lkml.org 
[lkml]   [2016]   [Jan]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2.y-ckt 199/211] net: check both type and procotol for tcp sockets
    Date
    4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: WANG Cong <xiyou.wangcong@gmail.com>

    [ Upstream commit ac5cc977991d2dce85fc734a6c71ddb33f6fe3c1 ]

    Dmitry reported the following out-of-bound access:

    Call Trace:
    [<ffffffff816cec2e>] __asan_report_load4_noabort+0x3e/0x40
    mm/kasan/report.c:294
    [<ffffffff84affb14>] sock_setsockopt+0x1284/0x13d0 net/core/sock.c:880
    [< inline >] SYSC_setsockopt net/socket.c:1746
    [<ffffffff84aed7ee>] SyS_setsockopt+0x1fe/0x240 net/socket.c:1729
    [<ffffffff85c18c76>] entry_SYSCALL_64_fastpath+0x16/0x7a
    arch/x86/entry/entry_64.S:185

    This is because we mistake a raw socket as a tcp socket.
    We should check both sk->sk_type and sk->sk_protocol to ensure
    it is a tcp socket.

    Willem points out __skb_complete_tx_timestamp() needs to fix as well.

    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Acked-by: Willem de Bruijn <willemb@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    net/core/skbuff.c | 3 ++-
    net/core/sock.c | 3 ++-
    2 files changed, 4 insertions(+), 2 deletions(-)

    diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    index 9ad9576..dd6d553 100644
    --- a/net/core/skbuff.c
    +++ b/net/core/skbuff.c
    @@ -3643,7 +3643,8 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
    serr->ee.ee_info = tstype;
    if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) {
    serr->ee.ee_data = skb_shinfo(skb)->tskey;
    - if (sk->sk_protocol == IPPROTO_TCP)
    + if (sk->sk_protocol == IPPROTO_TCP &&
    + sk->sk_type == SOCK_STREAM)
    serr->ee.ee_data -= sk->sk_tskey;
    }

    diff --git a/net/core/sock.c b/net/core/sock.c
    index 544ff7d..623224a 100644
    --- a/net/core/sock.c
    +++ b/net/core/sock.c
    @@ -860,7 +860,8 @@ set_rcvbuf:

    if (val & SOF_TIMESTAMPING_OPT_ID &&
    !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)) {
    - if (sk->sk_protocol == IPPROTO_TCP) {
    + if (sk->sk_protocol == IPPROTO_TCP &&
    + sk->sk_type == SOCK_STREAM) {
    if (sk->sk_state != TCP_ESTABLISHED) {
    ret = -EINVAL;
    break;
    --
    1.9.1


    \
     
     \ /
      Last update: 2016-01-05 21:21    [W:4.097 / U:0.168 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site