** Changed in: linux (Ubuntu Disco)
Status: Fix Committed => Won't Fix
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1832828
Title:
ipv6: fix EFAULT on sendto with icmpv6 and hdrincl
Status in linux package in Ubuntu:
Confirmed
Status in linux source package in Bionic:
Fix Committed
Status in linux source package in Disco:
Won't Fix
Bug description:
== SRU Justification ==
The following code returns EFAULT (Bad address):
s = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
setsockopt(s, SOL_IPV6, IPV6_HDRINCL, 1);
sendto(ipv6_icmp6_packet, addr); /* returns -1, errno = EFAULT */
The IPv4 equivalent code works.
The failure happens because 2 bytes are eaten from the msghdr by
rawv6_probe_proto_opt() starting from commit 19e3c66b52ca ("ipv6
equivalent of "ipv4: Avoid reading user iov twice after
raw_probe_proto_opt""), but at that time it was not a problem because
IPV6_HDRINCL was not yet introduced.
Only eat these 2 bytes if hdrincl == 0.
== Fix ==
Upstream commits:
59e3e4b52663 ("ipv6: use READ_ONCE() for inet->hdrincl as in ipv4")
b9aa52c4cb45 ("ipv6: fix EFAULT on sendto with icmpv6 and hdrincl")
== Regression Potential ==
Low. Only impacts IPv6 raw sockets with IPV6_HDRINCL.
== Test Case ==
Copy/paste this code in a python3 interpreter:
IPPROTO_ICMPV6 = socket.getprotobyname('ipv6-icmp')
SOL_IPV6 = 41
IPV6_HDRINCL = 36
import socket
send_s = socket.socket(socket.AF_INET6, socket.SOCK_RAW, IPPROTO_ICMPV6)
send_s.setsockopt(SOL_IPV6, IPV6_HDRINCL, 1)
# this is an IPv6 + ICMPv6 echo packet
req =
b'`\x00\x00\x00\x00":@?\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01?\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x80\x00\xe0\xda9\xa0V\x8dabcdefghijklmnopqrstuvwxyz'
send_s.sendto(req, ('3ffe::2', 0, 0, 0))
On error, it raises:
OSError: [Errno 14] Bad address
After the fix, no exception is raised.
---
ProblemType: Bug
AlsaDevices:
total 0
crw-rw---- 1 root audio 116, 1 Jun 28 08:58 seq
crw-rw---- 1 root audio 116, 33 Jun 28 08:58 timer
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay': 'aplay'
ApportVersion: 2.20.9-0ubuntu7.6
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord':
'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq',
'/dev/snd/timer'] failed with exit code 1:
DistroRelease: Ubuntu 18.04
IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig': 'iwconfig'
Lsusb: Error: [Errno 2] No such file or directory: 'lsusb': 'lsusb'
MachineType: QEMU Standard PC (i440FX + PIIX, 1996)
Package: linux (not installed)
PciMultimedia:
ProcEnviron:
TERM=screen
PATH=(custom, no user)
XDG_RUNTIME_DIR=<set>
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcFB:
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.15.0-50-generic
root=/dev/mapper/6WIND-hostname ro console=ttyS0,115200n8 quiet splash
vt.handoff=1
ProcVersionSignature: Ubuntu 4.15.0-50.54-generic 4.15.18
RelatedPackageVersions:
linux-restricted-modules-4.15.0-50-generic N/A
linux-backports-modules-4.15.0-50-generic N/A
linux-firmware 1.173.6
RfKill: Error: [Errno 2] No such file or directory: 'rfkill': 'rfkill'
Tags: bionic
Uname: Linux 4.15.0-50-generic x86_64
UnreportableReason: This report is about a package that is not installed.
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:
_MarkForUpload: False
dmi.bios.date: 04/01/2014
dmi.bios.vendor: SeaBIOS
dmi.bios.version: rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org
dmi.chassis.type: 1
dmi.chassis.vendor: QEMU
dmi.chassis.version: pc-i440fx-2.12
dmi.modalias:
dmi:bvnSeaBIOS:bvrrel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org:bd04/01/2014:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-2.12:cvnQEMU:ct1:cvrpc-i440fx-2.12:
dmi.product.name: Standard PC (i440FX + PIIX, 1996)
dmi.product.version: pc-i440fx-2.12
dmi.sys.vendor: QEMU
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1832828/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
