linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Guillaume Nault <g.nault@alphalink.fr>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 25/36] ppp: prevent unregistered channels from connecting to PPP units
Date: Fri,  9 Mar 2018 16:18:41 -0800	[thread overview]
Message-ID: <20180310001808.741475823@linuxfoundation.org> (raw)
In-Reply-To: <20180310001807.213987241@linuxfoundation.org>

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guillaume Nault <g.nault@alphalink.fr>


[ Upstream commit 77f840e3e5f09c6d7d727e85e6e08276dd813d11 ]

PPP units don't hold any reference on the channels connected to it.
It is the channel's responsibility to ensure that it disconnects from
its unit before being destroyed.
In practice, this is ensured by ppp_unregister_channel() disconnecting
the channel from the unit before dropping a reference on the channel.

However, it is possible for an unregistered channel to connect to a PPP
unit: register a channel with ppp_register_net_channel(), attach a
/dev/ppp file to it with ioctl(PPPIOCATTCHAN), unregister the channel
with ppp_unregister_channel() and finally connect the /dev/ppp file to
a PPP unit with ioctl(PPPIOCCONNECT).

Once in this situation, the channel is only held by the /dev/ppp file,
which can be released at anytime and free the channel without letting
the parent PPP unit know. Then the ppp structure ends up with dangling
pointers in its ->channels list.

Prevent this scenario by forbidding unregistered channels from
connecting to PPP units. This maintains the code logic by keeping
ppp_unregister_channel() responsible from disconnecting the channel if
necessary and avoids modification on the reference counting mechanism.

This issue seems to predate git history (successfully reproduced on
Linux 2.6.26 and earlier PPP commits are unrelated).

Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ppp/ppp_generic.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2952,6 +2952,15 @@ ppp_connect_channel(struct channel *pch,
 		goto outl;
 
 	ppp_lock(ppp);
+	spin_lock_bh(&pch->downl);
+	if (!pch->chan) {
+		/* Don't connect unregistered channels */
+		spin_unlock_bh(&pch->downl);
+		ppp_unlock(ppp);
+		ret = -ENOTCONN;
+		goto outl;
+	}
+	spin_unlock_bh(&pch->downl);
 	if (pch->file.hdrlen > ppp->file.hdrlen)
 		ppp->file.hdrlen = pch->file.hdrlen;
 	hdrlen = pch->file.hdrlen + 2;	/* for protocol bytes */

  parent reply	other threads:[~2018-03-10  0:18 UTC|newest]

Thread overview: 54+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-10  0:18 [PATCH 4.4 00/36] 4.4.121-stable review Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 01/36] tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 02/36] tpm_i2c_infineon: " Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 03/36] tpm_i2c_nuvoton: " Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 04/36] ALSA: usb-audio: Add a quirck for B&W PX headphones Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 05/36] ALSA: hda: Add a power_save blacklist Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 06/36] cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 07/36] media: m88ds3103: dont call a non-initalized function Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 08/36] nospec: Allow index argument to have const-qualified type Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 09/36] ARM: mvebu: Fix broken PL310_ERRATA_753970 selects Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 10/36] KVM: mmu: Fix overlap between public and private memslots Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 11/36] x86/syscall: Sanitize syscall table de-references under speculation fix Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 12/36] btrfs: Dont clear SGID when inheriting ACLs Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 13/36] ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux Greg Kroah-Hartman
2018-03-12 23:29   ` Ben Hutchings
2018-03-14 21:31     ` Adam Ford
2018-03-16 12:32       ` Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 14/36] x86/apic/vector: Handle legacy irq data correctly Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 15/36] leds: do not overflow sysfs buffer in led_trigger_show Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 16/36] x86/spectre: Fix an error message Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 17/36] Revert "led: core: Fix brightness setting when setting delay_off=0" Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 18/36] bridge: check brport attr show in brport_show Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 19/36] fib_semantics: Dont match route with mismatching tclassid Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 20/36] hdlc_ppp: carrier detect ok, dont turn off negotiation Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 21/36] ipv6 sit: work around bogus gcc-8 -Wrestrict warning Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 22/36] net: fix race on decreasing number of TX queues Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 23/36] net: ipv4: dont allow setting net.ipv4.route.min_pmtu below 68 Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 24/36] netlink: ensure to loop over all netns in genlmsg_multicast_allns() Greg Kroah-Hartman
2018-03-13  0:04   ` Ben Hutchings
2018-03-14 17:06     ` Nicolas Dichtel
2018-03-14 20:10     ` [PATCH net] netlink: avoid a double skb free in genlmsg_mcast() Nicolas Dichtel
2018-03-16 16:36       ` David Miller
2018-03-10  0:18 ` Greg Kroah-Hartman [this message]
2018-03-10  0:18 ` [PATCH 4.4 26/36] udplite: fix partial checksum initialization Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 27/36] sctp: fix dst refcnt leak in sctp_v4_get_dst Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 28/36] sctp: fix dst refcnt leak in sctp_v6_get_dst() Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 29/36] s390/qeth: fix SETIP command handling Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 30/36] s390/qeth: fix IPA command submission race Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 31/36] sctp: verify size of a new chunk in _sctp_make_chunk() Greg Kroah-Hartman
2018-03-13  0:46   ` Ben Hutchings
2018-03-13  9:56     ` Greg Kroah-Hartman
2018-03-14 16:23       ` Ben Hutchings
2018-03-10  0:18 ` [PATCH 4.4 32/36] net: mpls: Pull common label check into helper Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 33/36] mpls, nospec: Sanitize array index in mpls_label_ok() Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 34/36] dm io: fix duplicate bio completion due to missing ref count Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 35/36] bpf, x64: implement retpoline for tail call Greg Kroah-Hartman
2018-03-10  0:18 ` [PATCH 4.4 36/36] btrfs: preserve i_mode if __btrfs_set_acl() fails Greg Kroah-Hartman
2018-03-10  0:50 ` [PATCH 4.4 00/36] 4.4.121-stable review Nathan Chancellor
2018-03-10  1:03   ` Greg Kroah-Hartman
2018-03-10  1:07     ` Nathan Chancellor
2018-03-10  5:16 ` Shuah Khan
2018-03-10  7:19 ` kernelci.org bot
2018-03-10 15:43 ` Guenter Roeck
2018-03-12 11:39 ` Naresh Kamboju

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180310001808.741475823@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=g.nault@alphalink.fr \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).