Skip to contentSkip to conversation

Patch "net: ping: do not abuse udp_poll()" has been added to the 4.11-stable tree

PATCH [email protected] 1 participant 1 message Jun 8, 2017

Subsystems (3)
Networking Stable branch IPv4/IPv6
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

net: ping: do not abuse udp_poll()

to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-ping-do-not-abuse-udp_poll.patch
and it can be found in the queue-4.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Thu Jun 8 08:58:08 CEST 2017

From: Eric Dumazet <[email protected]>
Date: Sat, 3 Jun 2017 09:29:25 -0700
Subject: net: ping: do not abuse udp_poll()

From: Eric Dumazet <[email protected]>

[ Upstream commit 77d4b1d36926a9b8387c6b53eeba42bcaaffcea3 ]

Alexander reported various KASAN messages triggered in recent kernels

The problem is that ping sockets should not use udp_poll() in the first place, and recent changes in UDP stack finally exposed this old bug.

Fixes c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
Fixes 6d0bfe226116 ("net: ipv6: Add IPv6 support to the ping socket.")
Signed-off-by Eric Dumazet <[email protected]>
Reported-by Sasha Levin <[email protected]>
Cc Solar Designer <[email protected]>
Cc Vasiliy Kulikov <[email protected]>
Cc Lorenzo Colitti <[email protected]>
Acked-by Lorenzo Colitti <[email protected]>
Tested-by Lorenzo Colitti <[email protected]>
Signed-off-by David S. Miller <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 include/net/ipv6.h |    1 +
 net/ipv4/af_inet.c |    2 +-
 net/ipv6/ping.c    |    2 +-
 net/ipv6/raw.c     |    2 +-
 4 files changed, 4 insertions(+), 3 deletions(-)
include/net/ipv6.h +1 -0
@@ -1007,6 +1007,7 @@ int inet6_hash_connect(struct inet_timew
  */
 extern const struct proto_ops inet6_stream_ops;
 extern const struct proto_ops inet6_dgram_ops;
+extern const struct proto_ops inet6_sockraw_ops;
 
 struct group_source_req;
 struct group_filter;
net/ipv4/af_inet.c +1 -1
@@ -1043,7 +1043,7 @@ static struct inet_protosw inetsw_array[
 		.type =       SOCK_DGRAM,
 		.protocol =   IPPROTO_ICMP,
 		.prot =       &ping_prot,
-		.ops =        &inet_dgram_ops,
+		.ops =        &inet_sockraw_ops,
 		.flags =      INET_PROTOSW_REUSE,
        },
net/ipv6/ping.c +1 -1
@@ -192,7 +192,7 @@ static struct inet_protosw pingv6_protos
 	.type =      SOCK_DGRAM,
 	.protocol =  IPPROTO_ICMPV6,
 	.prot =      &pingv6_prot,
-	.ops =       &inet6_dgram_ops,
+	.ops =       &inet6_sockraw_ops,
 	.flags =     INET_PROTOSW_REUSE,
 };
net/ipv6/raw.c +1 -1
@@ -1338,7 +1338,7 @@ void raw6_proc_exit(void)
 #endif	/* CONFIG_PROC_FS */
 
 /* Same as inet6_dgram_ops, sans udp_poll.  */
-static const struct proto_ops inet6_sockraw_ops = {
+const struct proto_ops inet6_sockraw_ops = {
 	.family		   = PF_INET6,
 	.owner		   = THIS_MODULE,
 	.release	   = inet6_release,

Patches currently in stable-queue which might be from [email protected] are

queue-4.11/sock-reset-sk_err-when-the-error-queue-is-empty.patch queue-4.11/tcp-disallow-cwnd-undo-when-switching-congestion-control.patch queue-4.11/net-ping-do-not-abuse-udp_poll.patch