AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity
388cebfa73
kernel_optimize_test/net/dccp
History
Lin, Zhenpeng 6c3cb65d56 dccp: don't duplicate ccid when cloning dccp sock 
commit d9ea761fdd197351890418acd462c51f241014a7 upstream.

Commit 2677d20677 ("dccp: don't free ccid2_hc_tx_sock ...") fixed
a UAF but reintroduced CVE-2017-6074.

When the sock is cloned, two dccps_hc_tx_ccid will reference to the
same ccid. So one can free the ccid object twice from two socks after
cloning.

This issue was found by "Hadar Manor" as well and assigned with
CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port
the patch from Ubuntu to fix it.

The patch prevents cloned socks from referencing the same ccid.

Fixes: 2677d20677 ("dccp: don't free ccid2_hc_tx_sock ...")
Signed-off-by: Zhenpeng Lin <zplin@psu.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-22 12:27:56 +02:00
..
ccids net: dccp: Convert to use the preferred fallthrough macro 2020-08-22 12:38:34 -07:00
ackvec.c net: dccp: delete repeated words 2020-08-24 17:31:20 -07:00
ackvec.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
ccid.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
ccid.h net: dccp: Replace zero-length array with flexible-array member 2020-02-28 12:08:37 -08:00
dccp.h dccp: add do-while-0 stubs for dccp_pr_debug macros 2021-08-26 08:35:41 -04:00
diag.c inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data 2020-02-27 18:50:19 -08:00
feat.c net: dccp: Convert to use the preferred fallthrough macro 2020-08-22 12:38:34 -07:00
feat.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
input.c net: dccp: Convert to use the preferred fallthrough macro 2020-08-22 12:38:34 -07:00
ipv4.c tcp: fix race condition when creating child sockets from syncookies 2020-11-23 16:32:33 -08:00
ipv6.c ipv6: weaken the v4mapped source check 2021-03-30 14:32:01 +02:00
ipv6.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
Kconfig dccp: Replace HTTP links with HTTPS ones 2020-07-13 11:54:07 -07:00
Makefile net: dccp: Remove dccpprobe module 2018-01-02 14:27:30 -05:00
minisocks.c dccp: don't duplicate ccid when cloning dccp sock 2021-09-22 12:27:56 +02:00
options.c net: dccp: Convert to use the preferred fallthrough macro 2020-08-22 12:38:34 -07:00
output.c net: dccp: Convert to use the preferred fallthrough macro 2020-08-22 12:38:34 -07:00
proto.c net: dccp: Convert to use the preferred fallthrough macro 2020-08-22 12:38:34 -07:00
qpolicy.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 389 2019-06-05 17:37:11 +02:00
sysctl.c proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
timer.c inet: remove icsk_ack.blocked 2020-09-30 14:21:30 -07:00
trace.h net: dccp: Add DCCP sendmsg trace event 2018-01-02 14:27:30 -05:00