apport information ** Attachment added: "CurrentDmesg.txt" https://bugs.launchpad.net/bugs/1832828/+attachment/5274438/+files/CurrentDmesg.txt
-- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1832828 Title: ipv6: fix EFAULT on sendto with icmpv6 and hdrincl Status in linux package in Ubuntu: Confirmed Bug description: == SRU Justification == The following code returns EFAULT (Bad address): s = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6); setsockopt(s, SOL_IPV6, IPV6_HDRINCL, 1); sendto(ipv6_icmp6_packet, addr); /* returns -1, errno = EFAULT */ The IPv4 equivalent code works. The failure happens because 2 bytes are eaten from the msghdr by rawv6_probe_proto_opt() starting from commit 19e3c66b52ca ("ipv6 equivalent of "ipv4: Avoid reading user iov twice after raw_probe_proto_opt""), but at that time it was not a problem because IPV6_HDRINCL was not yet introduced. Only eat these 2 bytes if hdrincl == 0. == Fix == Upstream commits: 59e3e4b52663 ("ipv6: use READ_ONCE() for inet->hdrincl as in ipv4") b9aa52c4cb45 ("ipv6: fix EFAULT on sendto with icmpv6 and hdrincl") == Regression Potential == Low. Only impacts IPv6 raw sockets with IPV6_HDRINCL. == Test Case == Copy/paste this code in a python3 interpreter: IPPROTO_ICMPV6 = socket.getprotobyname('ipv6-icmp') SOL_IPV6 = 41 IPV6_HDRINCL = 36 import socket send_s = socket.socket(socket.AF_INET6, socket.SOCK_RAW, IPPROTO_ICMPV6) send_s.setsockopt(SOL_IPV6, IPV6_HDRINCL, 1) # this is an IPv6 + ICMPv6 echo packet req = b'`\x00\x00\x00\x00":@?\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01?\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x80\x00\xe0\xda9\xa0V\x8dabcdefghijklmnopqrstuvwxyz' send_s.sendto(req, ('3ffe::2', 0, 0, 0)) On error, it raises: OSError: [Errno 14] Bad address After the fix, no exception is raised. --- ProblemType: Bug AlsaDevices: total 0 crw-rw---- 1 root audio 116, 1 Jun 28 08:58 seq crw-rw---- 1 root audio 116, 33 Jun 28 08:58 timer AplayDevices: Error: [Errno 2] No such file or directory: 'aplay': 'aplay' ApportVersion: 2.20.9-0ubuntu7.6 Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord': 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: DistroRelease: Ubuntu 18.04 IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig': 'iwconfig' Lsusb: Error: [Errno 2] No such file or directory: 'lsusb': 'lsusb' MachineType: QEMU Standard PC (i440FX + PIIX, 1996) Package: linux (not installed) PciMultimedia: ProcEnviron: TERM=screen PATH=(custom, no user) XDG_RUNTIME_DIR=<set> LANG=en_US.UTF-8 SHELL=/bin/bash ProcFB: ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.15.0-50-generic root=/dev/mapper/6WIND-hostname ro console=ttyS0,115200n8 quiet splash vt.handoff=1 ProcVersionSignature: Ubuntu 4.15.0-50.54-generic 4.15.18 RelatedPackageVersions: linux-restricted-modules-4.15.0-50-generic N/A linux-backports-modules-4.15.0-50-generic N/A linux-firmware 1.173.6 RfKill: Error: [Errno 2] No such file or directory: 'rfkill': 'rfkill' Tags: bionic Uname: Linux 4.15.0-50-generic x86_64 UnreportableReason: This report is about a package that is not installed. UpgradeStatus: No upgrade log present (probably fresh install) UserGroups: _MarkForUpload: False dmi.bios.date: 04/01/2014 dmi.bios.vendor: SeaBIOS dmi.bios.version: rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org dmi.chassis.type: 1 dmi.chassis.vendor: QEMU dmi.chassis.version: pc-i440fx-2.12 dmi.modalias: dmi:bvnSeaBIOS:bvrrel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org:bd04/01/2014:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-2.12:cvnQEMU:ct1:cvrpc-i440fx-2.12: dmi.product.name: Standard PC (i440FX + PIIX, 1996) dmi.product.version: pc-i440fx-2.12 dmi.sys.vendor: QEMU To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1832828/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
