Skip to contentSkip to conversation

Patch "net: ipv4: fix for a race condition in raw_sendmsg" has been added to the 4.4-stable tree

PATCH [email protected] 1 participant 1 message Dec 31, 2017

Subsystems (2)
Networking Stable branch
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

net: ipv4: fix for a race condition in raw_sendmsg

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-ipv4-fix-for-a-race-condition-in-raw_sendmsg.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Sun Dec 31 11:20:35 CET 2017

From: Mohamed Ghannam <[email protected]>
Date: Sun, 10 Dec 2017 03:50:58 +0000
Subject: net: ipv4: fix for a race condition in raw_sendmsg

From: Mohamed Ghannam <[email protected]>

[ Upstream commit 8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 ]

inet->hdrincl is racy, and could lead to uninitialized stack pointer usage, so its value should be read only once.

Fixes c008ba5bdc9f ("ipv4: Avoid reading user iov twice after raw_probe_proto_opt")
Signed-off-by Mohamed Ghannam <[email protected]>
Reviewed-by Eric Dumazet <[email protected]>
Signed-off-by David S. Miller <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 net/ipv4/raw.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)
net/ipv4/raw.c +10 -5
@@ -500,11 +500,16 @@ static int raw_sendmsg(struct sock *sk,
 	int err;
 	struct ip_options_data opt_copy;
 	struct raw_frag_vec rfv;
+	int hdrincl;
 
 	err = -EMSGSIZE;
 	if (len > 0xFFFF)
 		goto out;
 
+	/* hdrincl should be READ_ONCE(inet->hdrincl)
+	 * but READ_ONCE() doesn't work with bit fields
+	 */
+	hdrincl = inet->hdrincl;
 	/*
 	 *	Check the flags.
 	 */

@@ -579,7 +584,7 @@ static int raw_sendmsg(struct sock *sk,
 		/* Linux does not mangle headers on raw sockets,
 		 * so that IP options + IP_HDRINCL is non-sense.
 		 */
-		if (inet->hdrincl)
+		if (hdrincl)
 			goto done;
 		if (ipc.opt->opt.srr) {
 			if (!daddr)

@@ -601,9 +606,9 @@ static int raw_sendmsg(struct sock *sk,
 
 	flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
 			   RT_SCOPE_UNIVERSE,
-			   inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
+			   hdrincl ? IPPROTO_RAW : sk->sk_protocol,
 			   inet_sk_flowi_flags(sk) |
-			    (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
+			    (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
 			   daddr, saddr, 0, 0);
 
 	if (!saddr && ipc.oif) {

@@ -612,7 +617,7 @@ static int raw_sendmsg(struct sock *sk,
 			goto done;
 	}
 
-	if (!inet->hdrincl) {
+	if (!hdrincl) {
 		rfv.msg = msg;
 		rfv.hlen = 0;
 

@@ -637,7 +642,7 @@ static int raw_sendmsg(struct sock *sk,
 		goto do_confirm;
 back_from_confirm:
 
-	if (inet->hdrincl)
+	if (hdrincl)
 		err = raw_send_hdrinc(sk, &fl4, msg, len,
 				      &rt, msg->msg_flags);

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/net-ipv4-fix-for-a-race-condition-in-raw_sendmsg.patch