rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

CVE-2012-4565 net: divide by zero in tcp algorithm illinois (rhbz 871848 871923)

This commit is contained in:
Josh Boyer 2012-10-31 13:58:56 -04:00
parent 3c9b3f75ac
commit 81f7c502c4
2 changed files with 126 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
kernel.spec
View File

@ -707,6 +707,9 @@ Patch22089: 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch
Patch22090: 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch
Patch22091: 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch
#rhbz 871923 871848 CVE-2012-4565
Patch22092: net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch
# Debug patches
Patch30000: weird-root-dentry-name-debug.patch
Patch30010: debug-808990.patch
@ -1339,6 +1342,9 @@ ApplyPatch 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch
ApplyPatch 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch
ApplyPatch 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch
#rhbz 871923 871848 CVE-2012-4565
ApplyPatch net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch
# END OF PATCH APPLICATIONS
%endif
@ -2039,6 +2045,9 @@ fi
# and build.
%changelog
* Wed Oct 30 2012 Josh Boyer <jwboyer@redhat.com>
- CVE-2012-4565 net: divide by zero in tcp algorithm illinois (rhbz 871848 871923)
* Mon Oct 29 2012 Justin M. Forbes <jforbes@redhat.com> 3.6.4-1
- Linux 3.6.4

117
net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch Normal file
View File

@ -0,0 +1,117 @@
Path: news.gmane.org!not-for-mail
From: Jesper Dangaard Brouer <brouer@redhat.com>
Newsgroups: gmane.linux.network
Subject: [net PATCH V2] net: fix divide by zero in tcp algorithm illinois
Date: Wed, 31 Oct 2012 13:45:32 +0100
Lines: 63
Approved: news@gmane.org
Message-ID: <20121031124318.30915.32293.stgit@dragon>
NNTP-Posting-Host: plane.gmane.org
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
X-Trace: ger.gmane.org 1351687472 19921 80.91.229.3 (31 Oct 2012 12:44:32 GMT)
X-Complaints-To: usenet@ger.gmane.org
NNTP-Posting-Date: Wed, 31 Oct 2012 12:44:32 +0000 (UTC)
Cc: Jesper Dangaard Brouer <brouer@redhat.com>, netdev@vger.kernel.org,
Petr Matousek <pmatouse@redhat.com>,
Stephen Hemminger <shemminger@vyatta.com>,
Eric Dumazet <eric.dumazet@gmail.com>
To: "David S. Miller" <davem@davemloft.net>
Original-X-From: netdev-owner@vger.kernel.org Wed Oct 31 13:44:40 2012
Return-path: <netdev-owner@vger.kernel.org>
Envelope-to: linux-netdev-2@plane.gmane.org
Original-Received: from vger.kernel.org ([209.132.180.67])
by plane.gmane.org with esmtp (Exim 4.69)
(envelope-from <netdev-owner@vger.kernel.org>)
id 1TTXex-0002V3-Qk
for linux-netdev-2@plane.gmane.org; Wed, 31 Oct 2012 13:44:40 +0100
Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S932565Ab2JaMo0 (ORCPT <rfc822;linux-netdev-2@m.gmane.org>);
Wed, 31 Oct 2012 08:44:26 -0400
Original-Received: from mx1.redhat.com ([209.132.183.28]:57345 "EHLO mx1.redhat.com"
rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
id S1751941Ab2JaMoZ (ORCPT <rfc822;netdev@vger.kernel.org>);
Wed, 31 Oct 2012 08:44:25 -0400
Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q9VCiOkC014655
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
Wed, 31 Oct 2012 08:44:24 -0400
Original-Received: from dragon.localdomain (ovpn-116-61.ams2.redhat.com [10.36.116.61])
by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q9VCiMuW008440;
Wed, 31 Oct 2012 08:44:23 -0400
Original-Received: from [127.0.0.1] (localhost [IPv6:::1])
by dragon.localdomain (Postfix) with ESMTP id 416D0E40666;
Wed, 31 Oct 2012 13:45:32 +0100 (CET)
User-Agent: StGIT/0.14.3
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12
Original-Sender: netdev-owner@vger.kernel.org
Precedence: bulk
List-ID: <netdev.vger.kernel.org>
X-Mailing-List: netdev@vger.kernel.org
Xref: news.gmane.org gmane.linux.network:247871
Archived-At: <http://permalink.gmane.org/gmane.linux.network/247871>
Reading TCP stats when using TCP Illinois congestion control algorithm
can cause a divide by zero kernel oops.
The division by zero occur in tcp_illinois_info() at:
do_div(t, ca->cnt_rtt);
where ca->cnt_rtt can become zero (when rtt_reset is called)
Steps to Reproduce:
1. Register tcp_illinois:
# sysctl -w net.ipv4.tcp_congestion_control=illinois
2. Monitor internal TCP information via command "ss -i"
# watch -d ss -i
3. Establish new TCP conn to machine
Either it fails at the initial conn, or else it needs to wait
for a loss or a reset.
This is only related to reading stats. The function avg_delay() also
performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its
calling point in update_params(). Thus, simply fix tcp_illinois_info().
Function tcp_illinois_info() / get_info() is called without
socket lock. Thus, eliminate any race condition on ca->cnt_rtt
by using a local stack variable. Simply reuse info.tcpv_rttcnt,
as its already set to ca->cnt_rtt.
Function avg_delay() is not affected by this race condition, as
its called with the socket lock.
Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
---
V2:
Address Eric Dumazets input:
- Save 2 bytes of stack, by using info.tcpv_rttcnt.
- Help compiler, and define "u64 t" inside if() lexical scope.
net/ipv4/tcp_illinois.c | 8 +++++---
1 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 813b43a..834857f 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
.tcpv_rttcnt = ca->cnt_rtt,
.tcpv_minrtt = ca->base_rtt,
};
- u64 t = ca->sum_rtt;
- do_div(t, ca->cnt_rtt);
- info.tcpv_rtt = t;
+ if (info.tcpv_rttcnt > 0) {
+ u64 t = ca->sum_rtt;
+ do_div(t, info.tcpv_rttcnt);
+ info.tcpv_rtt = t;
+ }
nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
}
}