0f831b3cf2
CVE-2017-8890: dccp/tcp: do not inherit mc_list from parent
CVE-2017-9074: ipv6: Prevent overrun when parsing v6 header options
CVE-2017-9075: sctp: do not inherit ipv6_{mc|ac|fl}_list from parent
CVE-2017-9076/CVE-2017-9077: ipv6/dccp: do not inherit ipv6_mc_list from parent
CVE-2017-9242: ipv6: fix out of bound writes in __ip6_append_data()
54 lines
1.8 KiB
Diff
54 lines
1.8 KiB
Diff
From fa0ad0349d68f7e86419922266aa48de3eb2c507 Mon Sep 17 00:00:00 2001
|
|
From: Eric Dumazet <edumazet@google.com>
|
|
Date: Tue, 6 Jun 2017 18:16:00 +0200
|
|
Subject: [PATCH] dccp/tcp: do not inherit mc_list from parent
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
syzkaller found a way to trigger double frees from ip_mc_drop_socket()
|
|
|
|
It turns out that leave a copy of parent mc_list at accept() time,
|
|
which is very bad.
|
|
|
|
Very similar to commit 8b485ce69876 ("tcp: do not inherit
|
|
fastopen_req from parent")
|
|
|
|
Initial report from Pray3r, completed by Andrey one.
|
|
Thanks a lot to them !
|
|
|
|
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
|
Reported-by: Pray3r <pray3r.z@gmail.com>
|
|
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
|
Tested-by: Andrey Konovalov <andreyknvl@google.com>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
|
|
CVE-2017-8890
|
|
|
|
(cherry-picked from 657831ffc38e30092a2d5f03d385d710eb88b09a)
|
|
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
|
|
Acked-by: Colin Ian King <colin.king@canonical.com>
|
|
Acked-by: Andy Whitcroft <apw@canonical.com>
|
|
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
|
|
|
|
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
|
|
---
|
|
net/ipv4/inet_connection_sock.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
|
|
index 19ea045c50ed..d952cfa15737 100644
|
|
--- a/net/ipv4/inet_connection_sock.c
|
|
+++ b/net/ipv4/inet_connection_sock.c
|
|
@@ -669,6 +669,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
|
|
/* listeners have SOCK_RCU_FREE, not the children */
|
|
sock_reset_flag(newsk, SOCK_RCU_FREE);
|
|
|
|
+ inet_sk(newsk)->mc_list = NULL;
|
|
+
|
|
newsk->sk_mark = inet_rsk(req)->ir_mark;
|
|
atomic64_set(&newsk->sk_cookie,
|
|
atomic64_read(&inet_rsk(req)->ir_cookie));
|
|
--
|
|
2.11.0
|
|
|