From patchwork Fri Jul 22 17:42:34 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 106348 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id E0041B6F80 for ; Sat, 23 Jul 2011 03:43:12 +1000 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1QkJkR-0001CC-RG; Fri, 22 Jul 2011 17:42:51 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1QkJkQ-0001Bh-JE for kernel-team@lists.ubuntu.com; Fri, 22 Jul 2011 17:42:50 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1QkJkQ-0005Eq-HW for ; Fri, 22 Jul 2011 17:42:50 +0000 Received: from [85.210.144.167] (helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1QkJkQ-0002BN-8N for kernel-team@lists.ubuntu.com; Fri, 22 Jul 2011 17:42:50 +0000 From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [lucid/fsl-imx51 CVE 05/12] udp: multicast RX should increment SNMP/sk_drops counter in allocation failures CVE-2010-4251 Date: Fri, 22 Jul 2011 18:42:34 +0100 Message-Id: <1311356561-11988-6-git-send-email-apw@canonical.com> X-Mailer: git-send-email 1.7.4.1 In-Reply-To: <1311356561-11988-1-git-send-email-apw@canonical.com> References: <1311356561-11988-1-git-send-email-apw@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Eric Dumazet BugLink: http://bugs.launchpad.net/bugs/807462 When skb_clone() fails, we should increment sk_drops and SNMP counters. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller (cherry picked from commit f6b8f32ca71406de718391369490f6b1e81fe0bb) Signed-off-by: Paolo Pisati Signed-off-by: Tim Gardner Signed-off-by: Andy Whitcroft --- net/ipv4/udp.c | 12 +++++++++++- net/ipv6/udp.c | 8 +++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 9715a30..6aa6c1c 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1179,12 +1179,22 @@ static void flush_stack(struct sock **stack, unsigned int count, { unsigned int i; struct sk_buff *skb1 = NULL; + struct sock *sk; for (i = 0; i < count; i++) { + sk = stack[i]; if (likely(skb1 == NULL)) skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC); - if (skb1 && udp_queue_rcv_skb(stack[i], skb1) <= 0) + if (!skb1) { + atomic_inc(&sk->sk_drops); + UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS, + IS_UDPLITE(sk)); + UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, + IS_UDPLITE(sk)); + } + + if (skb1 && udp_queue_rcv_skb(sk, skb1) <= 0) skb1 = NULL; } if (unlikely(skb1)) diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 1d0f07f..8af66ad 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -450,14 +450,20 @@ static void flush_stack(struct sock **stack, unsigned int count, for (i = 0; i < count; i++) { skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC); + sk = stack[i]; if (skb1) { - sk = stack[i]; bh_lock_sock(sk); if (!sock_owned_by_user(sk)) udpv6_queue_rcv_skb(sk, skb1); else sk_add_backlog(sk, skb1); bh_unlock_sock(sk); + } else { + atomic_inc(&sk->sk_drops); + UDP6_INC_STATS_BH(sock_net(sk), + UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk)); + UDP6_INC_STATS_BH(sock_net(sk), + UDP_MIB_INERRORS, IS_UDPLITE(sk)); } } }