Patchset for CVE-2020-1749 Kernel 4.19
Subsystems (16)
Hi Greg,
as announced i have backported the identified patches for CVE-2020-1749 from kernel 5.x into v4.19. Applies to stable linux-v4.19.y (with y=114).
Please find the patches for 4.19 appended.
Best regards
Carsten
-----------------
Mentor Graphics (Deutschland) GmbH, Arnulfstraße 201, 80634 München / Germany Registergericht München HRB 106955, Geschäftsführer: Thomas Heurung, Alexander Walter
From 81132cc6d1b45795570da7adbdf41d58c025a009 Mon Sep 17 00:00:00 2001
From: David Ahern <[email protected]>
Date: Fri, 22 Mar 2019 06:06:09 -0700
Subject: [PATCH 1/3] ipv6: Move ipv6 stubs to a separate header file
[ Upstream commit 3616d08bcbb564c7765187cd45ad392e49bad73a ]
Fixes CVE-2020-1749
Backported from v5.2-rc1
Patch 1/3
The number of stubs is growing and has nothing to do with addrconf. Move the definition of the stubs to a separate header file and update users. In the move, drop the vxlan specific comment before ipv6_stub.
Code move only; no functional change intended.
--- drivers/infiniband/core/addr.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 1 + drivers/net/geneve.c | 1 + drivers/net/usb/cdc_mbim.c | 1 + drivers/net/vxlan.c | 1 + include/net/addrconf.h | 41 ------------- include/net/ipv6_stubs.h | 58 +++++++++++++++++++ include/net/udp_tunnel.h | 2 +- net/bridge/br_arp_nd_proxy.c | 1 + net/core/filter.c | 1 + net/core/lwt_bpf.c | 1 + net/ipv6/addrconf_core.c | 2 +- net/ipv6/af_inet6.c | 1 + net/mpls/af_mpls.c | 2 +- net/tipc/udp_media.c | 2 +- 15 files changed, 71 insertions(+), 46 deletions(-) create mode 100644 include/net/ipv6_stubs.h
drivers/infiniband/core/addr.c +1 -1
@@ -42,7 +42,7 @@#include <net/neighbour.h> #include <net/route.h> #include <net/netevent.h> -#include <net/addrconf.h> +#include <net/ipv6_stubs.h> #include <net/ip6_route.h> #include <rdma/ib_addr.h> #include <rdma/ib.h>
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +1 -0
@@ -46,6 +46,7 @@#include <net/tc_act/tc_csum.h> #include <net/vxlan.h> #include <net/arp.h> +#include <net/ipv6_stubs.h> #include "en.h" #include "en_rep.h" #include "en_tc.h"
drivers/net/geneve.c +1 -0
@@ -14,6 +14,7 @@#include <linux/module.h> #include <linux/etherdevice.h> #include <linux/hash.h> +#include <net/ipv6_stubs.h> #include <net/dst_metadata.h> #include <net/gro_cells.h> #include <net/rtnetlink.h>
drivers/net/usb/cdc_mbim.c +1 -0
@@ -23,6 +23,7 @@#include <linux/usb/cdc_ncm.h> #include <net/ipv6.h> #include <net/addrconf.h> +#include <net/ipv6_stubs.h> /* alternative VLAN for IP session 0 if not untagged */ #define MBIM_IPS0_VID 4094
drivers/net/vxlan.c +1 -0
@@ -20,6 +20,7 @@#include <linux/ethtool.h> #include <net/arp.h> #include <net/ndisc.h> +#include <net/ipv6_stubs.h> #include <net/ip.h> #include <net/icmp.h> #include <net/rtnetlink.h>
include/net/addrconf.h +0 -41
47 lines not on this page · raw message
include/net/ipv6_stubs.h new file +58 -0
58 lines not on this page · raw message
include/net/udp_tunnel.h +1 -1
@@ -7,7 +7,7 @@#if IS_ENABLED (CONFIG_IPV6 )#include <net/ipv6.h> -#include <net/addrconf.h> +#include <net/ipv6_stubs.h> #endif struct udp_port_cfg {
net/bridge/br_arp_nd_proxy.c +1 -0
@@ -21,6 +21,7 @@#include <linux/if_vlan.h> #include <linux/inetdevice.h> #include <net/addrconf.h> +#include <net/ipv6_stubs.h> #if IS_ENABLED (CONFIG_IPV6 )#include <net/ip6_checksum.h> #endif
net/core/filter.c +1 -0
@@ -68,6 +68,7 @@#include <linux/seg6_local.h> #include <net/seg6.h> #include <net/seg6_local.h> +#include <net/ipv6_stubs.h> /** * sk_filter_trim_cap - run a packet through a socket filter
net/core/lwt_bpf.c +1 -0
@@ -16,6 +16,7 @@#include <linux/types.h> #include <linux/bpf.h> #include <net/lwtunnel.h> +#include <net/ipv6_stubs.h> struct bpf_lwt_prog {struct bpf_prog *prog;
net/ipv6/addrconf_core.c +1 -1
@@ -5,7 +5,7 @@#include <linux/export.h> #include <net/ipv6.h> -#include <net/addrconf.h> +#include <net/ipv6_stubs.h> #include <net/ip.h> /* if ipv6 module registers this function is used by xfrm to force all
net/ipv6/af_inet6.c +1 -0
@@ -56,6 +56,7 @@#include <net/transp_v6.h> #include <net/ip6_route.h> #include <net/addrconf.h> +#include <net/ipv6_stubs.h> #include <net/ndisc.h> #ifdef CONFIG_IPV6_TUNNEL #include <net/ip6_tunnel.h>
net/mpls/af_mpls.c +1 -1
@@ -22,7 +22,7 @@#if IS_ENABLED (CONFIG_IPV6 )#include <net/ipv6.h> #endif -#include <net/addrconf.h> +#include <net/ipv6_stubs.h> #include <net/nexthop.h> #include "internal.h"
net/tipc/udp_media.c +1 -1
@@ -44,7 +44,7 @@#include <net/sock.h> #include <net/ip.h> #include <net/udp_tunnel.h> -#include <net/addrconf.h> +#include <net/ipv6_stubs.h> #include <linux/tipc_netlink.h> #include "core.h" #include "addr.h"
Signature · 1 line
2.17.1
From aa1914ffe4c5a5328920c6b1be58a23d0f997195 Mon Sep 17 00:00:00 2001
From: Sabrina Dubroca <[email protected]>
Date: Wed, 4 Dec 2019 15:35:52 +0100
Subject: [PATCH 2/3] net: ipv6: add net argument to ip6_dst_lookup_flow
[ Upstream commit c4e85f73afb6384123e5ef1bba3315b2e3ad031e ]
Fixes CVE-2020-1749
Backported from v5.5-rc1
Patch 2/3
This will be used in the conversion of ipv6_stub to ip6_dst_lookup_flow, as some modules currently pass a net argument without a socket to ip6_dst_lookup. This is equivalent to commit 343d60aada5a ("ipv6: change ipv6_stub_impl.ipv6_dst_lookup to take net argument").
--- include/net/ipv6.h | 2 +- net/dccp/ipv6.c | 6 +++--- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/inet6_connection_sock.c | 4 ++-- net/ipv6/ip6_output.c | 8 ++++---- net/ipv6/raw.c | 2 +- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 4 ++-- net/l2tp/l2tp_ip6.c | 2 +- net/sctp/ipv6.c | 4 ++-- 11 files changed, 19 insertions(+), 19 deletions(-)
include/net/ipv6.h +1 -1
@@ -959,7 +959,7 @@ static inline struct sk_buff *ip6_finish_skb(struct sock *sk)int ip6_dst_lookup (struct net *net,struct sock *sk,struct dst_entry **dst,struct flowi6 *fl6); -struct dst_entry *ip6_dst_lookup_flow (const struct sock *sk,struct flowi6 *fl6, +struct dst_entry *ip6_dst_lookup_flow (struct net *net,const struct sock *sk,struct flowi6 *fl6,const struct in6_addr *final_dst); struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6, const struct in6_addr *final_dst,
net/dccp/ipv6.c +3 -3
@@ -211,7 +211,7 @@ static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req final_p =fl6_update_dst (&fl6,rcu_dereference (np->opt), &final);rcu_read_unlock (); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); dst =NULL ;
@@ -282,7 +282,7 @@ static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)security_skb_classify_flow (rxskb,flowi6_to_flowi (&fl6));/* sk = NULL, but it is safe for now. RST socket required. */ - dst =ip6_dst_lookup_flow (ctl_sk, &fl6,NULL ); + dst =ip6_dst_lookup_flow (sock_net (ctl_sk), ctl_sk, &fl6,NULL );if (!IS_ERR (dst)) {skb_dst_set (skb, dst);ip6_xmit (ctl_sk, skb, &fl6,0 ,NULL ,0 );
@@ -912,7 +912,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr, opt =rcu_dereference_protected (np->opt,lockdep_sock_is_held (sk)); final_p =fl6_update_dst (&fl6, opt, &final); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto failure;
net/ipv6/af_inet6.c +1 -1
@@ -741,7 +741,7 @@ int inet6_sk_rebuild_header(struct sock *sk) &final);rcu_read_unlock (); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { sk->sk_route_caps =0 ; sk->sk_err_soft = -PTR_ERR (dst);
net/ipv6/datagram.c +1 -1
@@ -89,7 +89,7 @@ int ip6_datagram_dst_update(struct sock *sk, bool fix_sk_saddr) final_p =fl6_update_dst (&fl6, opt, &final);rcu_read_unlock (); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto out;
net/ipv6/inet6_connection_sock.c +2 -2
@@ -52,7 +52,7 @@ struct dst_entry *inet6_csk_route_req(const struct sock *sk, fl6->flowi6_uid = sk->sk_uid;security_req_classify_flow (req,flowi6_to_flowi (fl6)); - dst =ip6_dst_lookup_flow (sk, fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_p);if (IS_ERR (dst))return NULL ;
@@ -107,7 +107,7 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk, dst =__inet6_csk_dst_check (sk, np->dst_cookie);if (!dst) { - dst =ip6_dst_lookup_flow (sk, fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_p);if (!IS_ERR (dst))ip6_dst_store (sk, dst,NULL ,NULL );
net/ipv6/ip6_output.c +4 -4
@@ -1071,19 +1071,19 @@ EXPORT_SYMBOL_GPL(ip6_dst_lookup);* It returns a valid dst pointer on success, or a pointer encoded * error code. */ -struct dst_entry *ip6_dst_lookup_flow (const struct sock *sk,struct flowi6 *fl6, +struct dst_entry *ip6_dst_lookup_flow (struct net *net,const struct sock *sk,struct flowi6 *fl6,const struct in6_addr *final_dst) {struct dst_entry *dst =NULL ;int err; - err =ip6_dst_lookup_tail (sock_net (sk), sk, &dst, fl6); + err =ip6_dst_lookup_tail (net, sk, &dst, fl6);if (err)return ERR_PTR (err);if (final_dst) fl6->daddr = *final_dst; -return xfrm_lookup_route (sock_net (sk), dst,flowi6_to_flowi (fl6), sk,0 ); +return xfrm_lookup_route (net, dst,flowi6_to_flowi (fl6), sk,0 ); }EXPORT_SYMBOL_GPL (ip6_dst_lookup_flow);
@@ -1115,7 +1115,7 @@ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,if (dst)return dst; - dst =ip6_dst_lookup_flow (sk, fl6, final_dst); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_dst);if (connected && !IS_ERR (dst))ip6_sk_dst_store_flow (sk,dst_clone (dst), fl6);
net/ipv6/raw.c +1 -1
@@ -928,7 +928,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) fl6.flowlabel =ip6_make_flowinfo (ipc6.tclass, fl6.flowlabel); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto out;
net/ipv6/syncookies.c +1 -1
@@ -240,7 +240,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) fl6.flowi6_uid = sk->sk_uid;security_req_classify_flow (req,flowi6_to_flowi (&fl6)); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) goto out_free; }
net/ipv6/tcp_ipv6.c +2 -2
@@ -268,7 +268,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,security_sk_classify_flow (sk,flowi6_to_flowi (&fl6)); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto failure;
@@ -885,7 +885,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32* Underlying function will use this to retrieve the network * namespace */ - dst =ip6_dst_lookup_flow (ctl_sk, &fl6,NULL ); + dst =ip6_dst_lookup_flow (sock_net (ctl_sk), ctl_sk, &fl6,NULL );if (!IS_ERR (dst)) {skb_dst_set (buff, dst);ip6_xmit (ctl_sk, buff, &fl6, fl6.flowi6_mark,NULL , tclass);
net/l2tp/l2tp_ip6.c +1 -1
@@ -619,7 +619,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) fl6.flowlabel =ip6_make_flowinfo (ipc6.tclass, fl6.flowlabel); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto out;
net/sctp/ipv6.c +2 -2
@@ -287,7 +287,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, final_p =fl6_update_dst (fl6,rcu_dereference (np->opt), &final);rcu_read_unlock (); - dst =ip6_dst_lookup_flow (sk, fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_p);if (!asoc || saddr) goto out;
@@ -340,7 +340,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, fl6->saddr = laddr->a.v6.sin6_addr; fl6->fl6_sport = laddr->a.v6.sin6_port; final_p =fl6_update_dst (fl6,rcu_dereference (np->opt), &final); - bdst =ip6_dst_lookup_flow (sk, fl6, final_p); + bdst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_p);if (IS_ERR (bdst))continue ;
Signature · 1 line
2.17.1
From 9c215c825018e1195c9f1bfad24f4f224591a274 Mon Sep 17 00:00:00 2001
From: Sabrina Dubroca <[email protected]>
Date: Wed, 4 Dec 2019 15:35:53 +0100
Subject: [PATCH 3/3] net: ipv6_stub: use ip6_dst_lookup_flow instead of
ip6_dst_lookup
[ Upstream commit 6c8991f41546c3c472503dff1ea9daaddf9331c2 ]
Fixes CVE-2020-1749
Backported from v5.5-rc1
Patch 3/3
ipv6_stub uses the ip6_dst_lookup function to allow other modules to perform IPv6 lookups. However, this function skips the XFRM layer entirely.
All users of ipv6_stub->ip6_dst_lookup use ip_route_output_flow (via the ip_route_output_key and ip_route_output helpers) for their IPv4 lookups, which calls xfrm_lookup_route(). This patch fixes this inconsistent behavior by switching the stub to ip6_dst_lookup_flow, which also calls xfrm_lookup_route().
This requires some changes in all the callers, as these two functions take different arguments and have different return types.
--- drivers/infiniband/core/addr.c | 7 +++---- drivers/infiniband/sw/rxe/rxe_net.c | 8 +++++--- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 9 ++++----- drivers/net/geneve.c | 4 +++- drivers/net/vxlan.c | 8 +++----- include/net/ipv6_stubs.h | 6 ++++-- net/ipv6/addrconf_core.c | 11 ++++++----- net/ipv6/af_inet6.c | 2 +- net/mpls/af_mpls.c | 7 +++---- net/tipc/udp_media.c | 9 ++++++--- 10 files changed, 38 insertions(+), 33 deletions(-)
drivers/infiniband/core/addr.c +3 -4
@@ -408,16 +408,15 @@ static int addr6_resolve(struct sockaddr_in6 *src_in,struct flowi6 fl6;struct dst_entry *dst;struct rt6_info *rt; -int ret;memset (&fl6,0 ,sizeof fl6); fl6.daddr = dst_in->sin6_addr; fl6.saddr = src_in->sin6_addr; fl6.flowi6_oif = addr->bound_dev_if; - ret = ipv6_stub->ipv6_dst_lookup (addr->net,NULL , &dst, &fl6); -if (ret <0 ) -return ret; + dst = ipv6_stub->ipv6_dst_lookup_flow (addr->net,NULL , &fl6,NULL ); +if (IS_ERR (dst)) +return PTR_ERR (dst); rt = (struct rt6_info *)dst;if (ipv6_addr_any (&src_in->sin6_addr)) {
drivers/infiniband/sw/rxe/rxe_net.c +5 -3
@@ -154,10 +154,12 @@ static struct dst_entry *rxe_find_route6(struct net_device *ndev,memcpy (&fl6.daddr, daddr,sizeof (*daddr)); fl6.flowi6_proto =IPPROTO_UDP ; -if (unlikely (ipv6_stub->ipv6_dst_lookup (sock_net (recv_sockets.sk6->sk), - recv_sockets.sk6->sk, &ndst, &fl6))) { + ndst = ipv6_stub->ipv6_dst_lookup_flow (sock_net (recv_sockets.sk6->sk), + recv_sockets.sk6->sk, &fl6, +NULL ); +if (unlikely (IS_ERR (ndst))) {pr_err_ratelimited ("no route to %pI6\n" , daddr); - goto put; +return NULL ; }if (unlikely (ndst->error)) {
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +4 -5
@@ -2218,12 +2218,11 @@ static int mlx5e_route_lookup_ipv6(struct mlx5e_priv *priv,#if IS_ENABLED (CONFIG_INET ) &&IS_ENABLED (CONFIG_IPV6 )struct mlx5e_rep_priv *uplink_rpriv;struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; -int ret; - ret = ipv6_stub->ipv6_dst_lookup (dev_net (mirred_dev),NULL , &dst, - fl6); -if (ret <0 ) -return ret; + dst = ipv6_stub->ipv6_dst_lookup_flow (dev_net (mirred_dev),NULL , fl6, +NULL ); +if (IS_ERR (dst)) +return PTR_ERR (dst);if (!(*out_ttl)) *out_ttl =ip6_dst_hoplimit (dst);
drivers/net/geneve.c +3 -1
@@ -802,7 +802,9 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,if (dst)return dst; } -if (ipv6_stub->ipv6_dst_lookup (geneve->net, gs6->sock->sk, &dst, fl6)) { + dst = ipv6_stub->ipv6_dst_lookup_flow (geneve->net, gs6->sock->sk, fl6, +NULL ); +if (IS_ERR (dst)) {netdev_dbg (dev,"no route to %pI6\n" , &fl6->daddr);return ERR_PTR (-ENETUNREACH ); }
drivers/net/vxlan.c +3 -5
@@ -1964,7 +1964,6 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,bool use_cache =ip_tunnel_dst_cache_usable (skb, info);struct dst_entry *ndst;struct flowi6 fl6; -int err;if (!sock6)return ERR_PTR (-EIO );
@@ -1987,10 +1986,9 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan, fl6.fl6_dport = dport; fl6.fl6_sport = sport; - err = ipv6_stub->ipv6_dst_lookup (vxlan->net, - sock6->sock->sk, - &ndst, &fl6); -if (unlikely (err <0 )) { + ndst = ipv6_stub->ipv6_dst_lookup_flow (vxlan->net, sock6->sock->sk, + &fl6,NULL ); +if (unlikely (IS_ERR (ndst))) {netdev_dbg (dev,"no route to %pI6\n" , daddr);return ERR_PTR (-ENETUNREACH ); }
include/net/ipv6_stubs.h +4 -2
@@ -21,8 +21,10 @@ struct ipv6_stub { const struct in6_addr *addr);int (*ipv6_sock_mc_drop)(struct sock *sk,int ifindex,const struct in6_addr *addr); -int (*ipv6_dst_lookup)(struct net *net,struct sock *sk, -struct dst_entry **dst,struct flowi6 *fl6); +struct dst_entry *(*ipv6_dst_lookup_flow)(struct net *net, +const struct sock *sk, +struct flowi6 *fl6, +const struct in6_addr *final_dst);int (*ipv6_route_input)(struct sk_buff *skb);struct fib6_table *(*fib6_get_table)(struct net *net,u32 id);
net/ipv6/addrconf_core.c +6 -5
@@ -127,11 +127,12 @@ int inet6addr_validator_notifier_call_chain(unsigned long val, void *v) }EXPORT_SYMBOL (inet6addr_validator_notifier_call_chain); -static int eafnosupport_ipv6_dst_lookup (struct net *net,struct sock *u1, -struct dst_entry **u2, -struct flowi6 *u3) +static struct dst_entry *eafnosupport_ipv6_dst_lookup_flow (struct net *net, +const struct sock *sk, +struct flowi6 *fl6, +const struct in6_addr *final_dst) { -return -EAFNOSUPPORT ; +return ERR_PTR (-EAFNOSUPPORT ); }static struct fib6_table *eafnosupport_fib6_get_table (struct net *net,u32 id)
@@ -169,7 +170,7 @@ eafnosupport_ip6_mtu_from_fib6(struct fib6_info *f6i, struct in6_addr *daddr, }const struct ipv6_stub *ipv6_stub__read_mostly = &(struct ipv6_stub ) { - .ipv6_dst_lookup = eafnosupport_ipv6_dst_lookup, + .ipv6_dst_lookup_flow = eafnosupport_ipv6_dst_lookup_flow, .fib6_get_table = eafnosupport_fib6_get_table, .fib6_table_lookup = eafnosupport_fib6_table_lookup, .fib6_lookup = eafnosupport_fib6_lookup,
net/ipv6/af_inet6.c +1 -1
@@ -905,7 +905,7 @@ static struct pernet_operations inet6_net_ops = {static const struct ipv6_stub ipv6_stub_impl = { .ipv6_sock_mc_join = ipv6_sock_mc_join, .ipv6_sock_mc_drop = ipv6_sock_mc_drop, - .ipv6_dst_lookup = ip6_dst_lookup, + .ipv6_dst_lookup_flow = ip6_dst_lookup_flow, .fib6_get_table = fib6_get_table, .fib6_table_lookup = fib6_table_lookup, .fib6_lookup = fib6_lookup,
net/mpls/af_mpls.c +3 -4
@@ -618,16 +618,15 @@ static struct net_device *inet6_fib_lookup_dev(struct net *net,struct net_device *dev;struct dst_entry *dst;struct flowi6 fl6; -int err;if (!ipv6_stub)return ERR_PTR (-EAFNOSUPPORT );memset (&fl6,0 ,sizeof (fl6));memcpy (&fl6.daddr, addr,sizeof (struct in6_addr )); - err = ipv6_stub->ipv6_dst_lookup (net,NULL , &dst, &fl6); -if (err) -return ERR_PTR (err); + dst = ipv6_stub->ipv6_dst_lookup_flow (net,NULL , &fl6,NULL ); +if (IS_ERR (dst)) +return ERR_CAST (dst); dev = dst->dev;dev_hold (dev);
net/tipc/udp_media.c +6 -3
@@ -189,10 +189,13 @@ static int tipc_udp_xmit(struct net *net, struct sk_buff *skb, .saddr = src->ipv6, .flowi6_proto = IPPROTO_UDP }; - err = ipv6_stub->ipv6_dst_lookup (net, ub->ubsock->sk, &ndst, - &fl6); -if (err) + ndst = ipv6_stub->ipv6_dst_lookup_flow (net, + ub->ubsock->sk, + &fl6,NULL ); +if (IS_ERR (ndst)) { + err =PTR_ERR (ndst); goto tx_error; + } ttl =ip6_dst_hoplimit (ndst); err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, NULL, &src->ipv6, &dst->ipv6, 0, ttl, 0,
Signature · 1 line
2.17.1
Greg KH
maintainerQuoted 4 lines · Carsten
Hi Greg,
as announced i have backported the identified patches for CVE-2020-1749 from kernel 5.x into v4.19. Applies to stable linux-v4.19.y (with y=114).
Have you been able to test these patches so that you know they work?
And can you please send them as a patch series, not as attachments, and
cc: all the original authors so that everyone can know what is going on
and weigh in if they see any issues?
And finally, do not change the changelog text from the original commits, that's not ok. If you need to put any notes in there as to what you did, follow the format we have been using for years, and put it in the
s-o-b: area in a small [ box ]
Same for the 4.14 patches.
thanks,
greg k-h
Quoted 4 lines
Quoted 1 line
Applies to stable linux-v4.19.y (with y=114).
Have you been able to test these patches so that you know they work?
I did apply and compile on x86 in both 4.14 and 4.19 (making sure to have all CONFIG_s set to compile the changed code).
I then ran 4.14 (project kernel) on our target; however i can't build an encrypted IPv6 tunnel to verify if the patchset helps.
(From the patch descriptions, it really looks like they fix this)
IPv6 tunnel testing will be done by other folks in the project, i can't tell when due to the CoVid situation as this requires special equipment that i can't access at all.
Quoted 3 lines
And can you please send them as a patch series, not as attachments, and
cc: all the original authors so that everyone can know what is going on
and weigh in if they see any issues?
Of course. Sorry that i didn't do this yet.
Quoted 3 lines
And finally, do not change the changelog text from the original commits, that's not ok.
Except for the "upstream commit id", right?
Quoted 9 lines
If you need to put any notes in there as to what you
did, follow the format we have been using for years, and put it in the
s-o-b: area in a small [ box ]Same for the 4.14 patches.
thanks,
greg k-h
Of course i will do so, if it makes sense due to little testing effort possible. Please give a short notice if you think i should resend the patch series.
One question:
Our IT department adds a signature since a few days, after a line with "----". Is this a problem? I can't turn that off, unfortunately.
(At least they keep the "text only" and don't switch to HTML)
Thanks for your guidance and patience
Carsten
-----------------
Mentor Graphics (Deutschland) GmbH, Arnulfstraße 201, 80634 München / Germany Registergericht München HRB 106955, Geschäftsführer: Thomas Heurung, Alexander Walter
Greg KH
maintainerQuoted 4 lines · Carsten
Quoted 4 lines
Quoted 1 line
Applies to stable linux-v4.19.y (with y=114).
Have you been able to test these patches so that you know they work?
Quoted 8 lines
I did apply and compile on x86 in both 4.14 and 4.19 (making sure to have all
CONFIG_sset to compile the changed code).
I then ran 4.14 (project kernel) on our target; however i can't build an encrypted IPv6 tunnel to verify if the patchset helps.
(From the patch descriptions, it really looks like they fix this)IPv6 tunnel testing will be done by other folks in the project, i can't tell when due to the CoVid situation as this requires special equipment that i can't access at all.
Please wait to submit these until you can actually test that they solve the issue involved.
Quoted 9 lines
Quoted 3 lines
And can you please send them as a patch series, not as attachments, and
cc: all the original authors so that everyone can know what is going on
and weigh in if they see any issues?Of course. Sorry that i didn't do this yet.
Quoted 3 lines
And finally, do not change the changelog text from the original commits, that's not ok.
Except for the "upstream commit id", right?
Correct.
Quoted 10 lines
Quoted 9 lines
If you need to put any notes in there as to what you
did, follow the format we have been using for years, and put it in the
s-o-b: area in a small [ box ]Same for the 4.14 patches.
thanks,
greg k-h
Quoted 7 lines
Of course i will do so, if it makes sense due to little testing effort possible. Please give a short notice if you think i should resend the patch series.
One question:
Our IT department adds a signature since a few days, after a line with "----". Is this a problem? I can't turn that off, unfortunately.
(At least they keep the "text only" and don't switch to HTML)
Is it a problem for what, patches? It shouldn't be.
thanks,
greg k-h