ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt
authorXin Long <lucien.xin@gmail.com>
Fri, 24 Feb 2017 08:29:06 +0000 (16:29 +0800)
committerDanny Wood <danwood76@gmail.com>
Tue, 28 Sep 2021 12:06:42 +0000 (13:06 +0100)
commitf2c80c0b08245dc82d500acf405d043a43027aa1
treebe1370563a2fa78e4a844e282227f639a799c139
parentb53722cfc979bca7d1711e8934324d1589a9e67b
ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt

[ Upstream commit 99253eb750fda6a644d5188fb26c43bad8d5a745 ]

Commit 5e1859fbcc3c ("ipv4: ipmr: various fixes and cleanups") fixed
the issue for ipv4 ipmr:

  ip_mroute_setsockopt() & ip_mroute_getsockopt() should not
  access/set raw_sk(sk)->ipmr_table before making sure the socket
  is a raw socket, and protocol is IGMP

The same fix should be done for ipv6 ipmr as well.

This patch can fix the panic caused by overwriting the same offset
as ipmr_table as in raw_sk(sk) when accessing other type's socket
by ip_mroute_setsockopt().

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I8d48f4611a2f2d0cb7ad5146036f571f12ecb1fc
CVE-2017-18509
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
net/ipv6/ip6mr.c