kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/l2tp
History
Eric Dumazet 46ddb98e20 ipv6: add complete rcu protection around np->opt 
[ Upstream commit 45f6fad84c ]

This patch addresses multiple problems :

UDP/RAW sendmsg() need to get a stable struct ipv6_txoptions
while socket is not locked : Other threads can change np->opt
concurrently. Dmitry posted a syzkaller
(http://github.com/google/syzkaller) program desmonstrating
use-after-free.

Starting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock()
and dccp_v6_request_recv_sock() also need to use RCU protection
to dereference np->opt once (before calling ipv6_dup_options())

This patch adds full RCU protection to np->opt

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2015-12-14 12:19:26 -05:00
..
Kconfig l2tp: Call udp_sock_create 2014-07-14 16:12:15 -07:00
l2tp_core.c l2tp: protect tunnel->del_work by ref_count 2015-11-13 13:15:37 -05:00
l2tp_core.h l2tp: Add support for zero IPv6 checksums 2014-05-23 16:28:53 -04:00
l2tp_debugfs.c ipv6: make lookups simpler and faster 2013-10-09 00:01:25 -04:00
l2tp_eth.c net: set name_assign_type in alloc_netdev() 2014-07-15 16:12:48 -07:00
l2tp_ip.c net: Eliminate no_check from protosw 2014-05-23 16:28:53 -04:00
l2tp_ip6.c ipv6: add complete rcu protection around np->opt 2015-12-14 12:19:26 -05:00
l2tp_netlink.c l2tp: Add support for zero IPv6 checksums 2014-05-23 16:28:53 -04:00
l2tp_ppp.c l2tp: fix race while getting PMTU on PPP pseudo-wire 2014-09-05 14:40:18 -07:00
Makefile l2tp: introduce L2TPv3 IP encapsulation support for IPv6 2012-05-01 09:30:55 -04:00