linux-toradex.git/drivers/net/ppp/pptp.c, branch v4.4.64

pptp: fix illegal memory access caused by multiple bind()s

2016-03-03T23:07:04+00:00

[ Upstream commit 9a368aff9cb370298fa02feeffa861f2db497c18 ]

Several times already this has been reported as kasan reports caused by
syzkaller and trinity and people always looked at RCU races, but it is
much more simple. :)

In case we bind a pptp socket multiple times, we simply add it to
the callid_sock list but don't remove the old binding. Thus the old
socket stays in the bucket with unused call_id indexes and doesn't get
cleaned up. This causes various forms of kasan reports which were hard
to pinpoint.

Simply don't allow multiple binds and correct error handling in
pptp_bind. Also keep sk_state bits in place in pptp_connect.

Fixes: 00959ade36acad ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
Cc: Dmitry Kozlov 
Cc: Sasha Levin 
Cc: Dmitry Vyukov 
Reported-by: Dmitry Vyukov 
Cc: Dave Jones 
Reported-by: Dave Jones 
Signed-off-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

pptp: verify sockaddr_len in pptp_bind() and pptp_connect()

2015-12-15T05:29:34+00:00

Reported-by: Dmitry Vyukov 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

ipv4, ipv6: Pass net into ip_local_out and ip6_local_out

2015-10-08T11:27:02+00:00

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

ppp: Cache net in pptp_xmit

2015-10-08T11:27:00+00:00

Compute net and store it in a variable in pptp_xmit, so that the value
can be reused the next time it is needed.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

ipv4: Merge ip_local_out and ip_local_out_sk

2015-10-08T11:26:57+00:00

It is confusing and silly hiding a parameter so modify all of
the callers to pass in the appropriate socket or skb->sk if
no socket is known.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

netfilter: Remove spurios included of netfilter.h

2015-06-18T19:14:32+00:00

While testing my netfilter changes I noticed several files where
recompiling unncessarily because they unncessarily included
netfilter.h.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Pablo Neira Ayuso

net: Pass kern from net_proto_family.create to sk_alloc

2015-05-11T14:50:17+00:00

In preparation for changing how struct net is refcounted
on kernel sockets pass the knowledge that we are creating
a kernel socket from sock_create_kern through to sk_alloc.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

ipv4: hash net ptr into fragmentation bucket selection

2015-03-25T18:07:04+00:00

As namespaces are sometimes used with overlapping ip address ranges,
we should also use the namespace as input to the hash to select the ip
fragmentation counter bucket.

Cc: Eric Dumazet 
Cc: Flavio Leitner 
Signed-off-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

pptp: fix stack info leak in pptp_getname()

2014-11-21T03:43:47+00:00

pptp_getname() only partially initializes the stack variable sa,
particularly only fills the pptp part of the sa_addr union. The code
thereby discloses 16 bytes of kernel stack memory via getsockname().

Fix this by memset(0)'ing the union before.

Cc: Dmitry Kozlov 
Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller

inetpeer: get rid of ip_id_count

2014-06-02T18:00:41+00:00

Ideally, we would need to generate IP ID using a per destination IP
generator.

linux kernels used inet_peer cache for this purpose, but this had a huge
cost on servers disabling MTU discovery.

1) each inet_peer struct consumes 192 bytes

2) inetpeer cache uses a binary tree of inet_peer structs,
   with a nominal size of ~66000 elements under load.

3) lookups in this tree are hitting a lot of cache lines, as tree depth
   is about 20.

4) If server deals with many tcp flows, we have a high probability of
   not finding the inet_peer, allocating a fresh one, inserting it in
   the tree with same initial ip_id_count, (cf secure_ip_id())

5) We garbage collect inet_peer aggressively.

IP ID generation do not have to be 'perfect'

Goal is trying to avoid duplicates in a short period of time,
so that reassembly units have a chance to complete reassembly of
fragments belonging to one message before receiving other fragments
with a recycled ID.

We simply use an array of generators, and a Jenkin hash using the dst IP
as a key.

ipv6_select_ident() is put back into net/ipv6/ip6_output.c where it
belongs (it is only used from this file)

secure_ip_id() and secure_ipv6_id() no longer are needed.

Rename ip_select_ident_more() to ip_select_ident_segs() to avoid
unnecessary decrement/increment of the number of segments.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller