1. 02 11月, 2017 38 次提交
  2. 01 11月, 2017 2 次提交
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 4f2ba5dc
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
      
       1) Fix refcounting in xfrm_bundle_lookup() when using a dummy bundle,
          from Steffen Klassert.
      
       2) Fix crypto header handling in rx data frames in ath10k driver, from
          Vasanthakumar Thiagarajan.
      
       3) Fix use after free of qdisc when we defer tcp_chain_flush() to a
          workqueue. From Cong Wang.
      
       4) Fix double free in lapbether driver, from Pan Bian.
      
       5) Sanitize TUNSETSNDBUF values, from Craig Gallek.
      
       6) Fix refcounting when addrconf_permanent_addr() calls
          ipv6_del_addr(). From Eric Dumazet.
      
       7) Fix MTU probing bug in TCP that goes back to 2007, from Eric
          Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        tcp: fix tcp_mtu_probe() vs highest_sack
        ipv6: addrconf: increment ifp refcount before ipv6_del_addr()
        tun/tap: sanitize TUNSETSNDBUF input
        mlxsw: i2c: Fix buffer increment counter for write transaction
        mlxsw: reg: Add high and low temperature thresholds
        MAINTAINERS: Remove Yotam from mlxfw
        MAINTAINERS: Update Yotam's E-mail
        net: hns: set correct return value
        net: lapbether: fix double free
        bpf: remove SK_REDIRECT from UAPI
        net: phy: marvell: Only configure RGMII delays when using RGMII
        xfrm: Fix GSO for IPsec with GRE tunnel.
        tc-testing: fix arg to ip command: -s -> -n
        net_sched: remove tcf_block_put_deferred()
        l2tp: hold tunnel in pppol2tp_connect()
        Revert "ath10k: fix napi_poll budget overflow"
        ath10k: rebuild crypto header in rx data frames
        wcn36xx: Remove unnecessary rcu_read_unlock in wcn36xx_bss_info_changed
        xfrm: Clear sk_dst_cache when applying per-socket policy.
        xfrm: Fix xfrm_dst_cache memleak
      4f2ba5dc
    • V
      x86/mm: fix use-after-free of vma during userfaultfd fault · cb0631fd
      Vlastimil Babka 提交于
      Syzkaller with KASAN has reported a use-after-free of vma->vm_flags in
      __do_page_fault() with the following reproducer:
      
        mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
        mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
        r0 = userfaultfd(0x0)
        ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000-0x18)={0xaa, 0x0, 0x0})
        ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000019000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1, 0x0})
        r1 = gettid()
        syz_open_dev$evdev(&(0x7f0000013000-0x12)="2f6465762f696e7075742f6576656e742300", 0x0, 0x0)
        tkill(r1, 0x7)
      
      The vma should be pinned by mmap_sem, but handle_userfault() might (in a
      return to userspace scenario) release it and then acquire again, so when
      we return to __do_page_fault() (with other result than VM_FAULT_RETRY),
      the vma might be gone.
      
      Specifically, per Andrea the scenario is
       "A return to userland to repeat the page fault later with a
        VM_FAULT_NOPAGE retval (potentially after handling any pending signal
        during the return to userland). The return to userland is identified
        whenever FAULT_FLAG_USER|FAULT_FLAG_KILLABLE are both set in
        vmf->flags"
      
      However, since commit a3c4fb7c ("x86/mm: Fix fault error path using
      unsafe vma pointer") there is a vma_pkey() read of vma->vm_flags after
      that point, which can thus become use-after-free.  Fix this by moving
      the read before calling handle_mm_fault().
      Reported-by: Nsyzbot <bot+6a5269ce759a7bb12754ed9622076dc93f65a1f6@syzkaller.appspotmail.com>
      Reported-by: NDmitry Vyukov <dvyukov@google.com>
      Suggested-by: NKirill A. Shutemov <kirill@shutemov.name>
      Fixes: 3c4fb7c9c2e ("x86/mm: Fix fault error path using unsafe vma pointer")
      Reviewed-by: NAndrea Arcangeli <aarcange@redhat.com>
      Signed-off-by: NVlastimil Babka <vbabka@suse.cz>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      cb0631fd