From e3cffe0bf8150c28f602e6fa03dc234257e35d29 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Wed, 31 Oct 2012 13:58:56 -0400 Subject: [PATCH] CVE-2012-4565 net: divide by zero in tcp algorithm illinois (rhbz 871848 871923) --- kernel.spec | 9 ++ ...de-by-zero-in-tcp-algorithm-illinois.patch | 117 ++++++++++++++++++ 2 files changed, 126 insertions(+) create mode 100644 net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch diff --git a/kernel.spec b/kernel.spec index db43deff3..d77ff8358 100644 --- a/kernel.spec +++ b/kernel.spec @@ -772,6 +772,9 @@ Patch22089: 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch Patch22090: 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch Patch22091: 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch +#rhbz 871923 871848 CVE-2012-4565 +Patch22092: net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch + Patch22100: uprobes-upstream-backport.patch # END OF PATCH DEFINITIONS @@ -1495,6 +1498,9 @@ ApplyPatch 0010-ext4-fix-ext_remove_space-for-punch_hole-case.patch ApplyPatch 0011-ext4-fix-ext4_flush_completed_IO-wait-semantics.patch ApplyPatch 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch +#rhbz 871923 871848 CVE-2012-4565 +ApplyPatch net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch + ApplyPatch uprobes-upstream-backport.patch # END OF PATCH APPLICATIONS @@ -2360,6 +2366,9 @@ fi # '-' | | # '-' %changelog +* Wed Oct 30 2012 Josh Boyer +- CVE-2012-4565 net: divide by zero in tcp algorithm illinois (rhbz 871848 871923) + * Tue Oct 30 2012 Mauro Carvalho Chehab - Fix EDAC memory filling for csrow-based memory controllers diff --git a/net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch b/net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch new file mode 100644 index 000000000..109ee17b4 --- /dev/null +++ b/net-fix-divide-by-zero-in-tcp-algorithm-illinois.patch @@ -0,0 +1,117 @@ +Path: news.gmane.org!not-for-mail +From: Jesper Dangaard Brouer +Newsgroups: gmane.linux.network +Subject: [net PATCH V2] net: fix divide by zero in tcp algorithm illinois +Date: Wed, 31 Oct 2012 13:45:32 +0100 +Lines: 63 +Approved: news@gmane.org +Message-ID: <20121031124318.30915.32293.stgit@dragon> +NNTP-Posting-Host: plane.gmane.org +Mime-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 7bit +X-Trace: ger.gmane.org 1351687472 19921 80.91.229.3 (31 Oct 2012 12:44:32 GMT) +X-Complaints-To: usenet@ger.gmane.org +NNTP-Posting-Date: Wed, 31 Oct 2012 12:44:32 +0000 (UTC) +Cc: Jesper Dangaard Brouer , netdev@vger.kernel.org, + Petr Matousek , + Stephen Hemminger , + Eric Dumazet +To: "David S. Miller" +Original-X-From: netdev-owner@vger.kernel.org Wed Oct 31 13:44:40 2012 +Return-path: +Envelope-to: linux-netdev-2@plane.gmane.org +Original-Received: from vger.kernel.org ([209.132.180.67]) + by plane.gmane.org with esmtp (Exim 4.69) + (envelope-from ) + id 1TTXex-0002V3-Qk + for linux-netdev-2@plane.gmane.org; Wed, 31 Oct 2012 13:44:40 +0100 +Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand + id S932565Ab2JaMo0 (ORCPT ); + Wed, 31 Oct 2012 08:44:26 -0400 +Original-Received: from mx1.redhat.com ([209.132.183.28]:57345 "EHLO mx1.redhat.com" + rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP + id S1751941Ab2JaMoZ (ORCPT ); + Wed, 31 Oct 2012 08:44:25 -0400 +Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) + by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q9VCiOkC014655 + (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); + Wed, 31 Oct 2012 08:44:24 -0400 +Original-Received: from dragon.localdomain (ovpn-116-61.ams2.redhat.com [10.36.116.61]) + by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q9VCiMuW008440; + Wed, 31 Oct 2012 08:44:23 -0400 +Original-Received: from [127.0.0.1] (localhost [IPv6:::1]) + by dragon.localdomain (Postfix) with ESMTP id 416D0E40666; + Wed, 31 Oct 2012 13:45:32 +0100 (CET) +User-Agent: StGIT/0.14.3 +X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 +Original-Sender: netdev-owner@vger.kernel.org +Precedence: bulk +List-ID: +X-Mailing-List: netdev@vger.kernel.org +Xref: news.gmane.org gmane.linux.network:247871 +Archived-At: + +Reading TCP stats when using TCP Illinois congestion control algorithm +can cause a divide by zero kernel oops. + +The division by zero occur in tcp_illinois_info() at: + do_div(t, ca->cnt_rtt); +where ca->cnt_rtt can become zero (when rtt_reset is called) + +Steps to Reproduce: + 1. Register tcp_illinois: + # sysctl -w net.ipv4.tcp_congestion_control=illinois + 2. Monitor internal TCP information via command "ss -i" + # watch -d ss -i + 3. Establish new TCP conn to machine + +Either it fails at the initial conn, or else it needs to wait +for a loss or a reset. + +This is only related to reading stats. The function avg_delay() also +performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its +calling point in update_params(). Thus, simply fix tcp_illinois_info(). + +Function tcp_illinois_info() / get_info() is called without +socket lock. Thus, eliminate any race condition on ca->cnt_rtt +by using a local stack variable. Simply reuse info.tcpv_rttcnt, +as its already set to ca->cnt_rtt. +Function avg_delay() is not affected by this race condition, as +its called with the socket lock. + +Cc: Petr Matousek +Signed-off-by: Jesper Dangaard Brouer + +--- +V2: + Address Eric Dumazets input: + - Save 2 bytes of stack, by using info.tcpv_rttcnt. + - Help compiler, and define "u64 t" inside if() lexical scope. + + + net/ipv4/tcp_illinois.c | 8 +++++--- + 1 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c +index 813b43a..834857f 100644 +--- a/net/ipv4/tcp_illinois.c ++++ b/net/ipv4/tcp_illinois.c +@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext, + .tcpv_rttcnt = ca->cnt_rtt, + .tcpv_minrtt = ca->base_rtt, + }; +- u64 t = ca->sum_rtt; + +- do_div(t, ca->cnt_rtt); +- info.tcpv_rtt = t; ++ if (info.tcpv_rttcnt > 0) { ++ u64 t = ca->sum_rtt; + ++ do_div(t, info.tcpv_rttcnt); ++ info.tcpv_rtt = t; ++ } + nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info); + } + } +