Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update dockerfile #1

Merged
merged 2 commits into from
Aug 27, 2019
Merged

update dockerfile #1

merged 2 commits into from
Aug 27, 2019

Conversation

miracle091
Copy link

  • changed base image from ubuntu:xenial (official) to linuxserver.io ubuntu:xenial (most updated)
  • changed default folder to 'padavan-ng' directory
  • updated the git repository url
  • updated the packages needed for build the firmware and the toolchain
  • now is auto building the toolchain

@miracle091
update dockerfile
d538fd2 
- changed base image from ubuntu:xenial (official) to linuxserver.io ubuntu:xenial (most updated)
- changed to padavan-ng directory
- updated the git repository
- updated the packages needed for build the firmware and the toolchain
- now is auto building the toolchain
@miracle091
Update Dockerfile
e26f34b
@zanezam zanezam merged commit b903075 into zanezam:custom Aug 27, 2019
@miracle091 miracle091 deleted the patch-1 branch August 28, 2019 07:13
zanezam pushed a commit that referenced this pull request Sep 23, 2019
@miracle091
Merge pull request #1 from miracle091/imgbot
d606db8 
[ImgBot] Optimize images
dur-randir referenced this pull request in dur-randir/padavan-ng May 3, 2020
@dur-randir
netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
8318439 
    commit 22dad713b8a5ff488e07b821195270672f486eb2 upstream.

    The set uadt functions assume lineno is never NULL, but it is in
    case of ip_set_utest().

    syzkaller managed to generate a netlink message that calls this with
    LINENO attr present:

    general protection fault: 0000 [#1] PREEMPT SMP KASAN
    RIP: 0010:hash_mac4_uadt+0x1bc/0x470 net/netfilter/ipset/ip_set_hash_mac.c:104
    Call Trace:
     ip_set_utest+0x55b/0x890 net/netfilter/ipset/ip_set_core.c:1867
     nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229
     netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
     nfnetlink_rcv+0x1ba/0x460 net/netfilter/nfnetlink.c:563

    pass a dummy lineno storage, its easier than patching all set
    implementations.

    This seems to be a day-0 bug.

    Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    Reported-by: syzbot+34bd2369d38707f3f4a7@syzkaller.appspotmail.com
    Fixes: a7b4f989a6294 ("netfilter: ipset: IP set core support")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    [bwh: Backported to 3.16: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
dur-randir referenced this pull request in dur-randir/padavan-ng May 3, 2020
@dur-randir
netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
e2d0d89 
    commit 212e7f56605ef9688d0846db60c6c6ec06544095 upstream.

    An earlier commit (1b789577f655060d98d20e,
    "netfilter: arp_tables: init netns pointer in xt_tgchk_param struct")
    fixed missing net initialization for arptables, but turns out it was
    incomplete.  We can get a very similar struct net NULL deref during
    error unwinding:

    general protection fault: 0000 [#1] PREEMPT SMP KASAN
    RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
     xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
     cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
     translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
     do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
     do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461

    Also init the netns pointer in xt_tgdtor_param struct.

    Fixes: add67461240c1d ("netfilter: add struct net * to target parameters")
    Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    [bwh: Backported to 3.16:
     - __arpt_unregister_table() has not been split out of
       arpt_unregister_table()
     - Add "net" parameter to arpt_unregister_table() and update its only
       caller in arptable_filter.c]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
dur-randir referenced this pull request in dur-randir/padavan-ng Jul 2, 2020
@dur-randir
xfrm: fix a NULL-ptr deref in xfrm_local_error
ca3457a 
commit f6a23d85d078c2ffde79c66ca81d0a1dde451649 upstream.

This patch is to fix a crash:

  [ ] kasan: GPF could be caused by NULL-ptr deref or user memory access
  [ ] general protection fault: 0000 [#1] SMP KASAN PTI
  [ ] RIP: 0010:ipv6_local_error+0xac/0x7a0
  [ ] Call Trace:
  [ ]  xfrm6_local_error+0x1eb/0x300
  [ ]  xfrm_local_error+0x95/0x130
  [ ]  __xfrm6_output+0x65f/0xb50
  [ ]  xfrm6_output+0x106/0x46f
  [ ]  udp_tunnel6_xmit_skb+0x618/0xbf0 [ip6_udp_tunnel]
  [ ]  vxlan_xmit_one+0xbc6/0x2c60 [vxlan]
  [ ]  vxlan_xmit+0x6a0/0x4276 [vxlan]
  [ ]  dev_hard_start_xmit+0x165/0x820
  [ ]  __dev_queue_xmit+0x1ff0/0x2b90
  [ ]  ip_finish_output2+0xd3e/0x1480
  [ ]  ip_do_fragment+0x182d/0x2210
  [ ]  ip_output+0x1d0/0x510
  [ ]  ip_send_skb+0x37/0xa0
  [ ]  raw_sendmsg+0x1b4c/0x2b80
  [ ]  sock_sendmsg+0xc0/0x110

This occurred when sending a v4 skb over vxlan6 over ipsec, in which case
skb->protocol == htons(ETH_P_IPV6) while skb->sk->sk_family == AF_INET in
xfrm_local_error(). Then it will go to xfrm6_local_error() where it tries
to get ipv6 info from a ipv4 sk.

This issue was actually fixed by Commit 628e341f319f ("xfrm: make local
error reporting more robust"), but brought back by Commit 844d48746e4b
("xfrm: choose protocol family by skb protocol").

So to fix it, we should call xfrm6_local_error() only when skb->protocol
is htons(ETH_P_IPV6) and skb->sk->sk_family is AF_INET6.

Fixes: 844d48746e4b ("xfrm: choose protocol family by skb protocol")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
dur-randir referenced this pull request in dur-randir/padavan-ng Jul 2, 2020
@dur-randir
l2tp: do not use inet_hash()/inet_unhash()
870322b 
[ Upstream commit 02c71b144c811bcdd865e0a1226d0407d11357e8 ]

syzbot recently found a way to crash the kernel [1]

Issue here is that inet_hash() & inet_unhash() are currently
only meant to be used by TCP & DCCP, since only these protocols
provide the needed hashinfo pointer.

L2TP uses a single list (instead of a hash table)

This old bug became an issue after commit 610236587600
("bpf: Add new cgroup attach type to enable sock modifications")
since after this commit, sk_common_release() can be called
while the L2TP socket is still considered 'hashed'.

general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 7063 Comm: syz-executor654 Not tainted 5.7.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:inet_unhash+0x11f/0x770 net/ipv4/inet_hashtables.c:600
Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e dd 04 00 00 48 8d 7d 08 44 8b 73 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 55 05 00 00 48 8d 7d 14 4c 8b 6d 08 48 b8 00 00
RSP: 0018:ffffc90001777d30 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff88809a6df940 RCX: ffffffff8697c242
RDX: 0000000000000001 RSI: ffffffff8697c251 RDI: 0000000000000008
RBP: 0000000000000000 R08: ffff88809f3ae1c0 R09: fffffbfff1514cc1
R10: ffffffff8a8a6607 R11: fffffbfff1514cc0 R12: ffff88809a6df9b0
R13: 0000000000000007 R14: 0000000000000000 R15: ffffffff873a4d00
FS:  0000000001d2b880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006cd090 CR3: 000000009403a000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 sk_common_release+0xba/0x370 net/core/sock.c:3210
 inet_create net/ipv4/af_inet.c:390 [inline]
 inet_create+0x966/0xe00 net/ipv4/af_inet.c:248
 __sock_create+0x3cb/0x730 net/socket.c:1428
 sock_create net/socket.c:1479 [inline]
 __sys_socket+0xef/0x200 net/socket.c:1521
 __do_sys_socket net/socket.c:1530 [inline]
 __se_sys_socket net/socket.c:1528 [inline]
 __x64_sys_socket+0x6f/0xb0 net/socket.c:1528
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x441e29
Code: e8 fc b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffdce184148 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441e29
RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000402c30 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 23b6578228ce553e ]---
RIP: 0010:inet_unhash+0x11f/0x770 net/ipv4/inet_hashtables.c:600
Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e dd 04 00 00 48 8d 7d 08 44 8b 73 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 55 05 00 00 48 8d 7d 14 4c 8b 6d 08 48 b8 00 00
RSP: 0018:ffffc90001777d30 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff88809a6df940 RCX: ffffffff8697c242
RDX: 0000000000000001 RSI: ffffffff8697c251 RDI: 0000000000000008
RBP: 0000000000000000 R08: ffff88809f3ae1c0 R09: fffffbfff1514cc1
R10: ffffffff8a8a6607 R11: fffffbfff1514cc0 R12: ffff88809a6df9b0
R13: 0000000000000007 R14: 0000000000000000 R15: ffffffff873a4d00
FS:  0000000001d2b880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006cd090 CR3: 000000009403a000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Fixes: 0d76751fad77 ("l2tp: Add L2TPv3 IP encapsulation (no UDP) support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Chapman <jchapman@katalix.com>
Cc: Andrii Nakryiko <andriin@fb.com>
Reported-by: syzbot+3610d489778b57cc8031@syzkaller.appspotmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
@ProBackup-nl ProBackup-nl mentioned this pull request Jul 5, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@miracle091 @zanezam