mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-04 18:09:57 +00:00
Code Issues Releases Wiki Activity
linux-stable/net
History
James Chapman 225eb26489 l2tp: don't use inet_shutdown on ppp session destroy 
Previously, if a ppp session was closed, we called inet_shutdown to mark
the socket as unconnected such that userspace would get errors and
then close the socket. This could race with userspace closing the
socket. Instead, leave userspace to close the socket in its own time
(our session will be detached anyway).

BUG: KASAN: use-after-free in inet_shutdown+0x5d/0x1c0
Read of size 4 at addr ffff880010ea3ac0 by task syzbot_347bd5ac/8296

CPU: 3 PID: 8296 Comm: syzbot_347bd5ac Not tainted 4.16.0-rc1+ #91
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
Call Trace:
 dump_stack+0x101/0x157
 ? inet_shutdown+0x5d/0x1c0
 print_address_description+0x78/0x260
 ? inet_shutdown+0x5d/0x1c0
 kasan_report+0x240/0x360
 __asan_load4+0x78/0x80
 inet_shutdown+0x5d/0x1c0
 ? pppol2tp_show+0x80/0x80
 pppol2tp_session_close+0x68/0xb0
 l2tp_tunnel_closeall+0x199/0x210
 ? udp_v6_flush_pending_frames+0x90/0x90
 l2tp_udp_encap_destroy+0x6b/0xc0
 ? l2tp_tunnel_del_work+0x2e0/0x2e0
 udpv6_destroy_sock+0x8c/0x90
 sk_common_release+0x47/0x190
 udp_lib_close+0x15/0x20
 inet_release+0x85/0xd0
 inet6_release+0x43/0x60
 sock_release+0x53/0x100
 ? sock_alloc_file+0x260/0x260
 sock_close+0x1b/0x20
 __fput+0x19f/0x380
 ____fput+0x1a/0x20
 task_work_run+0xd2/0x110
 exit_to_usermode_loop+0x18d/0x190
 do_syscall_64+0x389/0x3b0
 entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x7fe240a45259
RSP: 002b:00007fe241132df8 EFLAGS: 00000297 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe240a45259
RDX: 00007fe240a45259 RSI: 0000000000000000 RDI: 00000000000000a5
RBP: 00007fe241132e20 R08: 00007fe241133700 R09: 0000000000000000
R10: 00007fe241133700 R11: 0000000000000297 R12: 0000000000000000
R13: 00007ffc49aff84f R14: 0000000000000000 R15: 00007fe241141040

Allocated by task 8331:
 save_stack+0x43/0xd0
 kasan_kmalloc+0xad/0xe0
 kasan_slab_alloc+0x12/0x20
 kmem_cache_alloc+0x144/0x3e0
 sock_alloc_inode+0x22/0x130
 alloc_inode+0x3d/0xf0
 new_inode_pseudo+0x1c/0x90
 sock_alloc+0x30/0x110
 __sock_create+0xaa/0x4c0
 SyS_socket+0xbe/0x130
 do_syscall_64+0x128/0x3b0
 entry_SYSCALL_64_after_hwframe+0x26/0x9b

Freed by task 8314:
 save_stack+0x43/0xd0
 __kasan_slab_free+0x11a/0x170
 kasan_slab_free+0xe/0x10
 kmem_cache_free+0x88/0x2b0
 sock_destroy_inode+0x49/0x50
 destroy_inode+0x77/0xb0
 evict+0x285/0x340
 iput+0x429/0x530
 dentry_unlink_inode+0x28c/0x2c0
 __dentry_kill+0x1e3/0x2f0
 dput.part.21+0x500/0x560
 dput+0x24/0x30
 __fput+0x2aa/0x380
 ____fput+0x1a/0x20
 task_work_run+0xd2/0x110
 exit_to_usermode_loop+0x18d/0x190
 do_syscall_64+0x389/0x3b0
 entry_SYSCALL_64_after_hwframe+0x26/0x9b

Fixes: fd558d186d ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-02-26 12:20:36 -05:00
..
6lowpan
9p virtio: bugfixes 2018-02-15 14:29:27 -08:00
802
8021q net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
appletalk net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
atm vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
ax25 net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
batman-adv vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
bluetooth vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
bpf bpf: fix null pointer deref in bpf_prog_test_run_xdp 2018-02-01 07:43:56 -08:00
bridge Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2018-02-21 14:49:55 -05:00
caif vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
can can: migrate documentation to restructured text 2018-01-26 10:46:44 +01:00
ceph libceph: check kstrndup() return value 2018-01-29 18:36:12 +01:00
core net_sched: gen_estimator: fix broken estimators based on percpu stats 2018-02-23 12:35:46 -05:00
dcb
dccp vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
decnet dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock 2018-02-16 15:46:15 -05:00
dns_resolver afs: Support the AFS dynamic root 2018-02-06 14:43:37 +00:00
dsa net: dsa: Support internal phy on 'cpu' port 2018-01-23 19:22:38 -05:00
ethernet
hsr
ieee802154
ife
ipv4 net: ipv4: Set addr_type in hash_keys for forwarded case 2018-02-22 14:30:51 -05:00
ipv6 ipv6 sit: work around bogus gcc-8 -Wrestrict warning 2018-02-23 10:53:26 -05:00
iucv vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
kcm vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
key af_key: Fix memory leak in key_notify_policy. 2018-01-10 09:45:11 +01:00
l2tp l2tp: don't use inet_shutdown on ppp session destroy 2018-02-26 12:20:36 -05:00
l3mdev
lapb
llc net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
mac80211 Various fixes across the tree, the shortlog basically says it all: 2018-02-22 15:17:01 -05:00
mac802154
mpls mpls, nospec: Sanitize array index in mpls_label_ok() 2018-02-08 15:24:12 -05:00
ncsi net/ncsi: Don't take any action on HNCDSC AEN 2017-12-18 14:50:11 -05:00
netfilter netfilter: IDLETIMER: be syzkaller friendly 2018-02-19 18:28:59 +01:00
netlabel
netlink netlink: put module reference if dump start fails 2018-02-22 14:01:38 -05:00
netrom net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
nfc NFC: llcp: Limit size of SDP URI 2018-02-16 15:16:05 -05:00
nsh
openvswitch openvswitch: Remove padding from packet before L3+ conntrack processing 2018-02-01 09:46:22 -05:00
packet vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
phonet vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
psample
qrtr net: use rtnl_register_module where needed 2017-12-04 11:32:39 -05:00
rds rds: do not call ->conn_alloc with GFP_KERNEL 2018-02-13 13:52:02 -05:00
rfkill vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
rose net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
rxrpc rxrpc: Fix send in rxrpc_send_data_packet() 2018-02-22 15:37:47 -05:00
sched net: sched: report if filter is too large to dump 2018-02-20 21:57:17 -05:00
sctp sctp: remove the left unnecessary check for chunk in sctp_renege_events 2018-02-16 16:32:37 -05:00
smc vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
strparser strparser: Call sock_owned_by_user_nocheck 2017-12-28 14:28:22 -05:00
sunrpc vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
switchdev
tipc tipc: Fix missing RTNL lock protection during setting link properties 2018-02-14 14:46:33 -05:00
tls tls: getsockopt return record sequence number 2018-02-14 15:05:19 -05:00
unix net: af_unix: fix typo in UNIX_SKB_FRAGS_SZ comment 2018-02-13 12:21:45 -05:00
vmw_vsock vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
wimax
wireless Various fixes across the tree, the shortlog basically says it all: 2018-02-22 15:17:01 -05:00
x25
xfrm Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 2018-01-26 10:22:53 -05:00
compat.c
Kconfig Staging/IIO patches for 4.16-rc1 2018-02-01 09:51:57 -08:00
Makefile ipx: move Novell IPX protocol support into staging 2017-11-28 13:55:00 +01:00
socket.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
sysctl_net.c