From patchwork Tue Oct 25 15:54:01 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 121725 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 011311007D9 for ; Wed, 26 Oct 2011 02:54:22 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1RIjKM-0005Kd-7r; Tue, 25 Oct 2011 15:54:10 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1RIjKH-0005KE-Fu for kernel-team@lists.ubuntu.com; Tue, 25 Oct 2011 15:54:05 +0000 Received: from 212-139-208-147.dynamic.dsl.as9105.com ([212.139.208.147] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1RIjKH-0003XD-BY; Tue, 25 Oct 2011 15:54:05 +0000 From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [hardy CVE 1/1] gre: fix netns vs proto registration ordering Date: Tue, 25 Oct 2011 16:54:01 +0100 Message-Id: <1319558042-29483-2-git-send-email-apw@canonical.com> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1319558042-29483-1-git-send-email-apw@canonical.com> References: <1319558042-29483-1-git-send-email-apw@canonical.com> Cc: Andy Whitcroft X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Alexey Dobriyan GRE protocol receive hook can be called right after protocol addition is done. If netns stuff is not yet initialized, we're going to oops in net_generic(). This is remotely oopsable if ip_gre is compiled as module and packet comes at unfortunate moment of module loading. Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller (backport from commit c2892f02712e9516d72841d5c019ed6916329794) CVE-2011-1767 BugLink: http://bugs.launchpad.net/bugs/869213 Signed-off-by: Andy Whitcroft --- net/ipv4/ip_gre.c | 18 ++++++++++-------- 1 files changed, 10 insertions(+), 8 deletions(-) diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c index 4b93f32..73da30a 100644 --- a/net/ipv4/ip_gre.c +++ b/net/ipv4/ip_gre.c @@ -1268,28 +1268,30 @@ static int __init ipgre_init(void) printk(KERN_INFO "GRE over IPv4 tunneling driver\n"); - if (inet_add_protocol(&ipgre_protocol, IPPROTO_GRE) < 0) { - printk(KERN_INFO "ipgre init: can't add protocol\n"); - return -EAGAIN; - } - ipgre_fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "gre0", ipgre_tunnel_setup); if (!ipgre_fb_tunnel_dev) { err = -ENOMEM; - goto err1; + goto out;; } ipgre_fb_tunnel_dev->init = ipgre_fb_tunnel_init; if ((err = register_netdev(ipgre_fb_tunnel_dev))) + goto err1; + + if (inet_add_protocol(&ipgre_protocol, IPPROTO_GRE) < 0) { + printk(KERN_INFO "ipgre init: can't add protocol\n"); + err = -EAGAIN; goto err2; + } + out: return err; err2: - free_netdev(ipgre_fb_tunnel_dev); + unregister_netdev(ipgre_fb_tunnel_dev); err1: - inet_del_protocol(&ipgre_protocol, IPPROTO_GRE); + free_netdev(ipgre_fb_tunnel_dev); goto out; }