Vlad Yasevich
b14878ccb7
net: sctp: cache auth_enable per endpoint ...
Currently, it is possible to create an SCTP socket, then switch
auth_enable via sysctl setting to 1 and crash the system on connect:
Oops[#1 ]:
CPU: 0 PID: 0 Comm: swapper Not tainted 3.14.1-mipsgit-20140415 #1
task: ffffffff8056ce80 ti: ffffffff8055c000 task.ti: ffffffff8055c000
[...]
Call Trace:
[<ffffffff8043c4e8>] sctp_auth_asoc_set_default_hmac+0x68/0x80
[<ffffffff8042b300>] sctp_process_init+0x5e0/0x8a4
[<ffffffff8042188c>] sctp_sf_do_5_1B_init+0x234/0x34c
[<ffffffff804228c8>] sctp_do_sm+0xb4/0x1e8
[<ffffffff80425a08>] sctp_endpoint_bh_rcv+0x1c4/0x214
[<ffffffff8043af68>] sctp_rcv+0x588/0x630
[<ffffffff8043e8e8>] sctp6_rcv+0x10/0x24
[<ffffffff803acb50>] ip6_input+0x2c0/0x440
[<ffffffff8030fc00>] __netif_receive_skb_core+0x4a8/0x564
[<ffffffff80310650>] process_backlog+0xb4/0x18c
[<ffffffff80313cbc>] net_rx_action+0x12c/0x210
[<ffffffff80034254>] __do_softirq+0x17c/0x2ac
[<ffffffff800345e0>] irq_exit+0x54/0xb0
[<ffffffff800075a4>] ret_from_irq+0x0/0x4
[<ffffffff800090ec>] rm7k_wait_irqoff+0x24/0x48
[<ffffffff8005e388>] cpu_startup_entry+0xc0/0x148
[<ffffffff805a88b0>] start_kernel+0x37c/0x398
Code: dd0900b8 000330f8 0126302d <dcc60000> 50c0fff1 0047182a a48306a0
03e00008 00000000
---[ end trace b530b0551467f2fd ]---
Kernel panic - not syncing: Fatal exception in interrupt
What happens while auth_enable=0 in that case is, that
ep->auth_hmacs is initialized to NULL in sctp_auth_init_hmacs()
when endpoint is being created.
After that point, if an admin switches over to auth_enable=1,
the machine can crash due to NULL pointer dereference during
reception of an INIT chunk. When we enter sctp_process_init()
via sctp_sf_do_5_1B_init() in order to respond to an INIT chunk,
the INIT verification succeeds and while we walk and process
all INIT params via sctp_process_param() we find that
net->sctp.auth_enable is set, therefore do not fall through,
but invoke sctp_auth_asoc_set_default_hmac() instead, and thus,
dereference what we have set to NULL during endpoint
initialization phase.
The fix is to make auth_enable immutable by caching its value
during endpoint initialization, so that its original value is
being carried along until destruction. The bug seems to originate
from the very first days.
Fix in joint work with Daniel Borkmann.
Reported-by: Joshua Kinard <kumba@gentoo.org>
Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Tested-by: Joshua Kinard <kumba@gentoo.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-18 18:32:00 -04:00
9pnet: p9_client->conn field is unused. Remove it.
2014-03-25 16:38:16 -05:00
Bluetooth: Track current configured LE scan type parameter
2014-03-21 22:02:12 +02:00
caif_hsi.h: Remove extern from function prototypes
2013-09-23 16:29:41 -04:00
include/net/: Fix FSF address in file headers
2013-12-06 12:37:56 -05:00
af_iucv: fix recvmsg by replacing skb_pull() function
2013-04-08 17:16:57 -04:00
netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4
2014-04-14 10:38:02 +02:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2014-03-17 15:06:24 -04:00
NFC: digital: Rename Type V tags to Type 5 tags
2014-03-11 00:40:59 +01:00
net: sctp: cache auth_enable per endpoint
2014-04-18 18:32:00 -04:00
net_sched: act: hide struct tcf_common from API
2014-02-12 19:23:32 -05:00
6lowpan: move 6lowpan header to include/net
2014-03-06 17:21:38 -05:00
net_sched: act: refuse to remove bound action outside
2014-02-12 19:23:32 -05:00
ipv6: addrconf: silence sparse endianness warnings
2014-02-27 17:13:20 -05:00
ieee802154: rename struct ieee802154_addr to *_sa
2014-03-14 22:15:25 -04:00
af_rxrpc.h: Remove extern from function prototypes
2013-07-31 17:50:01 -07:00
af_unix: improve STREAM behavior with fragmented memory
2013-08-10 01:16:44 -07:00
VSOCK: Move af_vsock.h and vsock_addr.h to include/net
2013-07-27 22:14:06 -07:00
arp: make arp_invalidate static
2013-12-28 17:02:46 -05:00
ax25.h: Remove extern from function prototypes
2013-07-31 17:50:02 -07:00
sched, net: Fixup busy_loop_us_clock()
2014-01-13 17:39:11 +01:00
cfg80211/mac80211: ignore signal if the frame was heard on wrong channel
2014-03-19 21:29:56 +01:00
net: optimize csum_replace2()
2014-03-24 00:18:44 -04:00
cipso: cleanup cipso_v4_translate() when !CONFIG_NETLABEL
2013-12-10 17:56:54 -05:00
cgroup: clean up cgroup_subsys names and initialization
2014-02-08 10:36:58 -05:00
net: introduce reciprocal_scale helper and convert users
2014-01-21 23:17:20 -08:00
compat.h: Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
net: Move prototype declaration to header file include/net/datalink.h from net/ipx/af_ipx.c
2014-02-09 17:32:50 -08:00
include/net/: Fix FSF address in file headers
2013-12-06 12:37:56 -05:00
include/net/: Fix FSF address in file headers
2013-12-06 12:37:56 -05:00
net: Move prototype declaration to header file include/net/dn.h from net/decnet/af_decnet.c
2014-02-09 17:32:49 -08:00
dn_dev: add support for IFA_FLAGS nl attribute
2013-12-10 21:50:00 -05:00
decnet (dn*.h): Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
decnet (dn*.h): Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
decnet (dn*.h): Remove extern from function prototypes
2013-09-20 14:49:32 -04:00
net: Move prototype declaration to appropriate header file from decnet/af_decnet.c
2014-02-09 17:32:49 -08:00
ipv4: add a sock pointer to dst->output() path.
2014-04-15 13:47:15 -04:00
net: move pskb_put() to core code
2013-11-07 19:28:58 -05:00
net: ethoc: set up MII management bus clock
2014-02-04 20:19:51 -08:00
fib_rules.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
firewire net, ipv4 arp: Extend hardware address and remove driver-level packet inspection.
2013-03-26 12:32:13 -04:00
ipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iif
2014-04-16 15:05:11 -04:00
flow_dissector: factor out the ports extraction in skb_flow_get_ports
2013-10-03 15:36:37 -04:00
flowcache: Make flow cache name space aware
2014-02-12 07:02:11 +01:00
garp.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
gen_stats.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
genl: Add genlmsg_new_unicast() for unicast message allocation
2014-01-06 15:51:53 -08:00
gre_offload: statically build GRE offloading support
2014-01-06 20:28:34 -05:00
icmp.h: Remove extern from function prototypes
2013-09-20 14:49:33 -04:00
mac80211: propagate STBC / LDPC flags to radiotap
2014-02-06 09:34:58 +01:00
ieee802154: add header structs with endiannes and operations
2014-03-14 22:15:26 -04:00
mac802154: make csma/cca parameters per-wpan
2014-04-01 16:25:51 -04:00
ipv6: move DAD and addrconf_verify processing to workqueue
2014-03-28 16:54:50 -04:00
ipv4: add a sock pointer to ip_queue_xmit()
2014-04-15 12:58:34 -04:00
ipv6: split inet6_ehashfn to hash functions per compilation unit
2013-10-19 19:45:34 -04:00
inet*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
ipv4: add a sock pointer to ip_queue_xmit()
2014-04-15 12:58:34 -04:00
net: Correct comparisons and calculations using skb->tail and skb-transport_header
2013-05-28 23:49:07 -07:00
inet: remove old fragmentation hash initializing
2013-10-23 17:01:41 -04:00
tcp/dccp: remove twchain
2013-10-08 23:19:24 -04:00
inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once
2013-10-19 19:45:35 -04:00
ipv6: tcp: fix flowlabel value in ACK messages send from TIME_WAIT
2014-01-17 17:56:33 -08:00
ipv4: remove unused function
2013-12-28 17:03:20 -05:00
ipv4: add a sock pointer to dst->output() path.
2014-04-15 13:47:15 -04:00
net: fix build errors if ipv6 is disabled
2013-10-09 13:04:03 -04:00
ipv6: do not overwrite inetpeer metrics prematurely
2014-03-27 15:09:07 -04:00
ipv6: Limit mtu to 65575 bytes
2014-04-14 12:39:59 -04:00
net: unify the pcpu_tstats and br_cpu_netstats as one
2014-01-04 20:10:24 -05:00
ip*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
ipv4: add a sock pointer to dst->output() path.
2014-04-15 13:47:15 -04:00
netfilter: push reasm skb through instead of original frag skbs
2013-11-11 00:19:35 -05:00
ipv4: add a sock pointer to dst->output() path.
2014-04-15 13:47:15 -04:00
net: Move prototype declaration to header file include/net/ipx.h from net/ipx/af_ipx.c
2014-02-09 17:32:50 -08:00
iw_handler.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
lapb.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
hostap: Don't use create_proc_read_entry()
2013-04-29 15:41:56 -04:00
llc: make lock static
2014-01-03 20:56:48 -05:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
net: llc: fix order of evaluation in llc_conn_ac_inc_vr_by_1
2014-01-01 22:22:43 -05:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
llc*.h: Remove extern from function prototypes
2013-09-21 14:01:38 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-04-02 20:53:45 -07:00
ieee802154: add header structs with endiannes and operations
2014-03-14 22:15:26 -04:00
include/net/: Fix FSF address in file headers
2013-12-06 12:37:56 -05:00
net: ipv6: mld: get rid of MLDV2_MRC and simplify calculation
2013-09-04 14:53:20 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-10-01 17:06:14 -04:00
ndisc.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
neigh: use NEIGH_VAR_INIT in ndo_neigh_setup functions.
2014-01-16 11:31:58 -08:00
ipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iif
2014-04-16 15:05:11 -04:00
netevent/netlink.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-01-25 11:17:34 -08:00
netevent/netlink.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
cgroup: clean up cgroup_subsys names and initialization
2014-02-08 10:36:58 -05:00
netrom.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
ieee802154: use ieee802154_addr instead of *_sa variants
2014-03-14 22:15:26 -04:00
p8022.h: Remove extern from function prototypes
2013-09-21 14:01:39 -04:00
ipv6: make IPV6_RECVPKTINFO work for ipv4 datagrams
2014-01-19 19:53:18 -08:00
net_sched: optimize tcf_match_indev()
2014-01-13 11:50:15 -08:00
pkt_sched: give visibility to mq slave qdiscs
2013-12-09 19:54:47 -05:00
net: Add GRO support for UDP encapsulating protocols
2014-01-21 18:05:04 -08:00
psnap.h: Remove extern from function prototypes
2013-09-23 01:51:08 -04:00
raw/rawv6.h: Remove extern from function prototypes
2013-09-23 01:51:08 -04:00
raw/rawv6.h: Remove extern from function prototypes
2013-09-23 01:51:08 -04:00
reciprocal_divide: update/correction of the algorithm
2014-01-21 23:17:20 -08:00
cfg80211: regulatory: allow getting DFS CAC time from userspace
2014-02-25 17:29:25 +01:00
inet: includes a sock_common in request_sock
2013-10-10 00:08:07 -04:00
rose.h: Remove extern from function prototypes
2013-09-23 01:51:08 -04:00
ipv4: remove ip_rt_dump from route.c
2014-03-24 12:45:01 -04:00
rtnl: make ifla_policy static
2014-02-18 18:15:42 -05:00
net_sched: add struct net pointer to tcf_proto_ops->dump
2014-01-13 11:50:14 -08:00
scm.h: Remove extern from function prototypes
2013-09-23 01:51:09 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-10-01 17:06:14 -04:00
net: Fix use after free by removing length arg from sk_data_ready callbacks.
2014-04-11 16:15:36 -04:00
drivers: net: Include new header file in sbni.c
2013-12-19 18:51:20 -05:00
stp.h: Remove extern from function prototypes
2013-09-23 01:51:09 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-03-25 20:29:20 -04:00
tcp_memcontrol: Kill struct tcp_memcontrol
2013-10-21 18:43:02 -04:00
ipv6: make IPV6_RECVPKTINFO work for ipv4 datagrams
2014-01-19 19:53:18 -08:00
udp: Remove unnecessary semicolon from do{}while (0) macro
2013-11-07 02:14:33 -05:00
udplite.h: Remove extern from function prototypes
2013-09-23 16:29:40 -04:00
VSOCK: Move af_vsock.h and vsock_addr.h to include/net
2013-07-27 22:14:06 -07:00
net: Add GRO support for vxlan traffic
2014-01-21 18:05:04 -08:00
wext.h: Remove extern from function prototypes
2013-09-23 16:29:40 -04:00
wimax.h: Remove extern from function prototypes
2013-09-23 16:29:41 -04:00
ieee802154: add netlink APIs for smartMAC configuration
2014-02-17 16:42:39 -05:00
x25.h: Remove extern from function prototypes
2013-09-23 16:29:41 -04:00
ipv4: add a sock pointer to dst->output() path.
2014-04-15 13:47:15 -04:00
b14878ccb7