From patchwork Thu Oct 27 14:08:49 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 122162 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 5EE141007DD for ; Fri, 28 Oct 2011 01:09:13 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1RJQdi-0003O6-Ge; Thu, 27 Oct 2011 14:09:02 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1RJQda-0003Mc-3l for kernel-team@lists.ubuntu.com; Thu, 27 Oct 2011 14:08:54 +0000 Received: from 212-139-208-147.dynamic.dsl.as9105.com ([212.139.208.147] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1RJQdZ-0003HH-SS; Thu, 27 Oct 2011 14:08:54 +0000 From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [hardy CVE 1/1] tunnels: fix netns vs proto registration ordering Date: Thu, 27 Oct 2011 15:08:49 +0100 Message-Id: <1319724531-6686-2-git-send-email-apw@canonical.com> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1319724531-6686-1-git-send-email-apw@canonical.com> References: <1319724531-6686-1-git-send-email-apw@canonical.com> Cc: Andy Whitcroft X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Alexey Dobriyan Same stuff as in ip_gre patch: receive hook can be called before netns setup is done, oopsing in net_generic(). Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller (backported from commit d5aa407f59f5b83d2c50ec88f5bf56d40f1f8978) CVE-2011-1768 BugLink: http://bugs.launchpad.net/bugs/869215 Signed-off-by: Andy Whitcroft --- net/ipv4/ipip.c | 18 ++++++++++-------- net/ipv6/ip6_tunnel.c | 33 +++++++++++++++++---------------- net/ipv6/sit.c | 19 ++++++++++--------- net/ipv6/xfrm6_tunnel.c | 18 +++++++++--------- 4 files changed, 46 insertions(+), 42 deletions(-) diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c index 8c2b2b0..44446fd 100644 --- a/net/ipv4/ipip.c +++ b/net/ipv4/ipip.c @@ -863,29 +863,31 @@ static int __init ipip_init(void) printk(banner); - if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) { - printk(KERN_INFO "ipip init: can't register tunnel\n"); - return -EAGAIN; - } - ipip_fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "tunl0", ipip_tunnel_setup); if (!ipip_fb_tunnel_dev) { err = -ENOMEM; - goto err1; + goto out; } ipip_fb_tunnel_dev->init = ipip_fb_tunnel_init; if ((err = register_netdev(ipip_fb_tunnel_dev))) + goto err1; + + if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) { + printk(KERN_INFO "ipip init: can't register tunnel\n"); + err = -EAGAIN; goto err2; + } + out: return err; err2: - free_netdev(ipip_fb_tunnel_dev); + unregister_netdev(ipip_fb_tunnel_dev); err1: - xfrm4_tunnel_deregister(&ipip_handler, AF_INET); + free_netdev(ipip_fb_tunnel_dev); goto out; } diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 81941a1..c4e3dd0 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1396,10 +1396,22 @@ static int __init ip6_tunnel_init(void) { int err; + ip6_fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6tnl0", + ip6_tnl_dev_setup); + if (!ip6_fb_tnl_dev) { + err = -ENOMEM; + goto out; + } + ip6_fb_tnl_dev->init = ip6_fb_tnl_dev_init; + + if ((err = register_netdev(ip6_fb_tnl_dev))) { + goto free_netdev; + } + if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) { printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n"); err = -EAGAIN; - goto out; + goto unreg_netdev; } if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) { @@ -1407,24 +1419,13 @@ static int __init ip6_tunnel_init(void) err = -EAGAIN; goto unreg_ip4ip6; } - ip6_fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6tnl0", - ip6_tnl_dev_setup); - - if (!ip6_fb_tnl_dev) { - err = -ENOMEM; - goto fail; - } - ip6_fb_tnl_dev->init = ip6_fb_tnl_dev_init; - - if ((err = register_netdev(ip6_fb_tnl_dev))) { - free_netdev(ip6_fb_tnl_dev); - goto fail; - } return 0; -fail: - xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6); unreg_ip4ip6: xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET); +unreg_netdev: + unregister_netdev(ip6_fb_tnl_dev); +free_netdev: + free_netdev(ip6_fb_tnl_dev); out: return err; } diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index bd22f64..3e2ce4a 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -827,29 +827,30 @@ static int __init sit_init(void) printk(KERN_INFO "IPv6 over IPv4 tunneling driver\n"); - if (xfrm4_tunnel_register(&sit_handler, AF_INET6) < 0) { - printk(KERN_INFO "sit init: Can't add protocol\n"); - return -EAGAIN; - } - ipip6_fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "sit0", ipip6_tunnel_setup); if (!ipip6_fb_tunnel_dev) { err = -ENOMEM; - goto err1; + goto out; } ipip6_fb_tunnel_dev->init = ipip6_fb_tunnel_init; - if ((err = register_netdev(ipip6_fb_tunnel_dev))) + if ((err = register_netdev(ipip6_fb_tunnel_dev))) + goto err1; + + if (xfrm4_tunnel_register(&sit_handler, AF_INET6) < 0) { + printk(KERN_INFO "sit init: Can't add protocol\n"); + err = -EAGAIN; goto err2; + } out: return err; err2: - free_netdev(ipip6_fb_tunnel_dev); + unregister_netdev(ipip6_fb_tunnel_dev); err1: - xfrm4_tunnel_deregister(&sit_handler, AF_INET6); + free_netdev(ipip6_fb_tunnel_dev); goto out; } diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c index fae90ff..556491b 100644 --- a/net/ipv6/xfrm6_tunnel.c +++ b/net/ipv6/xfrm6_tunnel.c @@ -343,22 +343,22 @@ static struct xfrm6_tunnel xfrm46_tunnel_handler = { static int __init xfrm6_tunnel_init(void) { - if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0) + if (xfrm6_tunnel_spi_init() < 0) return -EAGAIN; - - if (xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6)) { - xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); + + if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0) { + xfrm6_tunnel_spi_fini(); return -EAGAIN; } - if (xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET)) { - xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); + if (xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6)) { xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); + xfrm6_tunnel_spi_fini(); return -EAGAIN; } - if (xfrm6_tunnel_spi_init() < 0) { - xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET); + if (xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET)) { xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); + xfrm6_tunnel_spi_fini(); return -EAGAIN; } return 0; @@ -366,10 +366,10 @@ static int __init xfrm6_tunnel_init(void) static void __exit xfrm6_tunnel_fini(void) { - xfrm6_tunnel_spi_fini(); xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET); xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); + xfrm6_tunnel_spi_fini(); } module_init(xfrm6_tunnel_init);