ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt (99253eb7) · Commits · 戴 / test

Commit ("ipv4: ipmr: various fixes and cleanups") fixed the issue for ipv4 ipmr: ip_mroute_setsockopt() & ip_mroute_getsockopt() should not access/set raw_sk(sk)->ipmr_table before making sure the socket is a raw socket, and protocol is IGMP The same fix should be done for ipv6 ipmr as well. This patch can fix the panic caused by overwriting the same offset as ipmr_table as in raw_sk(sk) when accessing other type's socket by ip_mroute_setsockopt(). Signed-off-by:

Xin Long <lucien.xin@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv6/ip6mr.c

+8 −3

Original line number	Diff line number	Diff line
		@@ -1666,6 +1666,10 @@ int ip6_mroute_setsockopt(struct sock sk, int optname, char __user optval, uns
		struct net *net = sock_net(sk);
		struct mr6_table *mrt;

		if (sk->sk_type != SOCK_RAW \|\|
		inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
		return -EOPNOTSUPP;

		mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
		if (!mrt)
		return -ENOENT;
		@@ -1677,9 +1681,6 @@ int ip6_mroute_setsockopt(struct sock sk, int optname, char __user optval, uns

		switch (optname) {
		case MRT6_INIT:
		if (sk->sk_type != SOCK_RAW \|\|
		inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
		return -EOPNOTSUPP;
		if (optlen < sizeof(int))
		return -EINVAL;

		@@ -1815,6 +1816,10 @@ int ip6_mroute_getsockopt(struct sock sk, int optname, char __user optval,
		struct net *net = sock_net(sk);
		struct mr6_table *mrt;

		if (sk->sk_type != SOCK_RAW \|\|
		inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
		return -EOPNOTSUPP;

		mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
		if (!mrt)
		return -ENOENT;

Admin message