linux-kernel - [PATCH 0/8] [backports] l2tp use-after-free fixes for 4.4 stable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200402173250.7858-1-will@kernel.org>
Date:   Thu,  2 Apr 2020 18:32:42 +0100
From:   Will Deacon <will@...nel.org>
To:     gregkh@...uxfoundation.org
Cc:     stable@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel-team@...roid.com, g.nault@...halink.fr,
        Will Deacon <will@...nel.org>
Subject: [PATCH 0/8] [backports] l2tp use-after-free fixes for 4.4 stable

Hi Greg,

Syzbot has been complaining about KASAN splats due to use-after-free
issues in the l2tp code on 4.4 Android kernels (although I reproduced
with latest 4.4 stable on my laptop):

https://syzkaller.appspot.com/bug?id=de316389db0fa0cd7ced6e564601ea8e56625ebc

These have been fixed upstream, but for some reason didn't get picked up
for stable. This series applies to 4.4.y and I've sent patches for 4.9
separately.

Thanks,

Will

--->8


Gao Feng (1):
  l2tp: Refactor the codes with existing macros instead of literal
    number

Guillaume Nault (5):
  l2tp: fix race in l2tp_recv_common()
  l2tp: ensure session can't get removed during pppol2tp_session_ioctl()
  l2tp: fix duplicate session creation
  l2tp: ensure sessions are freed after their PPPOL2TP socket
  l2tp: fix race between l2tp_session_delete() and
    l2tp_tunnel_closeall()

Shmulik Ladkani (1):
  net: l2tp: Make l2tp_ip6 namespace aware

phil.turnbull@...cle.com (1):
  l2tp: Correctly return -EBADF from pppol2tp_getname.

 net/l2tp/l2tp_core.c | 149 ++++++++++++++++++++++++++++++++++---------
 net/l2tp/l2tp_core.h |   4 ++
 net/l2tp/l2tp_eth.c  |  10 +--
 net/l2tp/l2tp_ip.c   |  17 +++--
 net/l2tp/l2tp_ip6.c  |  28 +++++---
 net/l2tp/l2tp_ppp.c  | 110 ++++++++++++++++----------------
 6 files changed, 211 insertions(+), 107 deletions(-)

-- 
2.26.0.rc2.310.g2932bb562d-goog