kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
No description
739,403 commits 117 branches 5,827 tags 6.3 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Guillaume Nault 4f9aa3f83f l2tp: fix races in tunnel creation 
[ Upstream commit 6b9f34239b ]

l2tp_tunnel_create() inserts the new tunnel into the namespace's tunnel
list and sets the socket's ->sk_user_data field, before returning it to
the caller. Therefore, there are two ways the tunnel can be accessed
and freed, before the caller even had the opportunity to take a
reference. In practice, syzbot could crash the module by closing the
socket right after a new tunnel was returned to pppol2tp_create().

This patch moves tunnel registration out of l2tp_tunnel_create(), so
that the caller can safely hold a reference before publishing the
tunnel. This second step is done with the new l2tp_tunnel_register()
function, which is now responsible for associating the tunnel to its
socket and for inserting it into the namespace's list.

While moving the code to l2tp_tunnel_register(), a few modifications
have been done. First, the socket validation tests are done in a helper
function, for clarity. Also, modifying the socket is now done after
having inserted the tunnel to the namespace's tunnels list. This will
allow insertion to fail, without having to revert theses modifications
in the error path (a followup patch will check for duplicate tunnels
before insertion). Either the socket is a kernel socket which we
control, or it is a user-space socket for which we have a reference on
the file descriptor. In any case, the socket isn't going to be closed
from under us.

Reported-by: syzbot+fbeeb5c3b538e8545644@syzkaller.appspotmail.com
Fixes: fd558d186d ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2018-04-19 08:54:04 +02:00
arch crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one 2018-04-08 14:29:51 +02:00
block Fix slab name "biovec-(1<<(21-12))" 2018-04-08 14:29:52 +02:00
certs certs/blacklist_nohashes.c: fix const confusion in certs blacklist 2018-02-21 15:35:43 -08:00
crypto crypto: ahash - Fix early termination in hash walk 2018-04-08 14:29:50 +02:00
Documentation serial: 8250: Add Nuvoton NPCM UART 2018-04-08 14:29:49 +02:00
drivers vhost: fix vhost_vq_access_ok() log check 2018-04-19 08:54:04 +02:00
firmware kbuild: remove all dummy assignments to obj- 2017-11-18 11:46:06 +09:00
fs Btrfs: fix unexpected cow in run_delalloc_nocow 2018-04-08 14:29:51 +02:00
include slip: Check if rstate is initialized before uncompressing 2018-04-19 08:54:04 +02:00
init jump_label: Disable jump labels in __exit code 2018-03-20 08:57:17 +01:00
ipc ipc/shm.c: add split function to shm_vm_ops 2018-03-28 13:42:05 -10:00
kernel perf/hwbp: Simplify the perf-hwbp code, fix documentation 2018-03-28 17:41:50 +02:00
lib Merge branch 'akpm' (patches from Andrew) 2018-03-22 18:48:43 -07:00
LICENSES LICENSES: Add MPL-1.1 license 2018-01-06 10:59:44 -07:00
mm mm/kmemleak.c: wait for scan completion before disabling free 2018-03-28 13:42:05 -10:00
net l2tp: fix races in tunnel creation 2018-04-19 08:54:04 +02:00
samples - do not build samples when cross compiling (Michal Hocko) 2018-02-27 10:39:29 -08:00
scripts kbuild: rpm-pkg: Support GNU tar >= 1.29 2018-03-28 01:42:17 +09:00
security integrity/security: fix digsig.c build error with header file 2018-02-22 20:09:08 -08:00
sound ALSA: pcm: potential uninitialized return values 2018-03-27 15:20:19 +02:00
tools Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-03-31 07:26:48 -10:00
usr initramfs: fix initramfs rebuilds w/ compression after disabling 2017-11-03 07:39:19 -07:00
virt kvm/arm fixes for 4.16, take 2 2018-03-15 21:45:37 +01:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Add hch to .get_maintainer.ignore 2015-08-21 14:30:10 -07:00
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore .gitignore: ignore ASN.1 auto generated files 2018-02-14 21:05:38 +01:00
.mailmap mailmap: Update email address for Gregory CLEMENT 2018-03-09 17:48:50 +01:00
COPYING [PATCH] update FSF address in COPYING 2005-09-10 10:06:29 -07:00
CREDITS MAINTAINERS: update TPM driver infrastructure changes 2017-11-09 17:58:40 -08:00
Kbuild Kbuild updates for v4.15 2017-11-17 17:45:29 -08:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
MAINTAINERS Merge branch 'akpm' (patches from Andrew) 2018-03-28 14:34:55 -10:00
Makefile Linux 4.16.2 2018-04-12 12:30:01 +02:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.