kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/l2tp
History
Eric Dumazet 81ed463384 ipv6: add complete rcu protection around np->opt 
[ Upstream commit 45f6fad84c ]

This patch addresses multiple problems :

UDP/RAW sendmsg() need to get a stable struct ipv6_txoptions
while socket is not locked : Other threads can change np->opt
concurrently. Dmitry posted a syzkaller
(http://github.com/google/syzkaller) program desmonstrating
use-after-free.

Starting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock()
and dccp_v6_request_recv_sock() also need to use RCU protection
to dereference np->opt once (before calling ipv6_dup_options())

This patch adds full RCU protection to np->opt

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2015-12-14 21:24:32 -08:00
..
Kconfig l2tp: Call udp_sock_create 2014-07-14 16:12:15 -07:00
l2tp_core.c l2tp: protect tunnel->del_work by ref_count 2015-10-27 09:51:48 +09:00
l2tp_core.h l2tp: Add support for zero IPv6 checksums 2014-05-23 16:28:53 -04:00
l2tp_debugfs.c ipv6: make lookups simpler and faster 2013-10-09 00:01:25 -04:00
l2tp_eth.c l2tp: Use eth_<foo>_addr instead of memset 2015-03-03 17:01:38 -05:00
l2tp_ip.c net: Remove iocb argument from sendmsg and recvmsg 2015-03-02 13:06:31 -05:00
l2tp_ip6.c ipv6: add complete rcu protection around np->opt 2015-12-14 21:24:32 -08:00
l2tp_netlink.c netlink: implement nla_get_in_addr and nla_get_in6_addr 2015-03-31 13:58:35 -04:00
l2tp_ppp.c net: Remove iocb argument from sendmsg and recvmsg 2015-03-02 13:06:31 -05:00
Makefile l2tp: introduce L2TPv3 IP encapsulation support for IPv6 2012-05-01 09:30:55 -04:00