1 |
commit: 6ed8b62e018b2d75b73c9d848d64b1394c1e362a |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Fri Feb 24 16:11:39 2017 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Fri Feb 24 16:11:39 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6ed8b62e |
7 |
|
8 |
dccp: fix freeing skb too early for IPV6_RECVPKTINFO. CVE-2017-6074 |
9 |
|
10 |
0000_README | 4 ++ |
11 |
1520_CVE-2017-6074-dccp-fix-early-skb-free.patch | 47 ++++++++++++++++++++++++ |
12 |
2 files changed, 51 insertions(+) |
13 |
|
14 |
diff --git a/0000_README b/0000_README |
15 |
index 061bd5e..9c6c940 100644 |
16 |
--- a/0000_README |
17 |
+++ b/0000_README |
18 |
@@ -203,6 +203,10 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch |
19 |
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/ |
20 |
Desc: Enable link security restrictions by default. |
21 |
|
22 |
+Patch: 1520_CVE-2017-6074-dccp-skb-freeing-fix.patch |
23 |
+From: https://bugs.gentoo.org/show_bug.cgi?id=610600 |
24 |
+Desc: dccp: fix freeing skb too early for IPV6_RECVPKTINFO. CVE-2017-6074 |
25 |
+ |
26 |
Patch: 1800_fix-lru-cache-add-oom-regression.patch |
27 |
From: http://thread.gmane.org/gmane.linux.kernel.stable/184384 |
28 |
Desc: Revert commit 8f182270dfec mm/swap.c: flush lru pvecs on compound page arrival to fix OOM error. |
29 |
|
30 |
diff --git a/1520_CVE-2017-6074-dccp-fix-early-skb-free.patch b/1520_CVE-2017-6074-dccp-fix-early-skb-free.patch |
31 |
new file mode 100644 |
32 |
index 0000000..433fd4b |
33 |
--- /dev/null |
34 |
+++ b/1520_CVE-2017-6074-dccp-fix-early-skb-free.patch |
35 |
@@ -0,0 +1,47 @@ |
36 |
+From 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 Mon Sep 17 00:00:00 2001 |
37 |
+From: Andrey Konovalov <andreyknvl@××××××.com> |
38 |
+Date: Thu, 16 Feb 2017 17:22:46 +0100 |
39 |
+Subject: dccp: fix freeing skb too early for IPV6_RECVPKTINFO |
40 |
+ |
41 |
+In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet |
42 |
+is forcibly freed via __kfree_skb in dccp_rcv_state_process if |
43 |
+dccp_v6_conn_request successfully returns. |
44 |
+ |
45 |
+However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb |
46 |
+is saved to ireq->pktopts and the ref count for skb is incremented in |
47 |
+dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed |
48 |
+in dccp_rcv_state_process. |
49 |
+ |
50 |
+Fix by calling consume_skb instead of doing goto discard and therefore |
51 |
+calling __kfree_skb. |
52 |
+ |
53 |
+Similar fixes for TCP: |
54 |
+ |
55 |
+fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed. |
56 |
+0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now |
57 |
+simply consumed |
58 |
+ |
59 |
+Signed-off-by: Andrey Konovalov <andreyknvl@××××××.com> |
60 |
+Acked-by: Eric Dumazet <edumazet@××××××.com> |
61 |
+Signed-off-by: David S. Miller <davem@×××××××××.net> |
62 |
+--- |
63 |
+ net/dccp/input.c | 3 ++- |
64 |
+ 1 file changed, 2 insertions(+), 1 deletion(-) |
65 |
+ |
66 |
+diff --git a/net/dccp/input.c b/net/dccp/input.c |
67 |
+index ba34718..8fedc2d 100644 |
68 |
+--- a/net/dccp/input.c |
69 |
++++ b/net/dccp/input.c |
70 |
+@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, |
71 |
+ if (inet_csk(sk)->icsk_af_ops->conn_request(sk, |
72 |
+ skb) < 0) |
73 |
+ return 1; |
74 |
+- goto discard; |
75 |
++ consume_skb(skb); |
76 |
++ return 0; |
77 |
+ } |
78 |
+ if (dh->dccph_type == DCCP_PKT_RESET) |
79 |
+ goto discard; |
80 |
+-- |
81 |
+cgit v0.12 |
82 |
+ |