]> www.infradead.org Git - users/jedix/linux-maple.git/commit
net: ipv4: fix for a race condition in raw_sendmsg
authorMohamed Ghannam <simo.ghannam@gmail.com>
Sun, 10 Dec 2017 03:50:58 +0000 (03:50 +0000)
committerTim Tianyang Chen <tianyang.chen@oracle.com>
Tue, 16 Jan 2018 20:49:51 +0000 (12:49 -0800)
commit4ad9f0b5e39ea7399c6391c7abcbe4249c1c6552
tree4c3260ed24e9379e1e3b2d8474e304525ea30691
parent2d9d922a00c73bb52df7d6b4b8d5ea5e2362361d
net: ipv4: fix for a race condition in raw_sendmsg

inet->hdrincl is racy, and could lead to uninitialized stack pointer
usage, so its value should be read only once.

Fixes: c008ba5bdc9f ("ipv4: Avoid reading user iov twice after raw_probe_proto_opt")
Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 8f659a03a0ba9289b9aeb9b4470e6fb263d6f483)

Orabug: 27390679
CVE: CVE-2017-17712

Signed-off-by: Tim Tianyang Chen <tianyang.chen@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
 Conflicts:
net/ipv4/raw.c
net/ipv4/raw.c