netdev - Re: [PATCH net] mpls: fix possible use after free of device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 05 Jun 2015 14:08:26 -0500
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Robert Shearman <rshearma@...cade.com>
Cc:	<netdev@...r.kernel.org>, "David S. Miller" <davem@...emloft.net>,
	<roopa@...ulusnetworks.com>
Subject: Re: [PATCH net] mpls: fix possible use after free of device

Robert Shearman <rshearma@...cade.com> writes:

> The mpls device is used in an RCU read context without a lock being
> held. As the memory is freed without waiting for the RCU grace period
> to elapse, the freed memory could still be in use.
>
> Address this by using kfree_rcu to free the memory for the mpls device
> after the RCU grace period has elapsed.

Acked-by: "Eric W. Biederman" <ebiederm@...ssion.com>


> Fixes: 03c57747a702 ("mpls: Per-device MPLS state")
> Signed-off-by: Robert Shearman <rshearma@...cade.com>
> ---
>  net/mpls/af_mpls.c  | 2 +-
>  net/mpls/internal.h | 1 +
>  2 files changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
> index 7b3f732269e4..bff427f31924 100644
> --- a/net/mpls/af_mpls.c
> +++ b/net/mpls/af_mpls.c
> @@ -541,7 +541,7 @@ static void mpls_ifdown(struct net_device *dev)
>  
>  	RCU_INIT_POINTER(dev->mpls_ptr, NULL);
>  
> -	kfree(mdev);
> +	kfree_rcu(mdev, rcu);
>  }
>  
>  static int mpls_dev_notify(struct notifier_block *this, unsigned long event,
> diff --git a/net/mpls/internal.h b/net/mpls/internal.h
> index b064c345042c..8cabeb5a1cb9 100644
> --- a/net/mpls/internal.h
> +++ b/net/mpls/internal.h
> @@ -16,6 +16,7 @@ struct mpls_dev {
>  	int			input_enabled;
>  
>  	struct ctl_table_header *sysctl;
> +	struct rcu_head		rcu;
>  };
>  
>  struct sk_buff;
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html