From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
"François CACHEREUL" <f.cachereul@alphalink.fr>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.10 07/54] l2tp: fix kernel panic when using IPv4-mapped IPv6 addresses
Date: Fri, 1 Nov 2013 15:03:35 -0700 [thread overview]
Message-ID: <20131101220212.154342917@linuxfoundation.org> (raw)
In-Reply-To: <20131101220211.311926234@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: François CACHEREUL <f.cachereul@alphalink.fr>
[ Upstream commit e18503f41f9b12132c95d7c31ca6ee5155e44e5c ]
IPv4 mapped addresses cause kernel panic.
The patch juste check whether the IPv6 address is an IPv4 mapped
address. If so, use IPv4 API instead of IPv6.
[ 940.026915] general protection fault: 0000 [#1]
[ 940.026915] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core pppox ppp_generic slhc loop psmouse
[ 940.026915] CPU: 0 PID: 3184 Comm: memcheck-amd64- Not tainted 3.11.0+ #1
[ 940.026915] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[ 940.026915] task: ffff880007130e20 ti: ffff88000737e000 task.ti: ffff88000737e000
[ 940.026915] RIP: 0010:[<ffffffff81333780>] [<ffffffff81333780>] ip6_xmit+0x276/0x326
[ 940.026915] RSP: 0018:ffff88000737fd28 EFLAGS: 00010286
[ 940.026915] RAX: c748521a75ceff48 RBX: ffff880000c30800 RCX: 0000000000000000
[ 940.026915] RDX: ffff88000075cc4e RSI: 0000000000000028 RDI: ffff8800060e5a40
[ 940.026915] RBP: ffff8800060e5a40 R08: 0000000000000000 R09: ffff88000075cc90
[ 940.026915] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88000737fda0
[ 940.026915] R13: 0000000000000000 R14: 0000000000002000 R15: ffff880005d3b580
[ 940.026915] FS: 00007f163dc5e800(0000) GS:ffffffff81623000(0000) knlGS:0000000000000000
[ 940.026915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 940.026915] CR2: 00000004032dc940 CR3: 0000000005c25000 CR4: 00000000000006f0
[ 940.026915] Stack:
[ 940.026915] ffff88000075cc4e ffffffff81694e90 ffff880000c30b38 0000000000000020
[ 940.026915] 11000000523c4bac ffff88000737fdb4 0000000000000000 ffff880000c30800
[ 940.026915] ffff880005d3b580 ffff880000c30b38 ffff8800060e5a40 0000000000000020
[ 940.026915] Call Trace:
[ 940.026915] [<ffffffff81356cc3>] ? inet6_csk_xmit+0xa4/0xc4
[ 940.026915] [<ffffffffa0038535>] ? l2tp_xmit_skb+0x503/0x55a [l2tp_core]
[ 940.026915] [<ffffffff812b8d3b>] ? pskb_expand_head+0x161/0x214
[ 940.026915] [<ffffffffa003e91d>] ? pppol2tp_xmit+0xf2/0x143 [l2tp_ppp]
[ 940.026915] [<ffffffffa00292e0>] ? ppp_channel_push+0x36/0x8b [ppp_generic]
[ 940.026915] [<ffffffffa00293fe>] ? ppp_write+0xaf/0xc5 [ppp_generic]
[ 940.026915] [<ffffffff8110ead4>] ? vfs_write+0xa2/0x106
[ 940.026915] [<ffffffff8110edd6>] ? SyS_write+0x56/0x8a
[ 940.026915] [<ffffffff81378ac0>] ? system_call_fastpath+0x16/0x1b
[ 940.026915] Code: 00 49 8b 8f d8 00 00 00 66 83 7c 11 02 00 74 60 49
8b 47 58 48 83 e0 fe 48 8b 80 18 01 00 00 48 85 c0 74 13 48 8b 80 78 02
00 00 <48> ff 40 28 41 8b 57 68 48 01 50 30 48 8b 54 24 08 49 c7 c1 51
[ 940.026915] RIP [<ffffffff81333780>] ip6_xmit+0x276/0x326
[ 940.026915] RSP <ffff88000737fd28>
[ 940.057945] ---[ end trace be8aba9a61c8b7f3 ]---
[ 940.058583] Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by: François CACHEREUL <f.cachereul@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_core.c | 27 +++++++++++++++++++++++----
net/l2tp/l2tp_core.h | 3 +++
2 files changed, 26 insertions(+), 4 deletions(-)
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -499,6 +499,7 @@ out:
static inline int l2tp_verify_udp_checksum(struct sock *sk,
struct sk_buff *skb)
{
+ struct l2tp_tunnel *tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
struct udphdr *uh = udp_hdr(skb);
u16 ulen = ntohs(uh->len);
__wsum psum;
@@ -507,7 +508,7 @@ static inline int l2tp_verify_udp_checks
return 0;
#if IS_ENABLED(CONFIG_IPV6)
- if (sk->sk_family == PF_INET6) {
+ if (sk->sk_family == PF_INET6 && !tunnel->v4mapped) {
if (!uh->check) {
LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n");
return 1;
@@ -1071,7 +1072,7 @@ static int l2tp_xmit_core(struct l2tp_se
/* Queue the packet to IP for output */
skb->local_df = 1;
#if IS_ENABLED(CONFIG_IPV6)
- if (skb->sk->sk_family == PF_INET6)
+ if (skb->sk->sk_family == PF_INET6 && !tunnel->v4mapped)
error = inet6_csk_xmit(skb, NULL);
else
#endif
@@ -1198,7 +1199,7 @@ int l2tp_xmit_skb(struct l2tp_session *s
/* Calculate UDP checksum if configured to do so */
#if IS_ENABLED(CONFIG_IPV6)
- if (sk->sk_family == PF_INET6)
+ if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
l2tp_xmit_ipv6_csum(sk, skb, udp_len);
else
#endif
@@ -1647,6 +1648,24 @@ int l2tp_tunnel_create(struct net *net,
if (cfg != NULL)
tunnel->debug = cfg->debug;
+#if IS_ENABLED(CONFIG_IPV6)
+ if (sk->sk_family == PF_INET6) {
+ struct ipv6_pinfo *np = inet6_sk(sk);
+
+ if (ipv6_addr_v4mapped(&np->saddr) &&
+ ipv6_addr_v4mapped(&np->daddr)) {
+ struct inet_sock *inet = inet_sk(sk);
+
+ tunnel->v4mapped = true;
+ inet->inet_saddr = np->saddr.s6_addr32[3];
+ inet->inet_rcv_saddr = np->rcv_saddr.s6_addr32[3];
+ inet->inet_daddr = np->daddr.s6_addr32[3];
+ } else {
+ tunnel->v4mapped = false;
+ }
+ }
+#endif
+
/* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
tunnel->encap = encap;
if (encap == L2TP_ENCAPTYPE_UDP) {
@@ -1655,7 +1674,7 @@ int l2tp_tunnel_create(struct net *net,
udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
udp_sk(sk)->encap_destroy = l2tp_udp_encap_destroy;
#if IS_ENABLED(CONFIG_IPV6)
- if (sk->sk_family == PF_INET6)
+ if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
udpv6_encap_enable();
else
#endif
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -189,6 +189,9 @@ struct l2tp_tunnel {
struct sock *sock; /* Parent socket */
int fd; /* Parent fd, if tunnel socket
* was created by userspace */
+#if IS_ENABLED(CONFIG_IPV6)
+ bool v4mapped;
+#endif
struct work_struct del_work;
next prev parent reply other threads:[~2013-11-01 22:39 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-11-01 22:03 [PATCH 3.10 00/54] 3.10.18-stable review Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 01/54] tcp: TSO packets automatic sizing Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 02/54] tcp: TSQ can use a dynamic limit Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 03/54] tcp: must unclone packets before mangling them Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 04/54] tcp: do not forget FIN in tcp_shifted_skb() Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 05/54] tcp: fix incorrect ca_state in tail loss probe Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 06/54] net: do not call sock_put() on TIMEWAIT sockets Greg Kroah-Hartman
2013-11-01 22:03 ` Greg Kroah-Hartman [this message]
2013-11-01 22:03 ` [PATCH 3.10 08/54] l2tp: Fix build warning with ipv6 disabled Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 09/54] net: mv643xx_eth: update statistics timer from timer context only Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 10/54] net: mv643xx_eth: fix orphaned statistics timer crash Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 11/54] net: heap overflow in __audit_sockaddr() Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 12/54] proc connector: fix info leaks Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 13/54] ipv4: fix ineffective source address selection Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 14/54] can: dev: fix nlmsg size calculation in can_get_size() Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 15/54] net: secure_seq: Fix warning when CONFIG_IPV6 and CONFIG_INET are not selected Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 16/54] xen-netback: Dont destroy the netdev until the vif is shut down Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 17/54] net: vlan: fix nlmsg size calculation in vlan_get_size() Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 18/54] vti: get rid of nf mark rule in prerouting Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 19/54] l2tp: must disable bh before calling l2tp_xmit_skb() Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 20/54] farsync: fix info leak in ioctl Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 21/54] unix_diag: fix info leak Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 22/54] connector: use nlmsg_len() to check message length Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 23/54] bnx2x: record rx queue for LRO packets Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 24/54] virtio-net: dont respond to cpu hotplug notifier if were not ready Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 25/54] virtio-net: fix the race between channels setting and refill Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 26/54] virtio-net: refill only when device is up during setting queues Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 27/54] bridge: Correctly clamp MAX forward_delay when enabling STP Greg Kroah-Hartman
2013-11-01 22:03 ` Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 28/54] net: dst: provide accessor function to dst->xfrm Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 29/54] sctp: Use software crc32 checksum when xfrm transform will happen Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 30/54] sctp: Perform software checksum if packet has to be fragmented Greg Kroah-Hartman
2013-11-01 22:03 ` [PATCH 3.10 31/54] wanxl: fix info leak in ioctl Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 32/54] be2net: pass if_id for v1 and V2 versions of TX_CREATE cmd Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 33/54] net: unix: inherit SOCK_PASS{CRED, SEC} flags from socket to fix race Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 34/54] net: fix cipso packet validation when !NETLABEL Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 35/54] inet: fix possible memory corruption with UDP_CORK and UFO Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 36/54] ipv6: always prefer rt6i_gateway if present Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 37/54] ipv6: fill rt6i_gateway with nexthop address Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 38/54] netfilter: nf_conntrack: fix rt6i_gateway checks for H.323 helper Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 39/54] ipv6: probe routes asynchronous in rt6_probe Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 40/54] davinci_emac.c: Fix IFF_ALLMULTI setup Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 41/54] ARM: 7851/1: check for number of arguments in syscall_get/set_arguments() Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 42/54] ARM: integrator: deactivate timer0 on the Integrator/CP Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 43/54] gpio/lynxpoint: check if the interrupt is enabled in IRQ handler Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 44/54] dm snapshot: fix data corruption Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 45/54] i2c: ismt: initialize DMA buffer Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 46/54] mm: fix BUG in __split_huge_page_pmd Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 47/54] ALSA: us122l: Fix pcm_usb_stream mmapping regression Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 48/54] ALSA: hda - Fix inverted internal mic not indicated on some machines Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 49/54] writeback: fix negative bdi max pause Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 50/54] wireless: radiotap: fix parsing buffer overrun Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 51/54] serial: vt8500: add missing braces Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 52/54] USB: serial: ti_usb_3410_5052: add Abbott strip port ID to combined table as well Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 53/54] USB: serial: option: add support for Inovia SEW858 device Greg Kroah-Hartman
2013-11-01 22:04 ` [PATCH 3.10 54/54] usb: serial: option: blacklist Olivetti Olicard200 Greg Kroah-Hartman
2013-11-02 2:30 ` [PATCH 3.10 00/54] 3.10.18-stable review Guenter Roeck
2013-11-02 21:32 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131101220212.154342917@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=f.cachereul@alphalink.fr \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.