Home Home > GIT Browse > SLE12-SP4
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-07-18 08:26:13 +0200
committerJiri Slaby <jslaby@suse.cz>2019-07-18 09:30:37 +0200
commit07894ad6aec7c0480055b2f47f907233f3dc996c (patch)
treee9aac8031e39b5946d9123d4e1b76aee1c19022b
parent13b9869088f335db7485982fe894e7fa7b946c9b (diff)
ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
(networking-stable-19_06_09).
-rw-r--r--patches.suse/ipv6-fix-EFAULT-on-sendto-with-icmpv6-and-hdrincl.patch55
-rw-r--r--series.conf1
2 files changed, 56 insertions, 0 deletions
diff --git a/patches.suse/ipv6-fix-EFAULT-on-sendto-with-icmpv6-and-hdrincl.patch b/patches.suse/ipv6-fix-EFAULT-on-sendto-with-icmpv6-and-hdrincl.patch
new file mode 100644
index 0000000000..2e53d7e02a
--- /dev/null
+++ b/patches.suse/ipv6-fix-EFAULT-on-sendto-with-icmpv6-and-hdrincl.patch
@@ -0,0 +1,55 @@
+From: Olivier Matz <olivier.matz@6wind.com>
+Date: Thu, 6 Jun 2019 09:15:19 +0200
+Subject: ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
+Git-commit: b9aa52c4cb457e7416cc0c95f475e72ef4a61336
+Patch-mainline: 5.2-rc4
+References: networking-stable-19_06_09
+
+The following code returns EFAULT (Bad address):
+
+ s = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
+ setsockopt(s, SOL_IPV6, IPV6_HDRINCL, 1);
+ sendto(ipv6_icmp6_packet, addr); /* returns -1, errno = EFAULT */
+
+The IPv4 equivalent code works. A workaround is to use IPPROTO_RAW
+instead of IPPROTO_ICMPV6.
+
+The failure happens because 2 bytes are eaten from the msghdr by
+rawv6_probe_proto_opt() starting from commit 19e3c66b52ca ("ipv6
+equivalent of "ipv4: Avoid reading user iov twice after
+raw_probe_proto_opt""), but at that time it was not a problem because
+IPV6_HDRINCL was not yet introduced.
+
+Only eat these 2 bytes if hdrincl == 0.
+
+Fixes: 715f504b1189 ("ipv6: add IPV6_HDRINCL option for raw sockets")
+Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
+Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv6/raw.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -894,11 +894,14 @@ static int rawv6_sendmsg(struct sock *sk
+ opt = ipv6_fixup_options(&opt_space, opt);
+
+ fl6.flowi6_proto = proto;
+- rfv.msg = msg;
+- rfv.hlen = 0;
+- err = rawv6_probe_proto_opt(&rfv, &fl6);
+- if (err)
+- goto out;
++
++ if (!hdrincl) {
++ rfv.msg = msg;
++ rfv.hlen = 0;
++ err = rawv6_probe_proto_opt(&rfv, &fl6);
++ if (err)
++ goto out;
++ }
+
+ if (!ipv6_addr_any(daddr))
+ fl6.daddr = *daddr;
diff --git a/series.conf b/series.conf
index ca6bc708a5..644fda855c 100644
--- a/series.conf
+++ b/series.conf
@@ -22712,6 +22712,7 @@
patches.suse/Fix-memory-leak-in-sctp_process_init.patch
patches.suse/ethtool-fix-potential-userspace-buffer-overflow.patch
patches.suse/ipv6-use-READ_ONCE-for-inet-hdrincl-as-in-ipv4.patch
+ patches.suse/ipv6-fix-EFAULT-on-sendto-with-icmpv6-and-hdrincl.patch
patches.drivers/net-mvpp2-Use-strscpy-to-handle-stat-strings.patch
patches.fixes/pktgen-do-not-sleep-with-the-thread-lock-held.patch
patches.drivers/hwmon-core-add-thermal-sensors-only-if-dev-of_node-i.patch