From 76b62cb0d5abed9354b1dd57dea3910c0091fc6c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 17 Apr 2018 17:19:14 +0200 Subject: [PATCH] 3.18-stable patches added patches: slip-check-if-rstate-is-initialized-before-uncompressing.patch --- queue-3.18/series | 1 + ...-is-initialized-before-uncompressing.patch | 76 +++++++++++++++++++ 2 files changed, 77 insertions(+) create mode 100644 queue-3.18/slip-check-if-rstate-is-initialized-before-uncompressing.patch diff --git a/queue-3.18/series b/queue-3.18/series index 058b3ff517b..09bfd9ab205 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -3,3 +3,4 @@ parisc-fix-out-of-array-access-in-match_pci_device.patch s390-qdio-don-t-retry-eqbs-after-ccq-96.patch s390-qdio-don-t-merge-error-output-buffers.patch s390-ipl-ensure-loadparm-valid-flag-is-set.patch +slip-check-if-rstate-is-initialized-before-uncompressing.patch diff --git a/queue-3.18/slip-check-if-rstate-is-initialized-before-uncompressing.patch b/queue-3.18/slip-check-if-rstate-is-initialized-before-uncompressing.patch new file mode 100644 index 00000000000..5587fe06aa9 --- /dev/null +++ b/queue-3.18/slip-check-if-rstate-is-initialized-before-uncompressing.patch @@ -0,0 +1,76 @@ +From foo@baz Tue Apr 17 17:00:10 CEST 2018 +From: Tejaswi Tanikella +Date: Wed, 11 Apr 2018 16:34:47 +0530 +Subject: slip: Check if rstate is initialized before uncompressing + +From: Tejaswi Tanikella + + +[ Upstream commit 3f01ddb962dc506916c243f9524e8bef97119b77 ] + +On receiving a packet the state index points to the rstate which must be +used to fill up IP and TCP headers. But if the state index points to a +rstate which is unitialized, i.e. filled with zeros, it gets stuck in an +infinite loop inside ip_fast_csum trying to compute the ip checsum of a +header with zero length. + +89.666953: <2> [] slhc_uncompress+0x464/0x468 +89.666965: <2> [] ppp_receive_nonmp_frame+0x3b4/0x65c +89.666978: <2> [] ppp_receive_frame+0x64/0x7e0 +89.666991: <2> [] ppp_input+0x104/0x198 +89.667005: <2> [] pppopns_recv_core+0x238/0x370 +89.667027: <2> [] __sk_receive_skb+0xdc/0x250 +89.667040: <2> [] pppopns_recv+0x44/0x60 +89.667053: <2> [] __sock_queue_rcv_skb+0x16c/0x24c +89.667065: <2> [] sock_queue_rcv_skb+0x2c/0x38 +89.667085: <2> [] raw_rcv+0x124/0x154 +89.667098: <2> [] raw_local_deliver+0x1e0/0x22c +89.667117: <2> [] ip_local_deliver_finish+0x70/0x24c +89.667131: <2> [] ip_local_deliver+0x100/0x10c + +./scripts/faddr2line vmlinux slhc_uncompress+0x464/0x468 output: + ip_fast_csum at arch/arm64/include/asm/checksum.h:40 + (inlined by) slhc_uncompress at drivers/net/slip/slhc.c:615 + +Adding a variable to indicate if the current rstate is initialized. If +such a packet arrives, move to toss state. + +Signed-off-by: Tejaswi Tanikella +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/slip/slhc.c | 5 +++++ + include/net/slhc_vj.h | 1 + + 2 files changed, 6 insertions(+) + +--- a/drivers/net/slip/slhc.c ++++ b/drivers/net/slip/slhc.c +@@ -509,6 +509,10 @@ slhc_uncompress(struct slcompress *comp, + if(x < 0 || x > comp->rslot_limit) + goto bad; + ++ /* Check if the cstate is initialized */ ++ if (!comp->rstate[x].initialized) ++ goto bad; ++ + comp->flags &=~ SLF_TOSS; + comp->recv_current = x; + } else { +@@ -673,6 +677,7 @@ slhc_remember(struct slcompress *comp, u + if (cs->cs_tcp.doff > 5) + memcpy(cs->cs_tcpopt, icp + ihl*4 + sizeof(struct tcphdr), (cs->cs_tcp.doff - 5) * 4); + cs->cs_hsize = ihl*2 + cs->cs_tcp.doff*2; ++ cs->initialized = true; + /* Put headers back on packet + * Neither header checksum is recalculated + */ +--- a/include/net/slhc_vj.h ++++ b/include/net/slhc_vj.h +@@ -127,6 +127,7 @@ typedef __u32 int32; + */ + struct cstate { + byte_t cs_this; /* connection id number (xmit) */ ++ bool initialized; /* true if initialized */ + struct cstate *next; /* next in ring (xmit) */ + struct iphdr cs_ip; /* ip/tcp hdr from most recent packet */ + struct tcphdr cs_tcp; -- 2.47.2