CVE-2013-0290 net: infinite loop in __skb_recv_datagram (rhbz 911479 911473)
This commit is contained in:
parent
6a4938fe99
commit
381fac519a
11
kernel.spec
11
kernel.spec
|
@ -54,7 +54,7 @@ Summary: The Linux kernel
|
|||
# For non-released -rc kernels, this will be appended after the rcX and
|
||||
# gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
|
||||
#
|
||||
%global baserelease 101
|
||||
%global baserelease 102
|
||||
%global fedora_build %{baserelease}
|
||||
|
||||
# base_sublevel is the kernel version we're starting with and patching
|
||||
|
@ -765,6 +765,9 @@ Patch22254: xen-dont-assume-ds-is-usable-in-xen_iret-for-32-bit-PVOPS.patch
|
|||
#rhbz 909591
|
||||
Patch22255: usb-cypress-supertop.patch
|
||||
|
||||
#rhbz 911479 911473 CVE-2013-0290
|
||||
Patch22256: net-fix-infinite-loop-in-__skb_recv_datagram.patch
|
||||
|
||||
Patch23000: silence-brcmsmac-warning.patch
|
||||
|
||||
Patch23100: validate-pud-largepage.patch
|
||||
|
@ -1484,6 +1487,9 @@ ApplyPatch xen-dont-assume-ds-is-usable-in-xen_iret-for-32-bit-PVOPS.patch
|
|||
#rhbz 909591
|
||||
ApplyPatch usb-cypress-supertop.patch
|
||||
|
||||
#rhbz 911479 911473 CVE-2013-0290
|
||||
ApplyPatch net-fix-infinite-loop-in-__skb_recv_datagram.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
@ -2339,6 +2345,9 @@ fi
|
|||
# '-' | |
|
||||
# '-'
|
||||
%changelog
|
||||
* Fri Feb 15 2013 Josh Boyer <jwboyer@redhat.com>
|
||||
- CVE-2013-0290 net: infinite loop in __skb_recv_datagram (rhbz 911479 911473)
|
||||
|
||||
* Thu Feb 14 2013 Justin M. Forbes <jforbes@redhat.com> - 3.7.8-101
|
||||
- Linux v3.7.8
|
||||
|
||||
|
|
|
@ -0,0 +1,53 @@
|
|||
From 77c1090f94d1b0b5186fb13a1b71b47b1343f87f Mon Sep 17 00:00:00 2001
|
||||
From: Eric Dumazet <edumazet@google.com>
|
||||
Date: Tue, 12 Feb 2013 06:16:53 +0000
|
||||
Subject: [PATCH] net: fix infinite loop in __skb_recv_datagram()
|
||||
|
||||
Tommi was fuzzing with trinity and reported the following problem :
|
||||
|
||||
commit 3f518bf745 (datagram: Add offset argument to __skb_recv_datagram)
|
||||
missed that a raw socket receive queue can contain skbs with no payload.
|
||||
|
||||
We can loop in __skb_recv_datagram() with MSG_PEEK mode, because
|
||||
wait_for_packet() is not prepared to skip these skbs.
|
||||
|
||||
[ 83.541011] INFO: rcu_sched detected stalls on CPUs/tasks: {}
|
||||
(detected by 0, t=26002 jiffies, g=27673, c=27672, q=75)
|
||||
[ 83.541011] INFO: Stall ended before state dump start
|
||||
[ 108.067010] BUG: soft lockup - CPU#0 stuck for 22s! [trinity-child31:2847]
|
||||
...
|
||||
[ 108.067010] Call Trace:
|
||||
[ 108.067010] [<ffffffff818cc103>] __skb_recv_datagram+0x1a3/0x3b0
|
||||
[ 108.067010] [<ffffffff818cc33d>] skb_recv_datagram+0x2d/0x30
|
||||
[ 108.067010] [<ffffffff819ed43d>] rawv6_recvmsg+0xad/0x240
|
||||
[ 108.067010] [<ffffffff818c4b04>] sock_common_recvmsg+0x34/0x50
|
||||
[ 108.067010] [<ffffffff818bc8ec>] sock_recvmsg+0xbc/0xf0
|
||||
[ 108.067010] [<ffffffff818bf31e>] sys_recvfrom+0xde/0x150
|
||||
[ 108.067010] [<ffffffff81ca4329>] system_call_fastpath+0x16/0x1b
|
||||
|
||||
Reported-by: Tommi Rantala <tt.rantala@gmail.com>
|
||||
Tested-by: Tommi Rantala <tt.rantala@gmail.com>
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Cc: Pavel Emelyanov <xemul@parallels.com>
|
||||
Acked-by: Pavel Emelyanov <xemul@parallels.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
net/core/datagram.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/net/core/datagram.c b/net/core/datagram.c
|
||||
index 0337e2b..368f9c3 100644
|
||||
--- a/net/core/datagram.c
|
||||
+++ b/net/core/datagram.c
|
||||
@@ -187,7 +187,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
|
||||
skb_queue_walk(queue, skb) {
|
||||
*peeked = skb->peeked;
|
||||
if (flags & MSG_PEEK) {
|
||||
- if (*off >= skb->len) {
|
||||
+ if (*off >= skb->len && skb->len) {
|
||||
*off -= skb->len;
|
||||
continue;
|
||||
}
|
||||
--
|
||||
1.8.1.2
|
||||
|
Loading…
Reference in New Issue