[arch-commits] Commit in linux-lts/trunk (2 files)
Andreas Radke
andyrtr at archlinux.org
Thu Oct 12 19:09:08 UTC 2017
Date: Thursday, October 12, 2017 @ 19:09:07
Author: andyrtr
Revision: 307785
upgpkg: linux-lts 4.9.55-1
upstream update 4.8.55 - revert one commit that breaks network (dhcp)
Added:
linux-lts/trunk/socket_bpf_fix_possible_use_after_free.diff
Modified:
linux-lts/trunk/PKGBUILD
---------------------------------------------+
PKGBUILD | 12 ++-
socket_bpf_fix_possible_use_after_free.diff | 91 ++++++++++++++++++++++++++
2 files changed, 100 insertions(+), 3 deletions(-)
Modified: PKGBUILD
===================================================================
--- PKGBUILD 2017-10-12 18:50:22 UTC (rev 307784)
+++ PKGBUILD 2017-10-12 19:09:07 UTC (rev 307785)
@@ -9,7 +9,7 @@
arch=('i686' 'x86_64')
url="https://www.kernel.org/"
license=('GPL2')
-makedepends=('xmlto' 'docbook-xsl' 'kmod' 'inetutils' 'bc' 'libelf')
+makedepends=('xmlto' 'docbook-xsl' 'kmod' 'inetutils' 'bc' 'libelf' 'git')
options=('!strip')
source=(https://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.{xz,sign}
https://www.kernel.org/pub/linux/kernel/v4.x/patch-${pkgver}.{xz,sign}
@@ -19,7 +19,8 @@
'90-linux.hook'
# standard config files for mkinitcpio ramdisk
linux-lts.preset
- change-default-console-loglevel.patch)
+ change-default-console-loglevel.patch
+ socket_bpf_fix_possible_use_after_free.diff)
# https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc
sha256sums=('029098dcffab74875e086ae970e3828456838da6e0ba22ce3f64ef764f3d7f1a'
'SKIP'
@@ -29,7 +30,8 @@
'1bec2ba1cd21b26234caf33cca737259797430d4fe5fade16e60480a9442a6e0'
'834bd254b56ab71d73f59b3221f056c72f559553c04718e350ab2a3e2991afe0'
'1f036f7464da54ae510630f0edb69faa115287f86d9f17641197ffda8cfd49e0'
- '1256b241cd477b265a3c2d64bdc19ffe3c9bbcee82ea3994c590c2c76e767d99')
+ '1256b241cd477b265a3c2d64bdc19ffe3c9bbcee82ea3994c590c2c76e767d99'
+ 'f6a5db4ef1580922ffd0e2d080a8a6ba9b97e270f8373f09c4675241447d6af6')
validpgpkeys=('ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds <torvalds at linux-foundation.org>
'647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman (Linux kernel stable release signing key) <greg at kroah.com>
)
@@ -45,6 +47,10 @@
# add latest fixes from stable queue, if needed
# http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git
+ # fix broken network reverting upstream commit
+ # https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-4.9.y&id=02f7e4101092b88e57c73171174976c8a72a3eba
+ patch -Rp1 -i ../socket_bpf_fix_possible_use_after_free.diff
+
# set DEFAULT_CONSOLE_LOGLEVEL to 4 (same value as the 'quiet' kernel param)
# remove this when a Kconfig knob is made available by upstream
# (relevant patch sent upstream: https://lkml.org/lkml/2011/7/26/227)
Added: socket_bpf_fix_possible_use_after_free.diff
===================================================================
--- socket_bpf_fix_possible_use_after_free.diff (rev 0)
+++ socket_bpf_fix_possible_use_after_free.diff 2017-10-12 19:09:07 UTC (rev 307785)
@@ -0,0 +1,91 @@
+From 02f7e4101092b88e57c73171174976c8a72a3eba Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet at google.com>
+Date: Mon, 2 Oct 2017 12:20:51 -0700
+Subject: socket, bpf: fix possible use after free
+
+[ Upstream commit eefca20eb20c66b06cf5ed09b49b1a7caaa27b7b ]
+
+Starting from linux-4.4, 3WHS no longer takes the listener lock.
+
+Since this time, we might hit a use-after-free in sk_filter_charge(),
+if the filter we got in the memcpy() of the listener content
+just happened to be replaced by a thread changing listener BPF filter.
+
+To fix this, we need to make sure the filter refcount is not already
+zero before incrementing it again.
+
+Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
+Signed-off-by: Eric Dumazet <edumazet at google.com>
+Acked-by: Alexei Starovoitov <ast at kernel.org>
+Acked-by: Daniel Borkmann <daniel at iogearbox.net>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/core/filter.c | 15 +++++++++++++--
+ net/core/sock.c | 5 ++++-
+ 2 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 4eb4ce0..bfeedbb 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -937,20 +937,31 @@ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
+ /* try to charge the socket memory if there is space available
+ * return true on success
+ */
+-bool sk_filter_charge(struct sock *sk, struct sk_filter *fp)
++static bool __sk_filter_charge(struct sock *sk, struct sk_filter *fp)
+ {
+ u32 filter_size = bpf_prog_size(fp->prog->len);
+
+ /* same check as in sock_kmalloc() */
+ if (filter_size <= sysctl_optmem_max &&
+ atomic_read(&sk->sk_omem_alloc) + filter_size < sysctl_optmem_max) {
+- atomic_inc(&fp->refcnt);
+ atomic_add(filter_size, &sk->sk_omem_alloc);
+ return true;
+ }
+ return false;
+ }
+
++bool sk_filter_charge(struct sock *sk, struct sk_filter *fp)
++{
++ if (!atomic_inc_not_zero(&fp->refcnt))
++ return false;
++
++ if (!__sk_filter_charge(sk, fp)) {
++ sk_filter_release(fp);
++ return false;
++ }
++ return true;
++}
++
+ static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp)
+ {
+ struct sock_filter *old_prog;
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 231c38d..2a77cc5 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1528,13 +1528,16 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
+ sock_reset_flag(newsk, SOCK_DONE);
+ skb_queue_head_init(&newsk->sk_error_queue);
+
+- filter = rcu_dereference_protected(newsk->sk_filter, 1);
++ rcu_read_lock();
++ filter = rcu_dereference(sk->sk_filter);
+ if (filter != NULL)
+ /* though it's an empty new sock, the charging may fail
+ * if sysctl_optmem_max was changed between creation of
+ * original socket and cloning
+ */
+ is_charged = sk_filter_charge(newsk, filter);
++ RCU_INIT_POINTER(newsk->sk_filter, filter);
++ rcu_read_unlock();
+
+ if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
+ /* We need to make sure that we don't uncharge the new
+--
+cgit v1.1
+
+
More information about the arch-commits
mailing list