tag 9f8436c384b96f351e6947af0a240096a734cb10
tagger Todd Kjos <tkjos@google.com> Tue Feb 02 13:30:36 2021 -0800
object 75f8f6d5b6608bfc9a8f573b8d9ccd9d219a5c2e

https://source.android.com/security/bulletin/2021-02-01
CVE-2017-18509
CVE-2020-10767

commit 75f8f6d5b6608bfc9a8f573b8d9ccd9d219a5c2e
author Xin Long <lucien.xin@gmail.com> Fri Feb 24 16:29:06 2017 +0800
committer Todd Kjos <tkjos@google.com> Mon Feb 01 15:16:31 2021 -0800
tree cbc5424f5a1b397bd6dfca055a12762dd5635dc2
parent 3bb3f19d2f63a4c559645abef673a7ca25b149b7

ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt

[ Upstream commit 99253eb750fda6a644d5188fb26c43bad8d5a745 ]

Commit 5e1859fbcc3c ("ipv4: ipmr: various fixes and cleanups") fixed
the issue for ipv4 ipmr:

  ip_mroute_setsockopt() & ip_mroute_getsockopt() should not
  access/set raw_sk(sk)->ipmr_table before making sure the socket
  is a raw socket, and protocol is IGMP

The same fix should be done for ipv6 ipmr as well.

This patch can fix the panic caused by overwriting the same offset
as ipmr_table as in raw_sk(sk) when accessing other type's socket
by ip_mroute_setsockopt().

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>