netdev - [PATCH net 1/2] macsec: fix use-after-free of skb during RX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <88846d6ff622a908655562e0be1a094e3b5a3b2d.camel@domdv.de>
Date:   Sun, 30 Jun 2019 22:46:42 +0200
From:   Andreas Steinmetz <ast@...dv.de>
To:     netdev@...r.kernel.org
Cc:     Sabrina Dubroca <sd@...asysnail.net>
Subject: [PATCH net 1/2] macsec: fix use-after-free of skb during RX

Fix use-after-free of skb when rx_handler returns RX_HANDLER_PASS.

Signed-off-by: Andreas Steinmetz <ast@...dv.de>

--- a/drivers/net/macsec.c	2019-06-05 20:23:27.640154747 +0200
+++ b/drivers/net/macsec.c	2019-06-05 20:23:46.791565816 +0200
@@ -1103,10 +1103,9 @@ static rx_handler_result_t macsec_handle
 	}
 
 	skb = skb_unshare(skb, GFP_ATOMIC);
-	if (!skb) {
-		*pskb = NULL;
+	*pskb = skb;
+	if (!skb)
 		return RX_HANDLER_CONSUMED;
-	}
 
 	pulled_sci = pskb_may_pull(skb, macsec_extra_len(true));
 	if (!pulled_sci) {