linux-stable.git/net, branch v4.1.45

ipv6: Remove sit_gro_receive()

2017-10-06T00:43:20+00:00

This was backported as part of 066b300e5be4 ("tunnels: Don't apply GRO
to multiple layers of encapsulation.") but nothing uses this function,
thus resulting in this build warning:

net/ipv6/ip6_offload.c:264:25: warning: 'sit_gro_receive' defined but
not used [-Wunused-function]
 static struct sk_buff **sit_gro_receive(struct sk_buff **head,
                         ^
Just drop it for now.

Fixes: 066b300e5be4 ("tunnels: Don't apply GRO to multiple layers of encapsulation.")
Signed-off-by: Florian Fainelli 
Signed-off-by: Sasha Levin

ipv6: fix typo in fib6_net_exit()

2017-10-04T01:36:49+00:00

[ Upstream commit 32a805baf0fb70b6dbedefcd7249ac7f580f9e3b ]

IPv6 FIB should use FIB6_TABLE_HASHSZ, not FIB_TABLE_HASHSZ.

Fixes: ba1cc08d9488 ("ipv6: fix memory leak with multiple tables during netns destruction")
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

ipv6: fix memory leak with multiple tables during netns destruction

2017-10-04T01:36:49+00:00

[ Upstream commit ba1cc08d9488c94cb8d94f545305688b72a2a300 ]

fib6_net_exit only frees the main and local tables. If another table was
created with fib6_alloc_table, we leak it when the netns is destroyed.

Fix this in the same way ip_fib_net_exit cleans up tables, by walking
through the whole hashtable of fib6_table's. We can get rid of the
special cases for local and main, since they're also part of the
hashtable.

Reproducer:
    ip netns add x
    ip -net x -6 rule add from 6003:1::/64 table 100
    ip netns del x

Reported-by: Jianlin Shi 
Fixes: 58f09b78b730 ("[NETNS][IPV6] ip6_fib - make it per network namespace")
Signed-off-by: Sabrina Dubroca 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0

2017-10-04T01:36:49+00:00

[ Upstream commit 499350a5a6e7512d9ed369ed63a4244b6536f4f8 ]

When tcp_disconnect() is called, inet_csk_delack_init() sets
icsk->icsk_ack.rcv_mss to 0.
This could potentially cause tcp_recvmsg() => tcp_cleanup_rbuf() =>
__tcp_select_window() call path to have division by 0 issue.
So this patch initializes rcv_mss to TCP_MIN_MSS instead of 0.

Reported-by: Andrey Konovalov  
Signed-off-by: Wei Wang 
Signed-off-by: Eric Dumazet 
Signed-off-by: Neal Cardwell 
Signed-off-by: Yuchung Cheng 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt()

2017-10-04T01:36:48+00:00

[ Upstream commit 3de33e1ba0506723ab25734e098cf280ecc34756 ]

A packet length of exactly IPV6_MAXPLEN is allowed, we should
refuse parsing options only if the size is 64KiB or more.

While at it, remove one extra variable and one assignment which
were also introduced by the commit that introduced the size
check. Checking the sum 'offset + len' and only later adding
'len' to 'offset' doesn't provide any advantage over directly
summing to 'offset' and checking it.

Fixes: 6399f1fae4ec ("ipv6: avoid overflow of offset in ip6_find_1stfragopt")
Signed-off-by: Stefano Brivio 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

Bluetooth: Properly check L2CAP config option output buffer length

2017-10-04T01:36:47+00:00

[ Upstream commit e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 ]

Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

xfrm: policy: check policy direction value

2017-10-04T01:36:43+00:00

[ Upstream commit 7bab09631c2a303f87a7eb7e3d69e888673b9b7e ]

The 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used
as an array index. This can lead to an out-of-bound access, kernel lockup and
DoS. Add a check for the 'dir' value.

This fixes CVE-2017-11600.

References: https://bugzilla.redhat.com/show_bug.cgi?id=1474928
Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
Cc:  # v2.6.21-rc1
Reported-by: "bo Zhang" 
Signed-off-by: Vladis Dronov 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin

Bluetooth: bnep: fix possible might sleep error in bnep_session

2017-10-04T01:36:35+00:00

[ Upstream commit 25717382c1dd0ddced2059053e3ca5088665f7a5 ]

It looks like bnep_session has same pattern as the issue reported in
old rfcomm:

	while (1) {
		set_current_state(TASK_INTERRUPTIBLE);
		if (condition)
			break;
		// may call might_sleep here
		schedule();
	}
	__set_current_state(TASK_RUNNING);

Which fixed at:
	dfb2fae Bluetooth: Fix nested sleeps

So let's fix it at the same way, also follow the suggestion of:
https://lwn.net/Articles/628628/

Signed-off-by: Jeffy Chen 
Reviewed-by: Brian Norris 
Reviewed-by: AL Yu-Chen Cho 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Sasha Levin

Bluetooth: cmtp: fix possible might sleep error in cmtp_session

2017-10-04T01:36:35+00:00

[ Upstream commit f06d977309d09253c744e54e75c5295ecc52b7b4 ]

It looks like cmtp_session has same pattern as the issue reported in
old rfcomm:

	while (1) {
		set_current_state(TASK_INTERRUPTIBLE);
		if (condition)
			break;
		// may call might_sleep here
		schedule();
	}
	__set_current_state(TASK_RUNNING);

Which fixed at:
	dfb2fae Bluetooth: Fix nested sleeps

So let's fix it at the same way, also follow the suggestion of:
https://lwn.net/Articles/628628/

Signed-off-by: Jeffy Chen 
Reviewed-by: Brian Norris 
Reviewed-by: AL Yu-Chen Cho 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Sasha Levin

Bluetooth: hidp: fix possible might sleep error in hidp_session_thread

2017-10-04T01:36:35+00:00

[ Upstream commit 5da8e47d849d3d37b14129f038782a095b9ad049 ]

It looks like hidp_session_thread has same pattern as the issue reported in
old rfcomm:

	while (1) {
		set_current_state(TASK_INTERRUPTIBLE);
		if (condition)
			break;
		// may call might_sleep here
		schedule();
	}
	__set_current_state(TASK_RUNNING);

Which fixed at:
	dfb2fae Bluetooth: Fix nested sleeps

So let's fix it at the same way, also follow the suggestion of:
https://lwn.net/Articles/628628/

Signed-off-by: Jeffy Chen 
Tested-by: AL Yu-Chen Cho 
Tested-by: Rohit Vaswani 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Sasha Levin