmail.com>
Date: Fri, 24 Feb 2017 16:29:06 +0800
Subject: ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt
Origin: https://git.kernel.org/linus/99253eb750fda6a644d5188fb26c43bad8d5a745
Commit 5e1859fbcc3c ("ipv4: ipmr: various fixes and cleanups") fixed
the issue for ipv4 ipmr:
ip_mroute_setsockopt() & ip_mroute_getsockopt() should not
access/set raw_sk(sk)->ipmr_table before making sure the socket
is a raw socket, and protocol is IGMP
The same fix should be done for ipv6 ipmr as well.
This patch can fix the panic caused by overwriting the same offset
as ipmr_table as in raw_sk(sk) when accessing other type's socket
by ip_mroute_setsockopt().
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/ipv6/ip6mr.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index babaf3ec2742..6ba6c900ebcf 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1666,6 +1666,10 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
struct net *net = sock_net(sk);
struct mr6_table *mrt;
+ if (sk->sk_type != SOCK_RAW ||
+ inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
+ return -EOPNOTSUPP;
+
mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
if (!mrt)
return -ENOENT;
@@ -1677,9 +1681,6 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
switch (optname) {
case MRT6_INIT:
- if (sk->sk_type != SOCK_RAW ||
- inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
- return -EOPNOTSUPP;
if (optlen < sizeof(int))
return -EINVAL;
@@ -1815,6 +1816,10 @@ int ip6_mroute_getsockopt(struct sock *sk, int optname, char __user *optval,
struct net *net = sock_net(sk);
struct mr6_table *mrt;
+ if (sk->sk_type != SOCK_RAW ||
+ inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
+ return -EOPNOTSUPP;
+
mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
if (!mrt)
return -ENOENT;
--
2.20.1
......@@ -103,6 +103,7 @@ bugfix/x86/mmap-add-an-exception-to-the-stack-gap-for-hotspot-jvm.patch
bugfix/all/xen-time-do-not-decrease-steal-time-after-live-migra.patch
bugfix/all/nfsd-increase-DRC-cache-limit.patch
bugfix/all/netfilter-xt_hashlimit-fix-integer-divide-round-to-z.patch
bugfix/all/ipv6-check-sk-sk_type-and-protocol-early-in-ip_mrout.patch
# Miscellaneous features
features/all/netfilter-nft_ct-add-notrack-support.patch
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment