All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Josh Hunt <joshhunt00@gmail.com>
Cc: Sabrina Dubroca <sd@queasysnail.net>,
	netdev@vger.kernel.org, herbert@gondor.apana.org.au,
	stable <stable@vger.kernel.org>,
	hannes@stressinduktion.org
Subject: Re: [PATCH stable <= 3.18] net: add length argument to skb_copy_and_csum_datagram_iovec
Date: Tue, 10 Nov 2015 16:03:52 -0800	[thread overview]
Message-ID: <20151111000352.GA5134@kroah.com> (raw)
In-Reply-To: <CAKA=qzZCi_OEDJKgy1WQ1QdMBpHBure1tY7NYtsgSr0fMva5jQ@mail.gmail.com>

On Tue, Nov 10, 2015 at 05:59:26PM -0600, Josh Hunt wrote:
> On Thu, Oct 29, 2015 at 5:00 AM, Sabrina Dubroca <sd@queasysnail.net> wrote:
> > 2015-10-15, 14:25:03 +0200, Sabrina Dubroca wrote:
> >> Without this length argument, we can read past the end of the iovec in
> >> memcpy_toiovec because we have no way of knowing the total length of the
> >> iovec's buffers.
> >>
> >> This is needed for stable kernels where 89c22d8c3b27 ("net: Fix skb
> >> csum races when peeking") has been backported but that don't have the
> >> ioviter conversion, which is almost all the stable trees <= 3.18.
> >>
> >> This also fixes a kernel crash for NFS servers when the client uses
> >>  -onfsvers=3,proto=udp to mount the export.
> >>
> >> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
> >> Reviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> >
> > Fixes CVE-2015-8019.
> > http://www.openwall.com/lists/oss-security/2015/10/29/1
> >
> > --
> > Sabrina
> > --
> > To unsubscribe from this list: send the line "unsubscribe netdev" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> Greg
> 
> Do you have this in your queue? I saw a few other stables pick this
> up, but haven't seen it in 3.14 or 3.18 yet. It wasn't clear to me if
> this had been fully reviewed yet.

I rely on Dave to package up networking stable patches and forward them
on to me, that's why you haven't seen it be picked up yet.

thanks,

greg k-h

  reply	other threads:[~2015-11-11  0:03 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-10-15 12:25 [PATCH stable <= 3.18] net: add length argument to skb_copy_and_csum_datagram_iovec Sabrina Dubroca
2015-10-29 10:00 ` Sabrina Dubroca
2015-11-10 23:59   ` Josh Hunt
2015-11-11  0:03     ` Greg Kroah-Hartman [this message]
2015-11-12  9:48       ` Sabrina Dubroca
2015-11-12 17:26         ` Eric Dumazet
2015-11-16 18:06           ` Sabrina Dubroca
2015-11-13 21:29         ` David Miller
2015-11-14 17:39 ` Ben Hutchings

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20151111000352.GA5134@kroah.com \
    --to=gregkh@linuxfoundation.org \
    --cc=hannes@stressinduktion.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=joshhunt00@gmail.com \
    --cc=netdev@vger.kernel.org \
    --cc=sd@queasysnail.net \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.