Patch "net-timestamp: avoid use-after-free in ip_recv_error" has been added to the 4.9-stable tree
Subsystems (3)
This is a note to let you know that I've just added the patch titled
net-timestamp: avoid use-after-free in ip_recv_error
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-timestamp-avoid-use-after-free-in-ip_recv_error.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From foo@baz Sat Apr 29 08:22:13 CEST 2017
From: Willem de Bruijn <[email protected]>
Date: Wed, 12 Apr 2017 19:24:35 -0400
Subject: net-timestamp: avoid use-after-free in ip_recv_error
From: Willem de Bruijn <[email protected]>
[ Upstream commit 1862d6208db0aeca9c8ace44915b08d5ab2cd667 ]
Syzkaller reported a use-after-free in ip_recv_error at line
info->ipi_ifindex = skb->dev->ifindex;
This function is called on dequeue from the error queue, at which point the device pointer may no longer be valid.
Save ifindex on enqueue in __skb_complete_tx_timestamp, when the pointer is valid or NULL. Store it in temporary storage skb->cb.
It is safe to reference skb->dev here, as called from device drivers or dev_queue_xmit. The exception is when called from tcp_ack_tstamp; in that case it is NULL and ifindex is set to 0 (invalid).
Do not return a pktinfo cmsg if ifindex is 0. This maintains the current behavior of not returning a cmsg if skb->dev was NULL.
On dequeue, the ipv4 path will cast from sock_exterr_skb to in_pktinfo. Both have ifindex as their first element, so no explicit conversion is needed. This is by design, introduced in commit 0b922b7a829c ("net: original ingress device index in PKTINFO"). For ipv6 ip6_datagram_support_cmsg converts to in6_pktinfo.
--- net/core/skbuff.c | 1 + net/ipv4/ip_sockglue.c | 9 ++++----- net/ipv6/datagram.c | 10 +--------- 3 files changed, 6 insertions(+), 14 deletions(-)
net/core/skbuff.c +1 -0
@@ -3779,6 +3779,7 @@ static void __skb_complete_tx_timestamp( serr->ee.ee_errno =ENOMSG ; serr->ee.ee_origin =SO_EE_ORIGIN_TIMESTAMPING ; serr->ee.ee_info = tstype; + serr->header.h4.iif = skb->dev ? skb->dev->ifindex :0 ;if (sk->sk_tsflags &SOF_TIMESTAMPING_OPT_ID ) { serr->ee.ee_data =skb_shinfo (skb)->tskey; if (sk->sk_protocol == IPPROTO_TCP &&
net/ipv4/ip_sockglue.c +4 -5
@@ -474,16 +474,15 @@ static bool ipv4_datagram_support_cmsg(creturn false;/* Support IP_PKTINFO on tstamp packets if requested, to correlate -* timestamp with egress dev. Not possible for packets without dev +* timestamp with egress dev. Not possible for packets without iif * or without payload (SOF_TIMESTAMPING_OPT_TSONLY). */ -if ((!(sk->sk_tsflags &SOF_TIMESTAMPING_OPT_CMSG )) || - (!skb->dev)) + info =PKTINFO_SKB_CB (skb); +if (!(sk->sk_tsflags &SOF_TIMESTAMPING_OPT_CMSG ) || + !info->ipi_ifindex)return false; - info =PKTINFO_SKB_CB (skb); info->ipi_spec_dst.s_addr =ip_hdr (skb)->saddr; - info->ipi_ifindex = skb->dev->ifindex;return true; }
net/ipv6/datagram.c +1 -9
@@ -400,9 +400,6 @@ static inline bool ipv6_datagram_support* At one point, excluding local errors was a quick test to identify icmp/icmp6 * errors. This is no longer true, but the test remained, so the v6 stack, * unlike v4, also honors cmsg requests on all wifi and timestamp errors. -* -* Timestamp code paths do not initialize the fields expected by cmsg: -* the PKTINFO fields in skb->cb[]. Fill those in here. */ static bool ip6_datagram_support_cmsg (struct sk_buff *skb,struct sock_exterr_skb *serr)
@@ -414,14 +411,9 @@ static bool ip6_datagram_support_cmsg(stif (serr->ee.ee_origin ==SO_EE_ORIGIN_LOCAL )return false; -if (!skb->dev) +if (!IP6CB (skb)->iif)return false; -if (skb->protocol ==htons (ETH_P_IPV6 )) -IP6CB (skb)->iif = skb->dev->ifindex; -else -PKTINFO_SKB_CB (skb)->ipi_ifindex = skb->dev->ifindex; -return true; }
Patches currently in stable-queue which might be from [email protected] are
queue-4.9/net-timestamp-avoid-use-after-free-in-ip_recv_error.patch