linux-kernel - [PATCH 4.6 076/121] batman-adv: Fix double neigh_node_put in batadv_v_ogm_route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20160605214420.040928849@linuxfoundation.org>
Date:	Sun,  5 Jun 2016 14:43:48 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Sven Eckelmann <sven@...fation.org>,
	Antonio Quartulli <a@...table.cc>
Subject: [PATCH 4.6 076/121] batman-adv: Fix double neigh_node_put in batadv_v_ogm_route_update

4.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Eckelmann <sven@...fation.org>

The router is put down twice when it was non-NULL and either orig_ifinfo is
NULL afterwards or batman-adv receives a packet with the same sequence
number. This will end up in a use-after-free when the batadv_neigh_node is
removed because the reference counter ended up too early at 0.

This patch is skipping netdev and is being sent directly to stable in
accordance with David S. Miller[1].

The reason is that this patch applies only on linux-4.6 and not on
linux-4.7/net because it was "accidentally" fixed by a refactoring
commit (more details in [2]).

It addresses a reference imbalance which systematically leads to a
use-after-free and then a kernel crash.

[1] https://www.mail-archive.com/b.a.t.m.a.n@lists.open-mesh.org/msg15258.html
[2] https://www.mail-archive.com/b.a.t.m.a.n@lists.open-mesh.org/msg15252.html

Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic")
Signed-off-by: Sven Eckelmann <sven@...fation.org>
Signed-off-by: Antonio Quartulli <a@...table.cc>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
---

Cheers,

 net/batman-adv/bat_v_ogm.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/batman-adv/bat_v_ogm.c
+++ b/net/batman-adv/bat_v_ogm.c
@@ -529,8 +529,10 @@ static void batadv_v_ogm_route_update(st
 		goto out;
 	}

-	if (router)
+	if (router) {
 		batadv_neigh_node_put(router);
+		router = NULL;
+	}

 	/* Update routes, and check if the OGM is from the best next hop */
 	batadv_v_ogm_orig_update(bat_priv, orig_node, neigh_node, ogm2,